Hepion Pharmaceuticals (HEPA) Risk Analysis

We need FDA approval prior to marketing our product candidates in the United States. If we fail to obtain FDA approval to market our product candidates, we will be unable to sell our product candidate in the United States and we will not generate any revenue. The FDA's review and approval process, including among other things, evaluation of preclinical studies and clinical trials of a product candidate as well as the manufacturing process and facility, is lengthy, expensive and uncertain. To receive approval, we must, among other things, demonstrate with substantial evidence from well-designed and well-controlled pre- clinical testing and clinical trials that the product candidate is both safe and effective for each indication for which approval is sought. Satisfaction of these requirements typically takes several years, and the time needed to satisfy them may vary substantially, based on the type, complexity and novelty of the pharmaceutical product. We cannot predict if or when we will submit an NDA for approval for our product candidate currently under development. Any approvals we may obtain may not cover all the clinical indications for which we are seeking approval or may contain significant limitations on the conditions of use. The FDA has substantial discretion in the NDA review process and may either refuse to file our NDA for substantive review or may decide that our data is insufficient to support approval of our product candidate for the claimed intended uses. Following any regulatory approval of our product candidate, we will be subject to continuing regulatory obligations such as safety reporting, required and additional post marketing obligations, and regulatory oversight of promotion and marketing. Even if we receive regulatory approvals, the FDA may subsequently seek to withdraw approval of our NDA if we determine that new data or a reevaluation of existing data show the product is unsafe for use under the conditions of use upon the basis of which the NDA was approved or based on new evidence of adverse effects or adverse clinical experience, or upon other new information. If the FDA does not file or approve our NDA or withdraws approval of our NDA, the FDA may require that we conduct additional clinical trials, preclinical or manufacturing studies and submit that data before it will reconsider our application. Depending on the extent of these or any other requested studies, approval of any applications that we submit may be delayed by several years, may require us to expend more resources than we have available, or may never be obtained at all. We will also be subject to a wide variety of foreign regulations governing the development, manufacture and marketing of our products to the extent we seek regulatory approval to develop and market our product candidate in a foreign jurisdiction. As of the date hereof we have not identified any foreign jurisdictions which we intend to seek approval from. Whether or not FDA approval has been obtained, approval of a product by the comparable regulatory authorities of foreign countries must still be obtained prior to marketing the product in those countries. The approval process varies, and the time needed to secure approval in any region such as the European Union or in a country with an independent review procedure may be longer or shorter than that required for FDA approval. We cannot assure you that clinical trials conducted in one country will be accepted by other countries or that an approval in one country or region will result in approval elsewhere.

As a developer of pharmaceuticals, even though we do not intend to make referrals of healthcare services or bill directly to Medicare, Medicaid or other third-party payers, certain federal and state healthcare laws and regulations pertaining to fraud and abuse, false claims and patients' privacy rights are and will be applicable to our business. We could be subject to healthcare fraud and abuse laws and patient privacy laws of both the federal government and the states in which we conduct our business. The laws include: - the federal healthcare program anti-kickback law, which prohibits, among other things, persons from soliciting, receiving or providing remuneration, directly or indirectly, to induce either the referral of an individual, for an item or service or the purchasing or ordering of a good or service, for which payment may be made under federal healthcare programs such as the Medicare and Medicaid programs;         - federal false claims laws which prohibit, among other things, individuals or entities from knowingly presenting, or causing to be presented, claims for payment from Medicare, Medicaid, or other third-party payers that are false or fraudulent, and which may apply to entities like us which provide coding and billing information to customers;         - the federal Health Insurance Portability and Accountability Act of 1996, which prohibits executing a scheme to defraud any healthcare benefit program or making false statements relating to healthcare matters and which also imposes certain requirements relating to the privacy, security and transmission of individually identifiable health information;         - the Federal Food, Drug, and Cosmetic Act, which among other things, strictly regulates drug manufacturing and product marketing, prohibits manufacturers from marketing drug products for off-label use and regulates the distribution of drug samples; and         - state law equivalents of each of the above federal laws, such as anti-kickback and false claims laws which may apply to items or services reimbursed by any third-party payer, including commercial insurers, and state laws governing the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and often are not preempted by federal laws, thus complicating compliance efforts. If our operations are found to be in violation of any of the laws described above or any governmental regulations that apply to us, we may be subject to penalties, including civil and criminal penalties, damages, fines and the curtailment or restructuring of our operations. Any penalties, damages, fines, curtailment or restructuring of our operations could adversely affect our ability to operate our business and our financial results. Although compliance programs can mitigate the risk of investigation and prosecution for violations of these laws, the risks cannot be entirely eliminated. Any action against us for violation of these laws, even if we successfully defend against it, could cause us to incur significant legal expenses and divert management's attention from the operation of our business. Moreover, achieving and sustaining compliance with applicable federal and state privacy, security and fraud laws may prove costly.

