If our clinical studies do not satisfy providers, payors, patients and others as to the reliability and performance of our EsoGuard test and the EsoCheck device, or any other product or service we may develop and seek to commercialize, we may experience reluctance or refusal on the part of physicians to order, and third-party payors to pay for, such test.
Although we have received FDA 510(k) clearance to market EsoCheck, and EsoGuard may be performed in our own CLIA-certified commercial clinical laboratory and marketed as an LDT, if the results of any research and clinical studies conducted by us, including those conducted for the purpose of obtaining FDA approval of the combined EsoGuard and EsoCheck product as an IVD device, and our sales and marketing activities relating to communication of these results, do not convince guidelines organizations, physicians and other healthcare providers, third-party payors and patients that EsoGuard and EsoCheck are safe and effective, we may experience reluctance or refusal on the part of physicians to order, and third-party payors to pay for, EsoGuard or EsoCheck, which could adversely affect our business prospects.
If the validity of an informed consent for a clinical trial of one of our products was challenged, we could be subject to fines, penalties, litigation, or regulatory sanctions, or other adverse consequences, including invalidating or requiring us to repeat clinical trials which could negatively affect our business and results of operations.
Our products are the subject of multiple clinical trials and we anticipate they will continue to be so in the future. We have implemented measures to ensure that data and biological samples that we receive have been collected from, and any procedures that have been performed using our products have been on, subjects who have provided appropriate informed consent. When we utilize clinical research contractor or partner with other third parties in connection with our studies, we rely upon them to comply with the requirements to obtain the subject's informed consent and to comply with applicable laws and regulations. The collection of data and samples in many different countries results in complex legal questions regarding the adequacy of informed consent and the status of genetic material under a large number of different legal systems. Those informed consents could be challenged and prove invalid, unlawful, or otherwise inadequate for our purposes. Any such findings against us, could force us to stop accessing or using data and samples or servicing or conducting clinical trials, which would hinder our product offerings or development. We could also become involved in legal actions, which could consume our management and financial resources.
EsoCheck and any other products we develop that receive regulatory clearance or approval will be subject to ongoing regulatory obligations and continued regulatory review, which may result in significant additional expense and subject us to penalties if we fail to comply with applicable regulatory requirements.
Even after regulatory clearance or approval has been obtained for our products, the cleared or approved product and its manufacturer remain subject to continual review by FDA or non-U.S. regulatory authorities. Our cleared or approved products may be subject to limitations on the indicated uses for which the product may be marketed, as in the case of the FDA 510(k) marketing clearance for our EsoCheck cell collection device. Furthermore, future approvals may contain requirements for potentially costly post-marketing follow-up studies to monitor the safety and efficacy of the approved product. There is a risk that FDA may modify or withdraw the approval of a product if the results of a post-approval study are not satisfactory or are inconsistent with previous studies. We may rely on third parties, such as contract research organizations, medical institutions and clinical investigators to conduct any post-approval studies. We will have limited control over the activities of these third parties and any post-approval studies may be delayed or halted prior to its completion for reasons outside our control.
In addition, we and our cleared or approved products will be subject to extensive and ongoing regulatory requirements by FDA and other regulatory authorities with regard to the labeling, packaging, adverse event reporting, storage, advertising, promotion and recordkeeping for our products. We and our contract manufacturers also will be required to comply with current good manufacturing practice ("cGMP") regulations regarding the manufacture of our products, which include requirements related to quality control and quality assurance as well as the corresponding maintenance of records and documentation. Further, regulatory authorities must approve these manufacturing facilities before they can be used to manufacture medical devices, and these facilities are subject to continual review and periodic inspections by FDA and other regulatory authorities for compliance with cGMP regulations. Operations at these facilities could be interrupted or halted if FDA or other governmental agency deems the findings of such inspections unsatisfactory.
Failure to comply with FDA or other regulatory requirements could result in fines, unanticipated compliance expenditures, recall or seizures of our products, total or partial suspension of production or distribution, restrictions on labeling and promotion, termination of ongoing research, disqualification of data for submission to regulatory authorities, enforcement actions, injunctions and criminal prosecution. If we or a third party discover previously unknown problems with a product, such as adverse events of unanticipated severity or frequency, or problems with the facility where the product is manufactured, a regulatory authority may impose restrictions on that product, the manufacturer or us, including requiring recall of the product from the market or suspension of manufacturing. We also may voluntarily recall a product. Any recalls could have an adverse effect on our ability to provide our products, which in turn would adversely affect our financial condition.
If we are found to be promoting the use of our devices for unapproved or "off-label" uses or engaging in other noncompliant activities, we may be subject to recalls, seizures, fines, penalties, injunctions, adverse publicity, prosecution, or other adverse actions, resulting in damage to our reputation and business.
