enVVeno Medical (NVNO) Risk Analysis

On August 19, 2025, the Company received a not-approvable letter from the FDA in response to its PMA application for the VenoValve. The letter indicated that the FDA completed its review of the VenoValve PMA application and determined that it is unable to approve the PMA for the VenoValve in its current form. In particular, the FDA indicated that the favorable rVCSS data generated by the study to show clinical improvement, together with the improvements in pain scores and venous specific quality of life indicators was not sufficient on its own to determine favorability of the benefit risk profile for the VenoValve. Without a specific hemodynamic measurement that correlates with patient improvement, the FDA raised concerns about bias and the possibility that clinical improvement occurred as a result of the patients being enrolled in a study. The FDA also focused on safety concerns which were attributed to the VenoValve open surgical procedure, and that required re-hospitalizations. On September 18, 2025, the Company filed a request for supervisory appeal of the not-approvable letter from the Center for Devices and Radiological Health (CDRH) of the FDA received on August 19, 2025, in response to its PMA application for the VenoValve. The FDA provides several internal informal and formal mechanisms to challenge staff decisions, including scientific controversies. One mechanism is a request for supervisory review in which an appeal is made to the next line of supervision. These appeals involve a formal substantive request, an in-person meeting, and a decision. It also often includes multiple interactions even after an initial appeal decision is made. Internal Agency reviews are based on information already in the administrative file. In October 2025, the Company completed an in-person meeting with the FDA. In addition to representatives from an outside firm specializing in FDA matters and appeals and representatives from the Company, the meeting also included a patient advocate from VenoValve U.S. pivotal study as well as one of the Company's primary investigators from the trial. Several employees from the FDA attended the meeting including the Director of the Center for Devices and Radiological Health, who elected to hear the appeal and who will be issuing the appeal decision. The FDA meeting provided the Company with the opportunity to put the major adverse events-those tied to the SAVVE study's safety endpoints-into the proper context. It also allowed the Company to re-emphasize the multiple physician-and patient-reported clinical benefits that comprise the totality of the evidence from the study, supported by firsthand perspectives shared by both the SAVVE study patient and investigator in attendance. Because there are no established industry or regulatory standards to determine the effectiveness for a replacement venous valve, it is necessary for the Company and the Agency to establish a new regulatory pathway for VenoValve effectiveness. On November 13, 2025, the Company received an unfavorable decision from the FDA in response to its supervisory appeal of the not-approvable letter. The supervisory appeal upheld the review staff decision in the not-approvable letter that the VenoValve did not meet the standard of reasonable assurance of safety and effectiveness. In light of receiving a not-approvable letter from the FDA and an unfavorable decision from the FDA in response to its supervisory appeal of the not-approvable letter, there can be no assurances that the Company will ever get regulatory approval for the VenoValve or for the enVVe System.

We currently have one product candidate, the enVVe System, and our business presently depends entirely on our success with this product candidate. In order for our product candidate to succeed it needs to be approved by regulatory authorities, which may never happen. Our product candidate is based on technologies that have not been used previously in the manner we propose. Market acceptance of our product candidates will largely depend on our ability to demonstrate their relative safety, efficacy, cost-effectiveness and ease of use. We may not be able to successfully develop and commercialize our product candidate. If we fail to do so, we will not be able to generate substantial revenues, if any. We are subject to rigorous and extensive regulation by the FDA in the United States and by comparable agencies in other jurisdictions, including the European Medicines Agency, or EMA, in the European Union, or EU. Our product candidate is currently in development, and we have not received FDA approval for it. Our product candidate may not be marketed in the United States until they have been approved by the FDA and may not be marketed in other jurisdictions until they have received approval from the appropriate foreign regulatory agencies. A product candidate requires significant research, development, pre-clinical testing and extensive clinical investigation before submission of any regulatory application for marketing approval. For example, on August 19, 2025, the Company received a not-approvable letter from the FDA in response to its PMA application for the VenoValve. While the enVVe System is different than the VenoValve in that it is a non-surgical, transcatheter based replacement venous valve, the enVVe System may also not receive FDA approval. Obtaining regulatory approval requires substantial time, effort and financial resources, and we may not be able to obtain approval of any of our product candidates on a timely basis, or at all. The number, size, design and focus of pre-clinical and clinical trials that will be required for approval by the FDA, the EMA or any other foreign regulatory agency varies depending on the device, the disease or condition that the product candidates are designed to address and the regulations applicable to particular products. Pre-clinical and clinical data can be interpreted in different ways, which could delay, limit or preclude regulatory approval. The FDA, the EMA and other foreign regulatory agencies can delay, limit or deny approval of a product for many reasons, including, but not limited to: - a product candidate may not be shown to be safe or effective;   - the clinical and other benefits of a product candidate may not outweigh its safety risks;   - we may not be able to enroll enough patients to complete our product studies;   - clinical trial results may be negative or inconclusive, or adverse medical events may occur during a clinical trial;   - trial patients may expire from reasons unrelated to our product, impairing our trials;   - the results of clinical trials may not meet the level of statistical significance required by regulatory agencies for approval;   - regulatory agencies may interpret data from pre-clinical and clinical trials in different ways than we do;   - regulatory agencies may not approve the manufacturing process or determine that the manufacturing is not in accordance with current good manufacturing practices, or cGMPs;   - a product candidate may fail to comply with regulatory requirements; and/or   - regulatory agencies might change their approval policies or adopt new regulations. For example, with respect to the VenoValve, the FDA indicated that the favorable rVCSS data generated by the study to show clinical improvement, together with the improvements in pain scores and venous specific quality of life indicators was not sufficient on its own to determine favorability of the benefit risk profile for the VenoValve. The FDA also referenced the use of a hemodynamic measurement that correlates with patient improvement, concerns about bias and the possibility that clinical improvement occurred as a result of the patients being enrolled in a study and safety concerns attributed to the VenoValve open surgical procedure, and that required re-hospitalizations. If our current and future product candidates are not approved at all or quickly enough to provide net revenues to defray our operating expenses, our business, financial condition, operating results and prospects could be harmed.