The product candidates that we, or our collaborators, may develop require regulatory approval to advance through clinical development and to ultimately be marketed and sold and are subject to extensive and rigorous domestic and foreign government regulation. In the U.S., the FDA regulates, among other things, the development, testing, manufacture, safety, efficacy, record-keeping, labeling, storage, approval, advertising, promotion, sale and distribution of pharmaceutical and biopharmaceutical products. Our product candidates are also subject to similar regulation by foreign governments to the extent we seek to develop or market them in those countries. We, or our collaborators, must provide the FDA and foreign regulatory authorities, if applicable, with preclinical and clinical data, as well as data supporting an acceptable manufacturing process, that appropriately demonstrate our product candidates' safety and efficacy before they can be approved for the targeted indications. Our product candidates have not been approved for sale in the U.S. or any foreign market, and we cannot predict whether we or our collaborators will obtain regulatory approval for any product candidates plan to develop. The regulatory review and approval process can take many years, is dependent upon the type, complexity, novelty of, and medical need for the product candidate, requires the expenditure of substantial resources, and involves post-marketing surveillance and vigilance and ongoing requirements for post-marketing studies or Phase 4 clinical trials. In addition, we or our collaborators may encounter delays in, or fail to gain, regulatory approval for our product candidate based upon additional governmental regulation resulting from future legislative, administrative action or changes in FDA's or other similar foreign regulatory authorities' policy or interpretation during the period of product development. Delays or failures in obtaining regulatory approval to advance our product candidate through clinical development, and ultimately commercialize them, may: - adversely impact our ability to raise sufficient capital to fund the development of our product candidate;         - adversely affect our ability to further develop or commercialize our product candidate;         - diminish any competitive advantages that we or our collaborators may have or attain; and         - adversely affect the receipt of potential milestone payments and royalties from the sale of our products or product revenues. Furthermore, any regulatory approvals, if granted, may later be withdrawn. If we or our collaborators fail to comply with applicable regulatory requirements at any time, or if post-approval safety concerns arise, we or our collaborators may be subject to restrictions or a number of actions, including: - delays, suspension or termination of clinical trials related to our products;         - refusal by regulatory authorities to review pending applications or supplements to approved applications;         - product recalls or seizures;         - suspension of manufacturing;         - withdrawals of previously approved marketing applications; and         - fines, civil penalties and criminal prosecutions. Additionally, at any time we or our collaborators may voluntarily suspend or terminate the preclinical or clinical development of a product candidate, or withdraw any approved product from the market if we believe that it may pose an unacceptable safety risk to patients, or if the product candidate or approved product no longer meets our business objectives. The ability to develop or market a pharmaceutical product outside of the U.S. is contingent upon receiving appropriate authorization from the respective foreign regulatory authorities. Foreign regulatory approval processes typically include many, if not all, of the risks and requirements associated with the FDA regulatory process for drug development and may include additional risks.

Even if our product candidate is successfully developed and we or a collaborator obtain the requisite regulatory approvals to commercialize it in the future, it may not gain market acceptance or utilization among physicians, patients or third-party payers. The degree of market acceptance that our product candidate may achieve will depend on several factors, including: - the therapeutic efficacy or perceived benefit of the product relative to existing therapies, if they exist;         - the timing of market approval and existing market for competitive drugs;         - the level of reimbursement provided by payers to cover the cost of the product to patients;         - the net cost of the product to the user or payer;         - the convenience and ease of administration of our product;         - the product's potential advantages over existing or alternative therapies;         - the actual or perceived safety of similar classes of products;         - the actual or perceived existence, prevalence and severity of negative side effects;         - the effectiveness of sales, marketing and distribution capabilities; and         - the scope of the product label approved by the FDA. There can be no assurance that physicians will choose to prescribe or administer our product, if approved, to the intended patient population. If our product does not achieve meaningful market acceptance, or if the market for our product proves to be smaller than anticipated, we may not generate significant revenues or ever become profitable.