Our labeling, advertising, promotional materials and user training materials must comply with FDA and other applicable laws and regulations, including the prohibition of the promotion of a medical device for a use that has not been cleared or approved by FDA. Obtaining 510(k) clearance or PMA approval only permits us to promote our products for the uses specifically cleared by FDA. Use of a device outside its cleared or approved indications is known as "off-label" use. Physicians and consumers may use our products off-label because FDA does not restrict or regulate a physician's choice of treatment within the practice of medicine nor is there oversight on patient use of over-the-counter devices. Although we may request additional cleared indications for our current products, FDA may deny those requests, require additional expensive clinical data to support any additional indications or impose limitations on the intended use of any cleared product as a condition of clearance. Even if regulatory clearance or approval of a product is granted, such clearance or approval may be subject to limitations on the intended uses for which the product may be marketed and reduce our potential to successfully commercialize the product and generate revenue from the product.
If FDA determines that our labeling, advertising, promotional materials, or user training materials, or representations made by our personnel, include the promotion of an off-label use for the device, or that we have made false or misleading or inadequately substantiated promotional claims, or claims that could potentially change the regulatory status of the product, the agency could take the position that these materials have misbranded our devices and request that we modify our labeling, advertising, or user training or promotional materials and/or subject us to regulatory or legal enforcement actions, including the issuance of an Untitled Letter or a Warning Letter, injunction, seizure, recall, adverse publicity, civil penalties, criminal penalties, or other adverse actions. It is also possible that other federal, state, or foreign enforcement authorities might take action if they consider our labeling, advertising, promotional, or user training materials to constitute promotion of an unapproved use, which could result in significant fines, penalties, or other adverse actions under other statutory authorities, such as laws prohibiting false claims for reimbursement. In that event, we would be subject to extensive fines and penalties and our reputation could be damaged and adoption of the products would be impaired. Although we intend to refrain from statements that could be considered off-label promotion of our products, FDA or another regulatory agency could disagree and conclude that we have engaged in off-label promotion. In addition, any such off-label use of our products may increase the risk of injury to patients, and, in turn, the risk of product liability claims, and such claims are expensive to defend and could divert our management's attention and result in substantial damage awards against us.
Clinical laboratories and medical diagnostic companies are subject to extensive and frequently changing federal, state, and local laws. We could be subject to significant fines and penalties if we fail (or if our prior unrelated third-party laboratory partner previously failed) to comply with these laws and regulations.
As a provider of clinical diagnostic products and services, we are subject (and our prior third-party laboratory partner previously was subject) to extensive and frequently changing federal, state, and local laws and regulations governing various other aspects of our business. In particular, the clinical laboratory industry is subject to significant governmental certification and licensing regulations, as well as federal and state laws regarding:
- test ordering and billing practices; - marketing, sales and pricing practices; - health information privacy and security, including the Health Insurance Portability and Accountability Act of 1996, or HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, or HITECH, and comparable state laws; - insurance; - anti-markup legislation; and - consumer protection.
We are also required to comply with FDA regulations, including with respect to our labeling and promotion activities. In addition, advertising of our tests is subject to regulation by the Federal Trade Commission, ("FTC") and advertising of laboratory services is regulated by certain state laws. Violation of any FDA requirement could result in enforcement actions, such as seizures, injunctions, civil penalties and criminal prosecutions, and violation of any FTC or state law requirement could result in injunctions and other associated remedies, all of which could have a material adverse effect on our business. Most states also have similar regulatory and enforcement authority for devices. Additionally, most foreign countries have authorities comparable to FDA and processes for obtaining marketing approvals. Obtaining and maintaining these approvals, and complying with all laws and regulations, may subject us to similar risks and delays as those we could experience under FDA, FTC and state regulation. We incur various costs in complying and overseeing compliance with these laws and regulations.
Healthcare policy has been a subject of extensive discussion in the executive and legislative branches of the federal and many state governments and healthcare laws and regulations are subject to change. Development of the existing commercialization strategy for our EsoGuard test and EsoCheck device has been based on existing healthcare policies. We cannot predict what additional changes, if any, will be proposed or adopted or the effect that such proposals or adoption may have on our business, financial condition and results of operations.
If we or our partners fail to comply with these laws and regulations, we could incur significant fines and penalties and our reputation and prospects could suffer. Additionally, any such partners could be forced to cease offering our products and services in certain jurisdictions, which could materially disrupt our business.
We operate Lucid Test Centers where prescribing physicians can send patients for EsoGuard testing, including undergoing specimen collection using EsoCheck. These Lucid Test Centers are subject to federal and state regulations which may be burdensome, costly or difficult to comply with. Failure to comply with these regulations could result in sanctions, fines or other enforcement actions which may be costly, time-consuming and limit our ability to utilize them and adversely impact our business.