Our product candidates and operations are subject to extensive regulation in the United States by the FDA and by regulatory agencies in other countries where we anticipate conducting business activities. The FDA regulates the development, testing, manufacturing, labeling, storage, record-keeping, promotion, marketing, sales, distribution and post-market support and reporting of medical devices in the United States. The regulations to which we are subject are complex and may become more stringent over time. Regulatory changes could result in restrictions on our ability to carry on or expand our operations, higher than anticipated costs or lower than anticipated sales. In order to conduct a clinical investigation involving human subjects for the purpose of demonstrating the safety and effectiveness of a medical device, a company must, among other things, apply for and obtain Institutional Review Board, or IRB, approval of the proposed investigation. In addition, if the clinical study involves a "significant risk" (as defined by the FDA) to human health, the sponsor of the investigation must submit and obtain FDA approval of an IDE application. Our product candidates are considered significant risk devices requiring IDE approval prior to investigational use. We may not be able to obtain FDA and/or IRB approval to undertake clinical trials in the United States for any new devices we intend to market in the United States in the future. If we do obtain such approvals, we may not be able to conduct studies which comply with the IDE and other regulations governing clinical investigations or the data from any such trials may not support clearance or approval of the investigational device. Failure to obtain such approvals or to comply with such regulations could have a material adverse effect on our business, financial condition and results of operations. It is uncertain whether clinical trials will meet desired endpoints, produce meaningful or useful data and be free of unexpected adverse effects, or that the FDA will accept the validity of foreign clinical study data, and such uncertainty could preclude or delay market clearance or authorizations resulting in significant financial costs and reduced revenue.