Before we begin to manufacture, label and market additional clinical diagnostic products for commercial diagnostic use in the U.S., we may be required to obtain either clearance, marketing authorization or approval from the FDA and state regulatory authorities with jurisdiction over such products, unless an exemption applies or, in the case of the FDA, it exercises its enforcement discretion and refrains from enforcing its requirements. For example, the FDA currently refrains from enforcing its medical device requirements with respect to LDTs, which the FDA considers to be a type of in vitro diagnostic test that is designed, manufactured and used within a single properly licensed laboratory. The process of obtaining PMA from the FDA is much more rigorous, costly, lengthy and uncertain than the 510(k) clearance process. In the PMA approval process, the FDA must determine that a proposed device is safe and effective for its intended use based, in part, on extensive data, including, but not limited to, technical, preclinical, clinical trial, manufacturing and labeling data. Conversely, in the 510(k) clearance process, the FDA must determine that a proposed device is "substantially equivalent" to a legally marketed "predicate" device in order for the product to be cleared for marketing. To be "substantially equivalent," the proposed device must have the same intended use as the predicate device, and either have the same technological characteristics or if it has different technological characteristics as the predicate device, the proposed device must be as safe and effective as, and not raise different questions of safety or effectiveness than, the predicate device. Clinical data is sometimes required to support substantial equivalence. For lower-risk devices that would otherwise automatically be placed into Class III, which require a PMA because no predicate device is available and the devices do not fall within an existing 510(k)-exempt classification, an applicant may submit a de novo request to down classify the device into Class II or Class I, which would not require a PMA. In the de novo process, the FDA must determine that general and special controls are sufficient to provide reasonable assurance of the safety and effectiveness of a device, which is low to moderate risk and has no predicate. In other words, the applicant must justify the "down-classification" to Class I or II for a new product type that would otherwise automatically be placed into Class III, but is lower risk. Clinical data may be required. For laboratory tests for which FDA clearance, authorization or approval is required, the FDA may also require data to support analytical and clinical validity. The 510(k), de novo and PMA processes can be expensive and lengthy and require the payment of significant fees, unless an exemption applies. The FDA's 510(k) clearance pathway usually takes from three to nine months from submission, but it can take longer for a novel type of product. The FDA's de novo classification pathway usually takes from six to 12 months, but for many applicants can take up to 18 months or more. The process of obtaining a PMA generally takes from one to three years, or even longer, from the time the PMA is submitted to the FDA until an approval is obtained. Any delay or failure to obtain necessary regulatory clearances, authorizations or approvals would have a material adverse effect on our business, financial condition and prospects. The FDA can delay, limit or deny clearance, authorization or approval of a device for many reasons, including: - the inability to demonstrate to the satisfaction of the FDA that the products are safe or effective for their intended uses;     - the disagreement of the FDA with the design, conduct or implementation of the clinical trials or the analysis or interpretation of data from preclinical studies, analytical studies or clinical trials;     - serious and unexpected adverse device effects experienced by participants in clinical trials;     - the data from preclinical studies, analytical studies and clinical trials may be insufficient to support clearance, authorization or approval, where required;     - the inability to demonstrate that the clinical and other benefits of the device outweigh the risks;     - an advisory committee, if convened by the FDA, may recommend against approval of a PMA or other application or may recommend that the FDA require, as a condition of approval, additional preclinical studies or clinical trials, limitations on approved labeling or distribution and use restrictions, or even if an advisory committee makes a favorable recommendation, the FDA may still not approve the product;     - the FDA may identify deficiencies in our marketing application;     - the FDA may identify deficiencies in our or our collaborators' manufacturing processes, facilities or analytical methods;     - the potential for policies or regulations of the FDA or applicable foreign regulatory bodies to change significantly in a manner rendering clinical data or regulatory filings insufficient for clearance, authorization or approval; and     - the FDA or foreign regulatory authorities may audit clinical trial data and conclude that the data is not sufficiently reliable to support a PMA. There are numerous FDA personnel assigned to review different aspects of marketing submissions, which can present uncertainties based on their ability to exercise judgment and discretion during the review process. During the course of review, the FDA may request or require additional data and information, and the development and provision of these data and information may be time-consuming and expensive. The process of obtaining regulatory clearances, authorizations or approvals to market a medical device can be costly and time-consuming, and we may not be able to obtain these clearances, authorizations or approvals on a timely basis, or at all for our products in development. If we are unable to obtain clearance, authorization or approval for any products for which we plan to seek clearance, authorization or approval, our business may be harmed.