As part of our commercialization efforts for EsoGuard, we are operating Lucid Test Centers in jurisdictions where a licensed health care professional, employed or contracted by us, will perform the esophageal cell collection procedure using EsoCheck and then package the specimen for transport to our CLIA-certified commercial clinical laboratory. The Lucid Test Centers may be deemed laboratory draw stations or outpatient centers or clinics, which may be subject to state licensure and operating requirements. In addition, states may require personnel performing the specimen collection procedure to be licensed and may require collaboration with or supervision by a physician. The health care professionals may also be subject to malpractice claims. We will need to purchase insurance policies to cover such claims but the coverage limits on such policies may be insufficient to cover any monetary awards for damages granted for such claims. In certain states, our Lucid Test Centers may trigger the corporate practice of medicine doctrine, a general prohibition in some jurisdictions against non-licensed individuals or corporations owning medical practices or employing physicians and other licensed HCPs. In many states, a general business corporation cannot directly employ health care professionals or enter any arrangement where the physicians or the healthcare professional is in any way controlled or directed by the corporation. Complying with these state regulations can be complex, burdensome and costly and we may be unable to do so in certain states, limiting our commercialization efforts and business in those states. The Lucid Test Centers may be subject to additional state regulations relating to the distribution of the collection devices, test orders, patient consents, medical necessity requirements and billing regulations.
We have invested heavily in regulatory and compliance infrastructure in an effort to ensure compliance with this regulatory framework, however, we cannot guarantee that we will remain in compliance with these rules at all times. Our failure to comply with these regulations in the operation of these Lucid Test Centers or in managing the personnel interacting with patients at these centers could subject us to sanctions, fines or other enforcement actions. Responding to these actions may be costly and time-consuming and may require us to cease operations at these centers which may limit our commercialization efforts and adversely impact our business.
We intend to engage with one or more third-party telemedicine companies to provide physicians to evaluate patients and, if clinically indicated, refer the patient to our Lucid Test Centers or to a #CheckYourFoodTube Precancer Testing Event, to undergo EsoCheck specimen collection for EsoGuard testing. Telemedicine is subject to numerous federal and state regulations and faces particularly intense scrutiny by these regulators. If we fail to comply with federal healthcare regulations, we could face substantial penalties, sanctions, fines or prosecution and our business, operations and financial condition could be adversely affected.
One element of our growth strategy is to expand EsoGuard commercialization across multiple channels, including by partnership with telemedicine providers. The logistics required to manage a patient's journey through a telemedicine program, in a manner which is compliant with all applicable regulations, are complex and require very careful coordination between us and our third-party telemedicine and laboratory partners broadly operating within our quality management system. Our activities and the activities of our third-party partners on our behalf within this telemedicine program are subject to numerous federal and state regulations. The telemedicine provider itself may be subject to additional state regulations relating to the corporate practice of medicine, test orders, patient consents, medical necessity requirements and billing regulations. Telemedicine faces particularly intense scrutiny from regulators due to numerous cases of companies failing to operate in this space with a properly functioning regulatory and compliance infrastructure.
We cannot guarantee that our personnel or those of our third-party partners will comply with the applicable regulations at all times. If any such personnel fail to comply with regulations, we could face substantial penalties, sanctions, fines or prosecution and our business, operations and financial condition could be adversely affected.
Many aspects of our business, beyond the specific elements described above, are subject to complex, intertwined, costly and/or burdensome federal health care laws and regulations which may open to interpretation and be subject to varying levels of discretionary enforcement. If we fail to comply with these laws and regulations, we could face substantial penalties and our business, operations and financial condition could be adversely affected.
Even though we do not and do not expect to control referrals of healthcare services or bill directly to Medicare, Medicaid or other third-party payors, certain federal and state healthcare laws and regulations pertaining to fraud and abuse and patients' rights are and will be applicable to our business. We could be subject to healthcare fraud and abuse and patient privacy regulation by both the federal government and the states in which we conduct our business. The regulations that may affect our ability to operate include, without limitation:
- the federal healthcare program Anti-Kickback Statute, which prohibits, among other things, any person from knowingly and willfully offering, soliciting, receiving, or providing remuneration, directly or indirectly, in exchange for or to induce either the referral of an individual for, or the purchase, order or recommendation of, any good or service for which payment may be made under federal healthcare programs, such as the Medicare and Medicaid programs; - the U.S. Foreign Corrupt Practices Act, or "FCPA," which prohibits payments or the provision of anything of value to foreign officials for the purpose of obtaining or keeping business; - the federal False Claims Act, or "FCA," which prohibits, among other things, individuals or entities from knowingly presenting, or causing to be presented, false claims, or knowingly using false statements, to obtain payment from the federal government, and which may apply to entities like us which provide coding and billing advice to customers; - federal criminal laws that prohibit executing a scheme to defraud any healthcare benefit program or making false statements relating to healthcare matters; - the federal transparency requirements under the Health Care Reform Law requires manufacturers of drugs, devices, biologics and medical supplies to report to the Department of Health and Human Services information related to physician payments and other transfers of value and physician ownership and investment interests; - the federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, which governs the conduct of certain electronic healthcare transactions and protects the security and privacy of protected health information, and - state law equivalents of each of the above federal laws, such as anti-kickback and false claims laws which may apply to items or services reimbursed by any third-party payor, including commercial insurers.