In the United States, our product candidates are regulated as medical devices. Before our medical device product candidates may be marketed in the United States, we must submit, and the FDA must approve a PMA application. For the PMA approval process, the FDA must determine that a proposed device is safe and effective for its intended use based, in part, on extensive data, including, but not limited to, technical, pre-clinical, clinical trial, manufacturing and labeling data. In addition, modifications to products that are approved through a PMA application generally require FDA approval. The time required to obtain approval, clearance or license by the FDA to market a new therapy is unpredictable but typically takes years and depends upon many factors, including the substantial discretion of the FDA, especially after the Company received a not-approvable letter from the FDA related to the VenoValve. This timeline may be further extended as a result of the recent reduction in workforce that has taken place within the federal government, including at the FDA. Our product candidates could fail to receive regulatory approval, clearance or license for many reasons, including the following: - the FDA may disagree with the design or implementation of our clinical trials or study endpoints;   - we may be unable to demonstrate to the satisfaction of the FDA that our product candidates are safe and effective for their proposed indications or that our product candidates provide significant clinical benefits;   - the results of our clinical trials may not meet the level of statistical significance required by the FDA for approval, clearance or license or may not support approval of a label that could command a price sufficient for us to be profitable;   - the FDA may disagree with our interpretation of data from pre-clinical studies or clinical trials;   - the opportunity for bias in the clinical trials as a result of the open-label design may not be adequately handled and may cause our trial to fail;   - our product candidates may be subject to an FDA advisory committee review, which may be requested at the sole discretion of the FDA, and which may result in unexpected delays or hurdles to approval;   - the FDA may determine that the manufacturing processes at our facilities or facilities of third-party manufacturers with which we contract for clinical and commercial supplies are inadequate;- the FDA may determine we cannot continue our clinical trials due to adverse patient reactions including patient deaths for reasons unrelated to our products; and   - the approval, clearance or license policies or regulations of the FDA may significantly change in a manner rendering our clinical data insufficient for approval. For example, with respect to the VenoValve, the FDA indicated that the favorable rVCSS data generated by the study to show clinical improvement, together with the improvements in pain scores and venous specific quality of life indicators was not sufficient on its own to determine favorability of the benefit risk profile for the VenoValve. The FDA also referenced the use of a hemodynamic measurement that correlates with patient improvement, concerns about bias and the possibility that clinical improvement occurred as a result of the patients being enrolled in a study and safety concerns attributed to the VenoValve open surgical procedure, and that required re-hospitalizations. Even if we were to obtain approval, clearance or license, the FDA may grant approval, clearance or license contingent on the performance of costly post-marketing clinical trials or may approve our product candidates with a label that does not include the labeling claims necessary or desirable for successful commercialization of our product candidates. Any of the above could materially harm our product candidates' commercial prospects.

The manufacturing processes, post-approval clinical data and promotional activities of any product candidate for which we obtain marketing approval will be subject to continual review and periodic inspections by the FDA and other regulatory bodies. Even if regulatory approval of our product candidates is granted in the United States or elsewhere, the approval may be subject to limitations on the indicated uses for which the product candidates may be marketed or contain requirements for costly post-marketing testing and surveillance to monitor the safety or effectiveness of the product. Later discovery of previously unknown and unanticipated problems with our product candidates, including but not limited to unanticipated severity or frequency of adverse events, delays or problems with the manufacturer or manufacturing processes, or failure to comply with regulatory requirements, may result in restrictions on such product candidates or manufacturing processes, withdrawal of the product candidates from the market, voluntary or mandatory recall, fines, suspension of regulatory approvals, product seizures, injunctions or the imposition of civil or criminal penalties.

All manufacturers marketing medical devices in the EEA are legally bound to report incidents involving devices they produce or sell to the regulatory agency, or competent authority, in whose jurisdiction the incident occurred. Under the EU Medical Devices Directive (Directive 93/42/EEC), an incident is defined as any malfunction or deterioration in the characteristics and/or performance of a device, as well as any inadequacy in the labeling or the instructions for use which, directly or indirectly, might lead to or might have led to the death of a patient, or user or of other persons or to a serious deterioration in their state of health. In addition, under the EU MDR, the manufacturers are obligated to publish Periodic Safety Update Report (annually for high risk devices) which will be uploaded to EUDAMED and require conformity assessment by Notified Bodies. Malfunction or misuse of our product candidates could result in future voluntary corrective actions, such as recalls, including corrections (e.g., customer notifications), or agency action, such as inspection or enforcement actions. If malfunctions or misuse do occur, we may be unable to correct the malfunctions adequately or prevent further malfunctions or misuse, in which case we may need to cease manufacture and distribution of the affected products, initiate voluntary recalls, and redesign the products or the instructions for use for those products. Regulatory authorities may also take actions against us, such as ordering recalls, imposing fines, or seizing the affected products. Any corrective action, whether voluntary or involuntary, will require the dedication of our time and capital, may distract management from operating our business, and may harm our business, results of operations and financial condition.