Even after we have obtained marketing authorization we must comply with the scope of that clearance, authorization or approval. Failure to comply with those limitations or the additional, extensive and ongoing post-marketing obligations imposed by the FDA or other regulatory requirements of other regulatory agencies, such as the Clinical Laboratory Evaluation Program for New York State, could result in unanticipated compliance expenditures, a range of administrative enforcement actions, injunctions and criminal prosecution. FDA post-market obligations include, among other things, compliance with the FDA QSR, establishing registration and device listings, labeling requirements, reporting of certain adverse events and malfunctions, and reporting of certain recalls. In addition, circumstances may arise that cause us to recall equipment used in connection with our products and services. Such recalls could have an adverse effect on our ability to provide those products and services, which in turn would adversely affect our financial condition. Our collaborators will also be required to maintain FDA clearance and possibly also other authorizations or approvals for the products and services that we jointly develop. Any failure by us or our collaborators to maintain such clearance, authorization or approval could impair or cause a delay in our ability to profit from these collaborations.

The life sciences industry is highly regulated, and the regulatory environment in which we and our collaborators operate may change significantly and adversely to us in the future. Areas of the regulatory environment that may affect our ability to conduct business include, without limitation, federal and state laws relating to: - laboratory testing, including CLIA and state laboratory licensing laws;     - the development, testing, use, distribution, promotion and advertising of research services, kits, clinical diagnostics and pharmaceutical therapies, including certain LDTs, and related services, which are regulated by the FDA under the FDCA and the FTC;     - test ordering, documentation of tests ordered, billing practices and claims payment under CMS and the HHS OIG enforcing those laws and regulations;     - cellular therapies, medical device and in vitro diagnostic clearance, marketing authorization or approval;     - laboratory anti-mark-up laws;     - the handling and disposal of medical and hazardous waste;     - fraud and abuse laws such as the False Claims Act, the AKS, EKRA, and the Stark Law;     - Occupational Safety and Health Administration rules and regulations;     - HIPAA and other federal and state data privacy and security laws;     - federal and state genetic information laws, such as the Genetic Information Nondiscrimination Act ("GINA") and similar state laws; and     - coverage and restrictions on coverage and reimbursement for clinical diagnostics and pharmaceutical therapies and Medicare, Medicaid, other governmental payors and private insurers reimbursement levels. In particular, the laws, regulations and policies governing the marketing of RUO products, LDTs and clinical diagnostic tests and services are extremely complex and are subject to interpretation by the courts and governmental agencies. Our failure to comply could lead to civil or criminal penalties, exclusion from participation in state and federal health care programs, or prohibitions or restrictions on our laboratories' ability to provide or receive payment for our services. We believe that we are in material compliance with all statutory and regulatory requirements, but there is a risk that one or more government agencies could take a contrary position, or that a private party could file suit under the qui tam provisions of the federal False Claims Act or a similar state law. Such occurrences, regardless of their outcome, could damage our reputation and adversely affect important business relationships with third parties, including managed care organizations, and other private third-party payors.

FINRA has adopted rules that require a broker-dealer to have reasonable grounds for believing that the investment is suitable for that customer before recommending an investment to a customer. Prior to recommending speculative low-priced securities to their non-institutional customers, broker-dealers must make reasonable efforts to obtain information about the customer's financial status, tax status, investment objectives, and other information. Under interpretations of these rules, FINRA believes that there is a high probability that speculative low-priced securities will not be suitable for at least some customers. Thus, the FINRA requirements make it more difficult for broker-dealers to recommend that their customers buy our common stock, which may limit your ability to buy and sell our shares of common stock, have an adverse effect on the market for our shares of common stock, and thereby depress our price per share of common stock.