The Patient Protection and Affordable Care Act (the "PPACA"), among other things, amends the intent requirement of the Federal Anti-Kickback Statute and criminal healthcare fraud statutes. A person or entity no longer needs to have actual knowledge of this statute or specific intent to violate it. In addition, the PPACA provides that the government may assert that a claim including items or services resulting from a violation of the Federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the FCA.
In 2018, Congress passed Eliminating Kickbacks in Recovery Act ("EKRA") as part of the Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act. Similar to the Anti-Kickback Statute, EKRA imposes criminal penalties for knowing or willful payment or offer, or solicitation or receipt, of any remuneration, whether directly or indirectly, overtly or covertly, in cash or in kind, in exchange for the referral or inducement of laboratory testing (among other healthcare services) unless a specific exception applies. However, unlike the Anti-Kickback Statute, EKRA is not limited to services covered by federal or state healthcare programs but applies more broadly to services covered by "healthcare benefit programs," including commercial insurers. EKRA potentially expands the universe of arrangements that could be subject to government enforcement under federal fraud and abuse laws. In addition, while the Anti-Kickback Statute includes certain exceptions that are widely relied upon in the healthcare industry, not all of those same exceptions apply under EKRA. We cannot assure you that our relationships with healthcare providers, sales representatives, hospitals, customers, or any other party will not be subject to scrutiny or will survive regulatory challenge under EKRA.
If our operations or arrangements are found to be in violation of any of the laws described above or any other governmental regulations that apply to us, we may be subject to penalties, including civil and criminal penalties, damages, fines, exclusion from the Medicare and Medicaid programs and the curtailment or restructuring of our operations. Any penalties, damages, fines, exclusions, curtailment or restructuring of our operations could adversely affect our ability to operate our business and our financial results. The risk of us being found in violation of these laws is increased by the fact that many of these laws are broad and their provisions are open to a variety of interpretations. Any action against us for violation of these laws, even if we successfully defend against that action and the underlying alleged violations, could cause us to incur significant legal expenses and divert our management's attention from the operation of our business. If the physicians or other providers or entities with whom we do business are found to be non-compliant with applicable laws, they may be subject to sanctions, which could also have a negative impact on our business. Moreover, achieving and sustaining compliance with applicable federal and state privacy, security and fraud laws may prove costly.
The regulations that govern pricing and reimbursement for new products vary widely from country to country, and may adversely affect the pricing, coverage and reimbursement rates of our products in other countries.
The regulations that govern pricing and reimbursement for new products vary widely from country to country. Some countries require approval of the sale price of a product before it can be marketed. In many countries, the pricing review period begins after marketing clearance or approval is granted. In some foreign markets, pricing remains subject to continuing governmental control even after initial approval is granted. As a result, we might obtain regulatory clearance or approval for a product in a particular country, but then be subject to price regulations that delay our commercial launch of the product and negatively impact the revenue we are able to generate from the sale of the product in that country. In addition, to obtain reimbursement or pricing approval in some countries, we may be required to conduct a clinical trial that compares the cost-effectiveness of our product to other available therapies. Adverse pricing limitations may hinder our ability to recoup our investment in the EsoGuard and EsoCheck products and any other products, tests or services we develop, even if our products obtain regulatory approval.
Due to billing complexities in the diagnostic and laboratory service industry, we may not be able to collect payment for the EsoGuard tests we perform.
Billing for diagnostic and laboratory services is a complex process. Laboratories bill many different payors including patients, private insurance companies, Medicare, Medicaid, and employer groups, all of which have different billing requirements. We are continuing to work with third-party payors to cover and reimburse EsoGuard tests. If we are unsuccessful, we may not receive payment for EsoGuard tests we perform for patients on a timely basis, if at all, and we may not be able to provide services for patients with certain healthcare plans. We may face lawsuits by government or commercial payors if they believe they have overpaid us for our EsoGuard test services. We may face write-offs of doubtful accounts, disputes with payors and patients, and long collection cycles. We may face patient dissatisfaction, complaints or lawsuits, including to the extent EsoGuard tests are not fully covered by insurers and patients become responsible for all or part of the price of the test. As a result, patient compliance in fulfilling prescriptions for EsoGuard could be adversely affected. To the extent patients express dissatisfaction with our billing practices to their physicians, those physicians may be less likely to prescribe EsoGuard for other patients, and our business would be adversely affected.
Even if payors do agree to cover EsoGuard, our billing and collections process may be complicated by the following and other factors, which may be beyond our control:
- disputes among payors as to which payor is responsible for payment; - disparity in coverage among various payors or among various healthcare plans offered by a single payor; - payer medical management requirements, including prior authorization requirements; - differing information and billing requirements among payors; and - failure by patients or physicians to provide complete and correct billing information.