From time to time, legislation is drafted and introduced in the U.S. Congress that could significantly change the statutory provisions governing the regulation of medical devices or the reimbursement thereof. In addition, the FDA regulations and guidance are often revised or reinterpreted by the FDA in ways that may significantly affect our business and our product candidates. For example, as part of the Food and Drug Administration Safety and Innovation Act, or FDASIA, Congress reauthorized the Medical Device User Fee Amendments with various FDA performance goal commitments and enacted several "Medical Device Regulatory Improvements" and miscellaneous reforms, which are further intended to clarify and improve medical device regulation both pre- and post-clearance or approval. Any new statutes, regulations or revisions or reinterpretations of existing regulations may impose additional costs or lengthen review times of any future products or make it more difficult to manufacture, market or distribute our product candidates or future products. We cannot determine what effect changes in regulations, statutes, legal interpretation or policies, when and if promulgated, enacted or adopted may have on our business in the future. Such changes could, among other things, require: - additional testing prior to obtaining clearance or approval;   - changes to manufacturing methods;   - recall, replacement or discontinuance of our systems or future products; or   - additional record keeping. Any of these changes could require substantial time and cost and could harm our business and our financial results. The highly publicized PIP scandal (use of non-medical grade silicone in breast implants) in 2010 led to publishing the first version of EU Medical Device Regulation (MDR) by European Commission in 2012. After 347 amendments by European Parliament in 2014, followed by various versions, the final version of the new EU Medical Device Regulation (MDR 2017/745) was published on May 5, 2017. Notified Bodies are currently not accepting any new CE Mark applications under MDD (Medical Device Directives). All new medical devices, including ours, must undergo assessment under MDR. The changes from EU Medical Device Directives (MDD) to Medical Device Regulation (MDR) are significant, with stricter clinical requirements and post-market surveillance, shift from pre-approval to Life-cycle approach, centralized EUDAMED database for public transparency (e.g. Periodic Safety Update Reports) and device registration, more device specific requirements (e.g. Common Specifications), legal liability for defective devices, etc. The QMS audit under MDR will be much more rigorous, including audits and assessment of suppliers and device testing. In addition, EU MDR introduces new stakeholders participating during the application review process, which will result in a longer and more burdensome assessment of our new products. The new stakeholders will include Medical Device Coordination Group (MDCG) established by Member States and Expert Panels appointed by European Union. Further, under either the FDA's Medical Device Reporting or MDR regulations, we are required to report to the FDA any incident in which our product candidates may have caused or contributed to a death or serious injury or in which our product malfunctioned and, if the malfunction were to recur, would likely cause or contribute to death or serious injury. Any adverse event involving our products could result in future voluntary corrective actions, such as product actions or customer notifications, or regulatory authority actions, such as inspection, mandatory recall or other enforcement action. Repeated product malfunctions may result in a voluntary or involuntary product recall, which could divert managerial and financial resources, impair our ability to manufacture our product candidates in a cost-effective and timely manner and have an adverse effect on our reputation, financial condition and operating results. Moreover, depending on the corrective action we take to redress a product's deficiencies or defects, the FDA may require us, or we may decide that we will need, to obtain new approvals or clearances for the device before we may market or distribute the corrected device. Seeking such approvals or clearances may delay our ability to replace the recalled devices in a timely manner. Moreover, if we do not adequately address problems associated with our product candidates, we may face additional regulatory enforcement action, including FDA warning letters, product seizure, injunctions, administrative penalties, withdrawals or clearances or approvals or civil or criminal fines. We may also be required to bear other costs or take other actions that may have a negative impact on our sales as well as face significant adverse publicity or regulatory consequences, which could harm our business, including our ability to market our product candidates in the future.