Even if we or our collaborators obtain regulatory clearance, authorization, approval, accreditation or licensure in a jurisdiction for our products and services, the applicable regulatory authority may still impose significant restrictions on the indicated uses or marketing of our products and services, or impose ongoing requirements for potentially costly post-approval studies or post-market surveillance of our or our collaborators' manufacturing and distribution. Advertising for certain devices and labeling, including promotional labeling, for all devices must comply with FDA requirements. In addition, device advertising and promotion may also be subject to other federal and state laws. For example, the FDA shares jurisdiction over the regulation of device advertising with the FTC. Advertising for devices characterized as restricted by the FDA is subject to specified FDA requirements, while advertising for non-restricted devices is regulated by the FTC. If we or our collaborators fail to comply with applicable regulatory requirements following clearance, authorization, approval, accreditation or licensure of any of our products and services, a regulatory agency may: - initiate an inspection of our or our collaborators' facilities;     - issue an untitled or warning letter asserting that we or our collaborators are in violation of law;     - seek an injunction or impose civil or criminal penalties or monetary fines;     - suspend or withdraw regulatory clearance, authorization or approval, or revoke a license or accreditation;     - suspend any ongoing clinical studies;     - delay or refuse clearance, authorization or approval of a pending regulatory submission or supplement submitted by us or our collaborators;     - impose restrictions on our or our collaborators' cleared, authorized, approved, accredited or licensed products or services;     - seize or recall the product or service;     - partially suspend or entirely shut down our or our collaborators' manufacturing or laboratory operations;     - issue advisories or other field actions;     - impose operating restrictions;     - refuse to allow us or our collaborators to enter into supply contracts, including government contracts; or     - refer matters to the DOJ or other enforcement or regulatory bodies. Any government investigation of alleged violations of law could require us to expend significant time and resources in response and could generate negative publicity. The occurrence of any event or penalty described above may inhibit our and our collaborators' ability to commercialize any cleared, authorized or approved products and services and generate revenues.

Healthcare providers, physicians, hospitals and third-party payors often play a primary role in the recommendation and prescription of any currently marketed products and services for which we may obtain clearance, authorization or approval. Our current and future arrangements with healthcare providers, physicians, hospitals and third-party payors, and our sales, marketing and educational activities related to our products and services, may expose us to broadly applicable fraud and abuse and other healthcare laws and regulations at the federal and state level that may constrain our business or financial arrangements, and the relationships through which we market, sell and distribute our products and services. In addition, our operations are also subject to various federal and state fraud and abuse, physician payment transparency, and privacy and security laws, including, without limitation: The AKS, which prohibits, among other things, persons and entities, including clinical laboratories, from knowingly and willfully soliciting, receiving, offering or paying remuneration, whether directly or indirectly, overtly or covertly, in case or in kind, to induce or reward or in return for either the referral of an individual or the purchase, lease, order or recommendation of an item or service reimbursable, in whole or in part, under a federal healthcare program such as Medicare or Medicaid. The AKS has been interpreted broadly to apply to, among other things, arrangements between clinical laboratories and prescribers and purchasers of our tests. The term "remuneration" expressly includes kickbacks, bribes or rebates and has been broadly interpreted to include anything of value, including gifts, discounts, waivers of payment, ownership interests and any goods or services provided at less than their fair market value. There are several statutory exceptions and regulatory safe harbors protecting certain common activities from prosecution or other regulatory sanctions, however, these exceptions and safe harbors are drawn narrowly, and practices that do not fit squarely within an exception or safe harbor may be subject to scrutiny. The failure to meet all of the requirements of a particular statutory exception or regulatory safe harbor does not make the conduct per se illegal under the AKS. Instead, the legality of the arrangement will be evaluated on a case-by-case basis based on a cumulative review of the facts and circumstances to determine whether one purpose of the remuneration in the arrangement was to induce referrals or generate business that is payable by a federal healthcare program. A violation of the AKS may be grounds for the government or a whistleblower to assert that a claim for payment of items or services resulting from such violation constitutes a false or fraudulent claim for purposes of the False Claims Act. Moreover, certain AKS safe harbors currently protecting rebates paid by device manufacturers to third parties and other arrangements between device manufacturers