Furthermore, our contracts with a commercial payor may not permit us to bill patients insured by that payor for amounts beyond deductibles, co-payments and co-insurance as prescribed in the coverage agreement between the payor and the patients. Moreover, when contracted payors do not cover an EsoGuard test, for example, for failure to satisfy prior-authorization or other payor medical management requirements, we may not be permitted to collect the balance from the patient and our business may be adversely impacted.
The uncertainty of receiving payment for our EsoGuard test and complex laboratory billing processes could negatively affect our business and our operating results.
Healthcare reform measures could hinder or prevent our products' commercial success.
There may well be legislative and regulatory proposals at the federal and state levels directed at containing or lowering the cost of health care. We cannot predict the initiatives that may be adopted in the future or their full impact. The continuing efforts of the government, insurance companies, managed care organizations and other payors of healthcare services to contain or reduce costs of health care may adversely affect:
- our ability to set a price that we believe is fair for our products; - our ability to generate revenue and achieve or maintain profitability; and - the availability of capital.
Further, changes in regulatory requirements and guidance may occur, both in the United States and in foreign countries, and we may need to amend clinical study protocols to reflect these changes. Amendments may require us to resubmit our clinical study protocols to an IRB for reexamination, which may impact the costs, timing or successful completion of a clinical study. In light of widely publicized events concerning the safety risk of certain drug and medical device products, regulatory authorities, members of Congress, the Governmental Accounting Office, medical professionals and the general public have all raised concerns about potential safety issues. These events have resulted in the recall and withdrawal of medical device products, revisions to product labeling that further limit use of products and establishment of risk management programs that may, for instance, restrict distribution of certain products or require safety surveillance or patient education. The increased attention to safety issues may result in a more cautious approach by FDA or other regulatory authorities to clinical studies and the medical device approval process. Adverse event data from clinical studies may receive greater scrutiny with respect to product safety, which may make FDA or other regulatory authorities more likely to terminate or suspend clinical studies before completion, or require longer or additional clinical studies that may result in substantial additional expense and a delay or failure in obtaining approval or approval for a more limited indication than originally sought.
Given the serious public health risks of high profile adverse safety events with certain products, FDA or other regulatory authorities may require, as a condition of approval, costly risk evaluation and mitigation strategies, which may include safety surveillance, restricted distribution and use, patient education, enhanced labeling, special packaging or labeling, expedited reporting of certain adverse events, preapproval of promotional materials and restrictions on direct-to-consumer advertising.
Our medical products may in the future be subject to product recalls that could harm our reputation, business, and financial results.
FDA has the authority to require the recall of commercialized medical device products in the event of material deficiencies or defects in design or manufacture. In the case of FDA, the authority to require a recall must be based on an FDA finding that there is a reasonable probability that the device would cause serious injury or death. Manufacturers may, under their own initiative, recall a product if any material deficiency in a device is found. A government-mandated or voluntary recall by us or one of our distributors could occur as a result of component failures, manufacturing errors, design or labeling defects or other deficiencies and issues. Recalls of any of our products would divert managerial and financial resources and have an adverse effect on our financial condition and results of operations. FDA requires that certain classifications of recalls be reported to FDA within ten working days after the recall is initiated. Companies are required to maintain certain records of recalls, even if they are not reportable to FDA. We may initiate voluntary recalls involving our products in the future that we determine do not require notification of FDA. If FDA disagrees with our determinations, they could require us to report those actions as recalls. A future recall announcement could harm our reputation with customers and negatively affect its sales. In addition, FDA could take enforcement action for failing to report the recalls when they were conducted. No recalls of our medical products have been reported to FDA.
If our medical products cause or contribute to a death or a serious injury, or malfunction in certain ways, we will be subject to medical device reporting regulations, which can result in voluntary corrective actions or agency enforcement actions.
Under FDA medical device reporting regulations, medical device manufacturers are required to report to FDA information that a device has or may have caused or contributed to a death or serious injury or has malfunctioned in a way that would likely cause or contribute to death or serious injury if the malfunction of the device or one of our similar devices were to recur. If we fail to report these events to FDA within the required timeframes, or at all, FDA could take enforcement action against us. Any such adverse event involving our products also could result in future voluntary corrective actions, such as recalls or customer notifications, or agency action, such as inspection or enforcement action. Any corrective action, whether voluntary or involuntary, as well as defending ourselves in a lawsuit, will require the dedication of our time and capital, distract management from operating our business, and may harm our reputation and financial results.
Product liability lawsuits against us could cause us to incur substantial liabilities and to limit commercialization of our products.