Our operations are, and will continue to be, directly and indirectly affected by various federal, state or foreign healthcare laws, including, but not limited to, those described below. These laws include: - the federal Anti-Kickback Statute, which prohibits, among other things, persons from knowingly and willfully soliciting, receiving, offering or paying remuneration, directly or indirectly, in exchange for or to induce either the referral of an individual for, or the purchase, order or recommendation of, any good or service for which payment may be made under federal healthcare programs, such as the Medicare and Medicaid programs. A person or entity does not need to have actual knowledge of the federal Anti-Kickback Statute or specific intent to violate it to have committed a violation. In addition, the government may assert that a claim including items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the False Claims Act. Violations of the federal Anti-kickback Statute may result in substantial civil or criminal penalties, including criminal fines of up to $25,000, imprisonment of up to five years, civil penalties under the Civil Monetary Penalties Law of up to $50,000 for each violation, plus three times the remuneration involved, civil penalties under the federal False Claims Act of up to $11,000 for each claim submitted, plus three times the amounts paid for such claims and exclusion from participation in the Medicare and Medicaid programs;   - the federal False Claims Act, which prohibits, among other things, individuals or entities from knowingly presenting, or causing to be presented, claims for payment from Medicare, Medicaid or other federal third-party payors that are false or fraudulent. Suits filed under the False Claims Act, known as "qui tam" actions, can be brought by any individual on behalf of the government and such individuals, commonly known as "whistleblowers," may share in any amounts paid by the entity to the government in fines or settlement. When an entity is determined to have violated the False Claims Act, the government may impose penalties of not less than $5,500 and not more than $11,000, plus three times the amount of the damages that the government sustains due to the submission of a false claim and exclude the entity from participation in Medicare, Medicaid and other federal healthcare programs;   - the federal Civil Monetary Penalties Law, which prohibits, among other things, offering or transferring remuneration to a federal healthcare beneficiary that a person knows or should know is likely to influence the beneficiary's decision to order or receive items or services reimbursable by the government from a particular provider or supplier;   - HIPAA, as amended by the HITECH Act, and their respective implementing regulations, which governs the conduct of certain electronic healthcare transactions and protects the security and privacy of protected health information. Failure to comply with the HIPAA privacy and security standards can result in civil monetary penalties up to $50,000 per violation, not to exceed $1.5 million per calendar year for non-compliance of an identical provision, and, in certain circumstances, criminal penalties with fines up to $250,000 per violation and/or imprisonment. State attorneys general can bring a civil action to enjoin a HIPAA violation or to obtain statutory damages up to $25,000 per violation on behalf of residents of his or her state. HIPAA also imposes criminal penalties for fraud against any healthcare benefit program and for obtaining money or property from a healthcare benefit program through false pretenses and provides for broad prosecutorial subpoena authority and authorizes certain property forfeiture upon conviction of a federal healthcare offense. Significantly, the HIPAA provisions apply not only to federal programs, but also to private health benefit programs. HIPAA also broadened the authority of the U.S. Office of Inspector General of the U.S. Department of Health and Human Services to exclude participants from federal healthcare programs;   - the federal physician sunshine requirements under the Patient Protection and Affordable Care Act, or PPACA, which requires certain manufacturers of drugs, devices, biologics and medical supplies to report annually to the U.S. Department of Health and Human Services information related to payments and other transfers of value to physicians, which is defined broadly to include other healthcare providers and teaching hospitals and ownership and investment interests held by physicians and their immediate family members. Manufacturers are required to submit reports by the 90th day of each calendar year. Failure to submit the required information may result in civil monetary penalties up to an aggregate of $150,000 per year (and up to an aggregate of $1 million per year for "knowing failures") for all payments, transfers of value or ownership or investment interests not reported in an annual submission, and may result in liability under other federal laws or regulations; and - analogous state and foreign law equivalents of each of the above federal laws, such as anti-kickback and false claims laws which may apply to items or services reimbursed by any third- party payor, including commercial insurers; state laws that require device companies to comply with the industry's voluntary compliance guidelines and the applicable compliance guidance promulgated by the federal government or otherwise restrict payments that may be made to healthcare providers and other potential referral sources; state laws that require device manufacturers to report information related to payments and other transfers of value to physicians and other healthcare providers or marketing expenditures; and state laws governing the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Any failure by us to ensure that our employees and agents comply with applicable state and foreign laws and regulations could result in substantial penalties or restrictions on our ability to conduct business in those jurisdictions, and our results of operations and financial condition could be materially and adversely affected. The risk of our being found in violation of these laws is increased by the fact that many of them have not been fully interpreted by the regulatory authorities or the courts, and their provisions are open to a variety of interpretations. Because of the breadth of these laws and the narrowness of the statutory exceptions and safe harbors available under such laws, it is possible that some of our business activities, including our relationships with surgeons and other healthcare providers, some of whom recommend, purchase and/or prescribe our product candidates, and our distributors, could be subject to challenge under one or more of such laws. If our operations are found to be in violation of any of the laws described above or any other governmental regulations that apply to us now or in the future, we may be subject to penalties, including civil and criminal penalties, damages, fines, disgorgement, exclusion from governmental health care programs and the curtailment or restructuring of our operations, any of which could adversely affect our ability to operate our business and our financial results. Any action against us for violation of these laws, even if we successfully defend against it, could cause us to incur significant legal expenses and divert our management's attention from the operation of our business.