and third parties may later be modified or repealed pursuant to a pending regulatory proposal, which could require us to revisit or modify our business practices. Our practices may not meet all of the criteria for safe harbor protection from AKS liability in all cases. A person or entity does not need to have actual knowledge of the AKS or specific intent to violate any AKS provisions to have committed a violation. In addition, renumeration may not be offered or provided to beneficiaries under the monetary penalty law provision prohibiting inducements to beneficiaries. Section 8122 of the SUPPORT Act, EKRA, which establishes an all-payor anti-kickback prohibition that extends to arrangements with recovery homes, clinical laboratories and clinical treatment facilities. EKRA includes a number of statutory exceptions, and directs agencies to develop further exceptions. Current EKRA exceptions in some cases reference, and in others differ from, the AKS safe harbors. Significantly, the EKRA prohibitions apply to the soliciting or receipt of remuneration for any referrals to recovery homes, clinical treatment facilities or clinical laboratories, whether or not related to the treatment of substance use disorders. Further, the EKRA prohibitions cover the payment or offer of remuneration to induce a referral to, or in exchange for, an individual using the services of such providers. EKRA creates additional risk that relationships with referral sources could be problematic. Federal civil and criminal false claims laws and civil monetary penalty laws, including the False Claims Act, which prohibits individuals or entities from, among other things, knowingly presenting, or causing to be presented, claims for payment to, or approval by, the federal government that are false, fictitious or fraudulent, or knowingly making, using or causing to be made or used a false record or statement material to a false or fraudulent claim to avoid, decrease or conceal an obligation to pay money to the federal government. As a result of a modification made by the Fraud Enforcement and Recovery Act of 2009, a claim includes "any request or demand" for money or property presented to the federal government. The False Claims Act also permits a private individual acting as a "whistleblower" to bring actions on behalf of the federal government alleging violations of the False Claims Act and to share in any monetary recovery. In addition, AKS violations implicate the False Claims Act. Conduct that results in a False Claims Act violation may also implicate various federal criminal statutes. The Criminal Health Care Fraud Statute, which imposes criminal and civil liability for knowingly and willfully executing, or attempting to execute, a scheme to defraud or to obtain, by means of false or fraudulent pretenses, representations or promises, any money or property owned by, or under the control or custody of, any healthcare benefit program, including private third-party payors, and knowingly and willfully falsifying, concealing or covering up by trick, scheme or device, a material fact or making any materially false, fictitious or fraudulent statement in connection with the delivery of or payment for healthcare benefits, items or services. Similar to the AKS, a person or entity does not need to have actual knowledge or specific intent to violate the Criminal Health Care Fraud Statute. The Stark Law, which is directed at "self-referral," prohibits, with certain exceptions, referrals for certain DHS, including laboratory services, that are covered by Medicare and Medicaid by physicians who personally, or through a family member, have an investment or ownership interest in, or a compensation arrangement with, an entity performing the tests. The prohibition also extends to payment for any testing referred in violation of the Stark Law. Because the Stark Law is a strict liability statute, proof of specific intent to violate the law is not a required element of a violation. Any person who engages in a scheme to circumvent the Stark Law's referral prohibition may be subject to significant fines for each such arrangement or scheme. In addition, any person who presents or causes to be presented a claim to Medicare or Medicaid in violation of the Stark Law is subject to civil monetary penalties applied to each bill submission, an assessment of up to three times the amount claimed and possible exclusion from participation in federal governmental payor programs, and those claims are considered false claims for which the parties to the arrangement may be liable under the False Claims Act. Bills submitted in violation of the Stark Law may not be paid by Medicare or Medicaid, and any person collecting any amounts with respect to any such prohibited bill is obligated to refund such amounts. Many states have comparable laws that are not limited to Medicare and Medicaid referrals. The Stark Law also places an annual cap on the amount of non-monetary compensation, which consists of meal spend and educational items, that a company can spend on a physician in the aggregate. We occasionally enter into financial relationships, usually compensation relationships, such as a consulting arrangement, with physicians who refer patients for testing. If these arrangements do not meet the Stark Law's requirements, any claims submitted to Medicare or Medicaid could violate the law and put both the physician referral source and us at risk. The administrative simplification provisions of HIPAA, as amended and supplemented by HITECH, impose, among other things, obligations, including mandatory contractual terms, with respect to safeguarding the privacy, security and transmission