We face an inherent risk of product liability exposure related to the sale of the EsoGuard and EsoCheck products and any other products we develop. The marketing, sale and use of our products could lead to the filing of product liability claims against us if someone alleges product failures, product malfunctions, manufacturing flaws, or design defects resulted in injury to patients. We may also be subject to liability for a misunderstanding of, or inappropriate reliance upon, the information we provide. If we cannot successfully defend ourselves against claims that a product we developed caused injuries, we may incur substantial liabilities. Regardless of merit or eventual outcome, liability claims may result in:
- decreased demand for our products; - injury to our reputation and significant negative media attention; - withdrawal of patients from clinical studies or cancellation of studies; - significant costs to defend the related litigation and distraction to our management team; - substantial monetary awards to patients; - loss of revenue; and - the inability to commercialize any products that we may develop.
In addition, insurance coverage is increasingly expensive. We may not be able to maintain insurance coverage at a reasonable cost or in an amount adequate to satisfy any liability that may arise.
Compliance with the HIPAA security, privacy and breach notification regulations may increase our costs.
The HIPAA privacy, security and breach notification regulations, including the expanded requirements under HITECH, establish comprehensive federal standards with respect to the uses and disclosures of protected health information, or "PHI," by health plans, healthcare providers and healthcare clearinghouses, in addition to setting standards to protect the confidentiality, integrity and security of PHI. The regulations establish a complex regulatory framework on a variety of subjects, including:
- the circumstances under which uses and disclosures of PHI are permitted or required without a specific authorization by the patient, including but not limited to treatment purposes, activities to obtain payments for our services, and our healthcare operations activities; - a patient's rights to access, amend and receive an accounting of certain disclosures of PHI; - requirements to notify individuals if there is a breach of their PHI; - the contents of notices of privacy practices for PHI; - administrative, technical and physical safeguards required of entities that use or receive PHI; and - the protection of computing systems maintaining electronic PHI.
We have implemented practices intended to meet the requirements of the HIPAA privacy, security and breach notification regulations, as required by law. We are required to comply with federal privacy, security and breach notification regulations as well as varying state privacy, security and breach notification laws and regulations, which may be more stringent than federal HIPAA requirements. In addition, for healthcare data transfers from other countries relating to citizens of those countries, we must comply with the laws of those countries. The federal privacy regulations restrict our ability to use or disclose patient identifiable data, without patient authorization, for purposes other than payment, treatment, healthcare operations and certain other specified disclosures such as public health and governmental oversight of the healthcare industry.
HIPAA provides for significant fines and other penalties for wrongful use or disclosure of PHI, including potential civil and criminal fines and penalties. Computer networks are always vulnerable to breach and unauthorized persons may in the future be able to exploit weaknesses in the security systems of our computer networks and gain access to PHI. Additionally, we share PHI with third-parties who are legally obligated to safeguard and maintain the confidentiality of PHI. Unauthorized persons may be able to gain access to PHI stored in such third-parties computer networks. Any wrongful use or disclosure of PHI by us or such third-parties, including disclosure due to data theft or unauthorized access to our or our third-parties computer networks, could subject us to fines or penalties that could adversely affect our business and results of operations. Although the HIPAA statute and regulations do not expressly provide for a private right of damages, we could also incur damages under state laws to private parties for the wrongful use or disclosure of confidential health information or other private personal information.
Risks Associated with Our Intellectual Property and Technology Infrastructure
We may not be able to protect or enforce the intellectual property rights for the technology used in, or expected to be used in, our products, which could impair our competitive position.
Our success depends significantly on our ability to protect the patents, trademarks, trade secrets, copyrights and the other intellectual property rights for the technology used, or expected to be used, in our products. We rely primarily on patent protection and trade secrets, including the patents to the EsoGuard and EsoCheck technologies licensed by us from CWRU, as well as a combination of copyright and trademark laws and nondisclosure and confidentiality agreements to protect the technology and other intellectual property on which we rely. However, these legal means afford only limited protection and may not adequately protect our rights or permit us to gain or maintain any competitive advantage. In addition, although we have the right to direct CWRU to seek patent protection for the EsoGuard and EsoCheck technology in additional countries, we have limited control over the prosecution of any such application and have limited control over CWRU's other intellectual property practices as they relate to the EsoGuard and EsoCheck technologies. Despite our intellectual property rights practices, it may be possible for a third party to copy or otherwise obtain and use the technology on which we rely without authorization, develop similar technology independently or design around our patents. Furthermore, protecting intellectual property rights is costly and time consuming. We are responsible for the costs of CWRU in preparing, filing and prosecuting any patents related to the EsoGuard technology (subject to a provision for cost sharing in the event CWRU grants additional licenses to the technology, none of which would be permitted to overlap with our field of use).
Patents relied on by us may expire or may be challenged, invalidated, or circumvented, which could limit our ability to stop competitors from marketing related technologies. If any of the patents fails to protect the technology used by us, it would make it easier for our competitors to offer similar products. In addition, there is no assurance that competitors will not be able to design around the patents. Upon expiration of the patents, we may lose some of our rights to exclude others from making, using, selling, or importing products using the technology based on the expired patents. We cannot be assured that any pending or future patent applications for the technology on which we rely will result in the issuance of a patent to us. The U.S. Patent and Trademark Office, or the "PTO," may deny or require significant narrowing of claims in the patent applications, and patents issued as a result of the patent applications, if any, may not provide us with significant commercial protection or be issued in a form that is advantageous to us. We could also incur substantial costs in proceedings before the PTO.