FDA regulations and guidance are often revised or reinterpreted by FDA and such actions may significantly affect our business and our product candidates. Any new regulations or revisions or reinterpretations of existing regulations may impose additional costs or lengthen review times for our product candidates. Delays in receipt of, or failure to receive, regulatory approvals for our product candidates would have a material and adverse effect on our business, results of operations and financial condition. In March 2010, the PPACA was signed into law. Initially it included a deductible 2.3% excise tax on any entity that manufactures or imports medical devices offered for sale in the United States, with limited exceptions. Although this excise tax was permanently repealed on December 20, 2019, it or similar taxes, may be enacted in the future. Other elements of the PPACA remain in force, including comparative effectiveness research, an independent payment advisory board and payment system reforms, including shared savings pilots and other provisions, which may significantly affect the payment for, and the availability of, healthcare services and result in fundamental changes to federal healthcare reimbursement programs, any of which may materially affect numerous aspects of our business, results of operations and financial condition. In addition, other legislative changes have been proposed and adopted in the United States since the PPACA was enacted. On August 2, 2011, the Budget Control Act of 2011 created measures for spending reductions by Congress. A Joint Select Committee on Deficit Reduction, tasked with recommending a targeted deficit reduction of at least $1.2 trillion for the years 2013 through 2021, was unable to reach required goals, thereby triggering the legislation's automatic reduction to several government programs. This includes aggregate reductions of Medicare payments to providers up to 2% per fiscal year, which went into effect on April 1, 2013. The 2% reduction in Medicare payments to providers, originally triggered by the Budget Control Act of 2011, has been extended multiple times. Most recently, the Consolidated Appropriations Act, 2023 extended this 2% sequester through fiscal year 2032. On January 2, 2013, the American Taxpayer Relief Act of 2012, or the ATRA, was signed into law which further reduced Medicare payments to certain providers, including hospitals. We expect that additional state and federal healthcare reform measures will be adopted in the future, any of which could limit the amounts that federal and state governments will pay for healthcare products and services, which could result in reduced demand for our product candidates, if approved, and services or additional pricing pressures.

Federal and state laws and regulations impose restrictions on our relationships with physicians who are consultants, owners and investors. We may enter into consulting agreements, license agreements and other agreements with physicians in which we provide cash as compensation. We have or may have other written and oral arrangements with physicians, including for research and development grants and for other purposes. We could be adversely affected if regulatory agencies were to interpret our financial relationships with these physicians, who may be in a position to influence the ordering of and use of our product candidates for which governmental reimbursement may be available, as being in violation of applicable laws. If our relationships with physicians are found to be in violation of the laws and regulations that apply to us, we may be required to restructure the arrangements and could be subject to administrative, civil and criminal penalties, including exclusion from participation in government healthcare programs, imprisonment, and the curtailment or restructuring of our operations, any of which could negatively impact our ability to operate our business and our results of operations.

Numerous federal and state laws and regulations, including the Health Insurance Portability and Accountability Act of 1996, or HIPAA, and the Health Information Technology for Economic and Clinical Health Act, or the HITECH Act, govern the collection, dissemination, security, use and confidentiality of health information that identifies specific patients. HIPAA and the HITECH Act require our surgeon and hospital customers and potential customers to comply with certain standards for the use and disclosure of health information within their companies and with third parties. The Privacy Standards and Security Standards under HIPAA establish a set of standards for the protection of individually identifiable health information by health plans, health care clearinghouses and certain health care providers, referred to as Covered Entities, and the business associates with whom Covered Entities enter into service relationships pursuant to which individually identifiable health information may be exchanged. Notably, whereas HIPAA previously directly regulated only these Covered Entities, the HITECH Act makes certain of HIPAA's privacy and security standards also directly applicable to Covered Entities' business associates. As a result, both Covered Entities and business associates are now subject to significant civil and criminal penalties for failure to comply with Privacy Standards and Security Standards. HIPAA requires Covered Entities (like many of our customers and potential customers) and business associates to develop and maintain policies and procedures with respect to protected health information that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information. The HITECH Act expands the notification requirement for breaches of patient-identifiable health information, restricts certain disclosures and sales of patient-identifiable health information and provides for civil monetary penalties for HIPAA violations. The HITECH Act also increased the civil and criminal penalties that may be imposed against Covered Entities and business associates and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorney fees and costs associated with pursuing federal civil actions. Additionally, certain states have adopted comparable privacy and security laws and regulations, some of which may be more stringent than HIPAA. Any new legislation or regulation in the area of privacy and security of personal information, including personal health information, could also adversely affect our business operations. If we do not comply with existing or new applicable federal or state laws and regulations related to patient health information, we could be subject to criminal or civil sanctions and any resulting liability could adversely affect our financial condition. In addition, countries around the world have passed or are considering legislation that would impose data breach notification requirements and/or require that companies adopt specific data security requirements. If we experience a data breach that triggers one or more of these laws, we may be subject to breach notification obligations, civil liability and litigation, all of which could also generate negative publicity and have a negative impact on our business.