of protected health information ("PHI") held by certain healthcare providers, health plans and healthcare clearinghouses, known as covered entities, and their respective business associates. HITECH also created four new tiers of civil monetary penalties, amended HIPAA to make civil and criminal penalties directly applicable to business associates and gave state attorneys general new authority to file civil actions for damages or injunctions in federal court to enforce the federal HIPAA regulation and seek attorneys' fees and costs associated with pursuing federal civil actions. The HHS Office for Civil Rights ("OCR") has increased its focus on compliance and continues to train state attorneys general for enforcement purposes. GINA, which restricts employers and health insurance companies from requiring or using the results of genetic tests in specific contexts and does not provide a private right of action. A number of states have also adopted laws regarding genetic tests, some aligned with GINA and some with broader applicability, including granting broader rights to individuals and imposing strict obligations on organizations to safeguard genetic data and the results of any such testing. The Physician Payments Sunshine Act created under the ACA, and its implementing regulations, which requires applicable manufacturers of covered drugs, devices, biologics and medical supplies for which payment is available under Medicare, Medicaid or the State Children's Health Insurance Program, with certain exceptions, to annually report to HHS information related to certain payments or other transfers of value made or distributed to physicians and teaching hospitals, or to entities or individuals at the request of, or designated on behalf of, physicians and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family members. The Physician Payments Sunshine Act has been extended to payments and transfers of value to physician assistants, nurse practitioners and other mid-level healthcare providers for payments and other transfers of value made to these practitioners. In addition, certain state and local laws may impose additional transparency and healthcare compliance requirements on medical device manufacturers, as well as certain restrictions or limits on interactions with healthcare professionals. The FTCA, which the FTC interprets to require taking appropriate steps to secure consumers' personal information and considers the failures to do so to constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the FTCA. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Health information is considered sensitive data that merits stronger safeguards, and the FTC's guidance for appropriately securing consumers' personal information is consistent with what is required by the HIPAA Security Rule. Many states have passed comprehensive privacy laws, some states, most notably Massachusetts and Nevada, also have adopted laws requiring the implementation of security measures to protect personal information, and all 50 states and the District of Columbia, Puerto Rico and Guam, have adopted breach notification laws. Analogous state laws and regulations, such as state anti-kickback, self-referral and false claims laws, which may apply to items or services reimbursed by any third-party payor, including commercial insurers, and in some cases even in self-pay scenarios. In addition, some state laws require life sciences companies to comply with the industry's voluntary compliance guidelines and the relevant compliance guidance promulgated by the federal government, or to impose transparency requirements or restrictions on marketing activities. Various state, federal and foreign laws and regulations govern our ability to communicate, prospect, advertise and market our products and services through email, phone, text messages, facsimile and online methods. Because of the breadth of these laws and the narrowness of the exceptions and safe harbors available under them, it is possible that certain of our business activities could be subject to challenge under one or more of such laws. The scope and enforcement of each of these laws is uncertain and subject to rapid change in the current environment of healthcare reform, especially in light of the lack of applicable precedent and regulations. Federal and state enforcement bodies have recently increased their scrutiny of the ongoing interactions between healthcare companies and healthcare providers, which has led to a number of investigations, prosecutions, convictions and settlements in the healthcare industry. Ensuring that business arrangements with third parties comply with applicable healthcare laws, as well as responding to possible investigations by government authorities, can be time- and resource-consuming and can divert management's attention from our business. If our operations are found to be in violation of any of the health regulatory laws described above or any other laws that apply to us, we may be subject to penalties, including, but not limited to, criminal, civil and administrative penalties, damages, fines, disgorgement, individual imprisonment, possible exclusion from participation in government healthcare programs, injunctions, private qui tam actions brought by individual whistleblowers in the name of the government and the curtailment or restructuring of our operations, as well as additional reporting obligations and oversight if we become subject to a corporate integrity agreement or other agreement to resolve allegations of non-compliance with these laws, any of which could adversely affect our ability to operate our business and our results of operations.