We also rely on unpatented proprietary technology. We cannot assure you that we can meaningfully protect all our rights in our unpatented proprietary technology or that others will not independently develop substantially equivalent proprietary products or processes or otherwise gain access to our unpatented proprietary technology. We seek to protect our know-how and other unpatented proprietary technology with confidentiality agreements and/or intellectual property assignment agreements with our team members, independent distributors and consultants. However, such agreements may not be enforceable or may not provide meaningful protection for our proprietary information in the event of unauthorized use or disclosure or other breaches of the agreements or in the event that our competitors discover or independently develop similar or identical designs or other proprietary information. Our trade secrets may be vulnerable to disclosure or misappropriation by employees, contractors, and other persons.
We also rely on the use of registered and common law trademarks with respect to the brand names of some of our products. Common law trademarks provide less protection than registered trademarks.
Furthermore, we may not be able to obtain patent protection and other intellectual property rights in all the countries in which we operate, and under the laws of such countries, patents and other intellectual property rights may be unavailable or limited in scope.
Any inability on our part to adequately protect our intellectual property may have a material adverse effect on our business, financial condition and results of operations.
We may be subject to intellectual property infringement claims by third parties which could be costly to defend, divert management's attention and resources, and may result in liability.
The medical device industry is characterized by vigorous protection and pursuit of intellectual property rights. Companies in the medical device industry have used intellectual property litigation to gain a competitive advantage in the marketplace. From time to time, third parties may assert against us or CWRU their patent, copyright, trademark, and other intellectual property rights relating to technologies that are important to our business. Searches for existing intellectual property rights may not reveal important intellectual property and our competitors may also have filed for patent protection, information which is not publicly available, just as claimed trademark rights may not be revealed through our searches. We may be subject to claims that our team members or CWRU's personnel have disclosed, or that we have used, or CWRU has used, trade secrets or other proprietary information of our team members' or CWRU's personnel's former employers. Our efforts to identify and avoid infringing upon third parties' intellectual property rights may not always be successful. Any claims that our products or processes infringe these rights, regardless of their merit or resolution, could be costly, time consuming and may divert the efforts and attention of our management and technical personnel. In addition, we may not prevail in such proceedings given the complex technical issues and inherent uncertainties in intellectual property litigation. In any infringement litigation against CWRU relating to the EsoGuard technology, we will have the right to assume the defense of such suit at our expense.
Any claims of patent or other intellectual property infringement against us or CWRU, even those without merit, could:
- increase the cost of our products; - be expensive and/or time consuming to defend; - result in our being required to pay significant damages to third parties; - force us to cease making or selling products that incorporate the challenged intellectual property; - require us to redesign, reengineer or rebrand our products and technologies; - require us to enter into royalty or licensing agreements in order to obtain the right to use a third party's intellectual property on terms that may not be favorable or acceptable to us; - require us to develop alternative non-infringing technology, which could require significant effort and expense; - require us to indemnify third parties pursuant to contracts in which we have agreed to provide indemnification for intellectual property infringement claims; - result in our customers or potential customers deferring or limiting their purchase or use of the affected products impacted by the claims until the claims are resolved; and - otherwise have a material adverse effect on our business.
Any of the foregoing could affect our ability to compete or have a material adverse effect on our financial condition and results of operations.
Competitors may violate the intellectual property rights for the technology used in, or expected to be used in, our products, and we may bring litigation to protect and enforce our intellectual property rights, which may result in substantial expense and may divert our attention from implementing our business strategy.
We believe that the success of our business will depend, in significant part, on obtaining patent protection for our products and technologies, defending our patents and preserving our trade secrets and other proprietary intellectual property rights. Our failure to pursue any potential claim could result in the loss of our proprietary intellectual property rights and harm our position in the marketplace. Therefore, we may be forced to pursue litigation to enforce our rights. Future litigation could result in significant costs and divert the attention of our management and key personnel from our business operations and the implementation of our business strategy.
Failure in our information technology systems could significantly disrupt our operations and our research and development efforts, which could adversely impact our revenues, as well as our research, development and commercialization efforts.
Our ability to execute our business strategy depends, in part, on the continued and uninterrupted performance of our information technology ("IT") systems that support our operations and our research and development efforts, and those IT systems within the control of our contract manufacturers. We are substantially dependent on those IT systems to receive and process EsoGuard test orders, securely store patient health records and deliver the results of our EsoGuard tests. IT systems are vulnerable to damage from a variety of sources, including telecommunications or network failures, malicious human acts including cyberattacks, and natural disasters. Despite the precautionary measures we have taken to prevent unanticipated problems that could affect our IT systems, and the precautionary measures taken by our contract parties, sustained or repeated system failures that interrupt our ability to generate and maintain data, and in particular to operate our clinical laboratory, could adversely affect our ability to operate our business. Any interruption in the operation of IT systems could have an adverse effect on our operations.
System upgrades, enhancements and replacements, as well as new systems, are required from time to time, and require significant expenditures and allocation of valuable employee resources. Delays in integration or disruptions to our business from implementation of these new or upgraded systems could have a material adverse impact on our financial condition and operating results. There can be no assurance that our process of improving existing systems, developing new systems to support our expanding operations, integrating new systems, protecting confidential patient information, and improving service levels will not be delayed or that additional systems issues will not arise in the future. Failure to adequately protect and maintain the integrity of our information systems issues and data may result in a material adverse effect on our financial position, results of operations and cash flows.
Our internal computer systems, or those used by our third-party research institution collaborators, vendors or other contractors or consultants, may suffer security breaches.
In the ordinary course of our business, we and our contract manufacturers store sensitive data, including intellectual property, proprietary business information, personally identifiable information of our employees and patient health records, in our data centers and on our networks. The integrity and protection of our own data, and that of our customers and employees, is critical to our business. The regulatory environment governing information, security and privacy laws is increasingly demanding and continues to evolve. Despite the implementation of security measures by us and by our contractors, our internal computer systems and those of our contractors may be vulnerable to security breaches and damage from computer viruses, unauthorized access and ransomware attacks, including the unauthorized encryption of data stored on our computer network. Any such breach or attack could materially affect business operations and result in a loss of data, damage to our IT systems, or inappropriate disclosure of confidential or proprietary information, including protected health information, which is protected by HIPAA and other laws. Any such access, disclosure, or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, damage to our reputation, and delays in the commercialization of our products. In addition, we could incur additional cost, expense and the diversion of time and resources to recover from such an attack, and any such attach could cause our management to conclude that our disclosure controls and procedures were not effective.
Risks Associated with Our Relationship with PAVmed
PAVmed owns a majority of our voting stock and thus it (or any successor to its stake in the Company), may control certain actions requiring a stockholder vote.
PAVmed owns approximately 70.1% as of December 31, 2023 and 64.9% as of March 21, 2024 of our issued common stock (with such percentage inclusive of shares of our common stock underlying granted but unvested restricted stock awards), but excluding the voting power of any convertible securities. Presently, PAVmed controls more than 50% of the combined voting power of our common stock and our convertible securities and for as long as PAVmed continues to control more than 50% of our voting securities, PAVmed will be able to direct the election of all the members of our board of directors. Thus, we are a majority-owned subsidiary of PAVmed, and PAVmed has a controlling financial interest. In addition, as long as PAVmed continues to control more than 50% of our voting securities, PAVmed will have the ability to take stockholder action without the vote of any other stockholder and without having to call a stockholder meeting. Similarly, PAVmed will have the ability to prevent the approval of any action submitted to the stockholders. If PAVmed does not provide any requisite consent allowing us to take any such action when requested, we will not be able to engage in the related activities and, as a result, our business and our operating results may be harmed.
PAVmed's interests and objectives as a stockholder may not align with, or may even directly conflict with, your interests and objectives as a stockholder. For example, PAVmed may be more or less interested in us entering into a transaction or conducting an activity due to the impact such transaction or activity may have on PAVmed as a company, independent of us. In such instances, PAVmed may exercise its control over us in a way that is beneficial to PAVmed, and you will not be able to affect the outcome so long as PAVmed continues to hold a majority of the shareholder votes.
In the event PAVmed is acquired or otherwise undergoes a change of control, any acquiror or successor will be entitled to exercise the voting control and contractual rights of PAVmed and may do so in a manner that could vary significantly from that of PAVmed.
With the goal of mitigating the risks flowing from PAVmed's control position, we have decided not to seek exemption as a "controlled company" from the corporate governance rules of Nasdaq, and therefore will be bound by the same corporate governance principles as other public companies, including the requirement that a majority of our directors be independent and that we maintain audit, compensation and nominating committees comprised of independent directors. However, our decision not to rely on the "controlled company" exemption could change. Although we do not anticipate changing our decision, for so long as a majority of our outstanding common stock is held by PAVmed (or by any other stockholder or group of stockholders), we could choose to rely on this exemption in the future to avoid complying with certain of the Nasdaq corporate governance rules, including the rules that require us to have a board comprised of at least 50% independent directors, to have board nominations either selected, or recommended for the board's selection, by either a nominating committee comprised solely of independent directors or by a majority of the independent directors and to have officer compensation determined, or recommended to the board for determination, either by a compensation committee comprised solely of independent directors or by a majority of the independent directors. Any decision to rely on the "controlled company" exemption will be disclosed in our annual proxy statement.