NeoGenomics (NEO) Risk Factors

We frequently develop diagnostic tests for clients that cannot currently be provided using test kits approved or cleared by the FDA. Currently, all LDTs are conducted and offered in accordance with the requirements of CLIA and individual state licensing procedures, but the FDA has had a policy of enforcement discretion with regard to LDTs. On September 29, 2023, the FDA published a proposed rule that, if finalized, would end this policy of enforcement discretion for virtually all LDTs in five stages over a four-year period from the date FDA publishes a final rule, and provide for LDTs to be regulated as medical devices. In Phase 1 (effective one year post-finalization), laboratories would be required to comply with medical device (adverse event) reporting and correction and removal reporting requirements. In Phase 2 (effective two years post-finalization), laboratories would be required to comply with all other medical device regulatory requirements (including registration and listing, labeling, and investigational use exemptions), except for quality system and premarket review requirements. In Phase 3 (effective three years post-finalization), laboratories would be required to comply with quality system requirements (i.e., good manufacturing practices). In Phase 4 (effective three and a half years post-finalization, but not before October 1, 2027), laboratories would be required to comply with premarket review requirements for high-risk tests (i.e., tests subject to premarket approval requirements). Finally, in Phase 5 (effective four years post-finalization, but not before April 1, 2028), laboratories would be required to comply with premarket review requirements for moderate- and low-risk tests (i.e., tests subject to de novo or full 510(k) premarket notification requirements). Unlike previous FDA proposals, the proposed rule does not "grandfather" any currently marketed tests. The content and timing of any final rule on LDTs is uncertain at this time and the FDA has taken a number of prior steps towards regulation of LDTs that have not been implemented. Nevertheless, there is a risk that the FDA's proposed regulatory process could delay the offering of certain tests and result in additional validation costs and fees. There is also an associated risk that some tests currently offered might become subject to FDA premarket approval or clearance. This FDA approval or clearance process may be time-consuming and costly, with no guarantee of ultimate approval or clearance. If our diagnostic tests are allowed to remain on the market but there is uncertainty about the regulatory status of such tests, if they are labeled investigational by FDA, or if FDA limits our labeling claims, orders or reimbursement may decline. Congress has also considered a number of legislative proposals in recent years that would amend the regulatory framework for LDTs, including, among other requirements, FDA premarket review of certain LDTs. The most recent such proposal, the VALID Act, was introduced in both the House and Senate on June 24, 2021. The VALID Act was expected to be included in the Omnibus bill signed at the end of 2022, but ultimately was not included. The VALID Act was then reintroduced in March 2023. The bill would subject many LDTs to FDA regulation by creating a new in vitro clinical test, or IVCT, category of regulated products. As proposed, the bill would grandfather many existing LDTs from the proposed premarket approval, quality systems, and labeling requirements, respectively, but would require such tests to comply with other regulatory requirements (including registration and listing and adverse event reporting). To market a high-risk IVCT, reasonable assurance of analytical and clinical validity for the intended use would be needed to be established. Under the VALID Act, a pre-certification process would be established that would allow a laboratory to establish that the facilities, methods, and controls used in the development of its IVCTs meet quality system requirements. If pre-certified, low-risk IVCTs, developed by the laboratory would not be subject to pre-market review. The new regulatory framework would include quality control and post-market reporting requirements. The FDA would have the authority to withdraw approvals for IVCTs for various reasons, including (for example) if there were a reasonable likelihood that the test would cause death or serious adverse health consequences. We cannot predict if the VALID Act (or any other bill) will be enacted in its current (or any other) form. However, it is possible that legislation and resulting FDA regulation may result in increased regulatory burdens and costs for us to seek marketing authorization for and maintain ongoing compliance for our existing tests, any modifications thereto, or any future tests we may develop. If the government begins to regulate our tests, it could require a significant volume of applications, which would be burdensome. Furthermore, governmental bodies could take a long time to review such applications and/or document responses if other laboratories were also required to file applications and/or document responses for each of their LDTs. In the event that the FDA begins to regulate our tests, it may require additional pre-market clinical testing prior to submitting a premarket approval, premarket notification, or other application to permit commercial sales. Such additional pre-market clinical testing could delay the commencement or completion of clinical testing, significantly increase our test development costs, delay commercialization of any future tests, and interrupt sales of our current tests. Additionally, the results of pre-clinical trials or previous clinical trials may not be predictive of future results, and clinical trials may not satisfy the requirements of the FDA or other non-U.S. regulatory authorities. Many of the factors that may cause or lead to a delay in the commencement or completion of clinical trials may also ultimately lead to delay or denial of regulatory clearance or approval. The commencement of clinical trials may be delayed due to insufficient patient enrollment, which is a function of many factors, including the size of the patient population, the nature of the protocol, the proximity of patients to clinical sites, and the eligibility criteria for the clinical trial. We also cannot be certain that FDA will not enact rules or guidance that could impact our ability to purchase materials necessary for the performance of our LDTs, such as products labeled for research use only. Should any of the reagents we obtain from third party suppliers and use in conducting our LDTs be affected by future regulatory actions, our business could be adversely affected by those actions, including increasing the cost of testing or delaying and limiting or prohibiting the purchase of reagents necessary to perform testing. We may find it necessary to engage CROs to perform data collection and analysis and other aspects of our clinical trials, which might increase the cost and complexity of our trials. We may also depend on clinical investigators, medical institutions, and CROs to perform the trials. If these parties do not successfully carry out their contractual duties or obligations or meet expected deadlines, or if the quality, completeness, or accuracy of the clinical data they obtain is compromised due to the failure to adhere to our clinical protocols or for other reasons, our clinical trials may have to be extended, delayed, or terminated. Many of these factors would be beyond our control. We may not be able to enter into replacement arrangements without undue delays or considerable expenditures. If there are delays in testing or approvals as a result of the failure to perform by third parties, our research and development costs would increase, and we may not be able to obtain regulatory clearance or approval for our tests. In addition, we may not be able to establish or maintain relationships with these parties on favorable terms, if at all. Each of these outcomes would harm our ability to market our tests and/or to achieve sustained profitability.

In the U.S., HIPAA, as expanded through the HITECH Act and as implemented through the HIPAA Rules, and similar state laws contain provisions that require the electronic exchange of health information, such as claims submission and receipt of remittances, using standard transactions and code sets, which we refer to as "Standards," and regulate the use and disclosure of patient records and other PHI. These provisions, which address security and confidentiality of patient information as well as the administrative aspects of claims handling, have very broad applicability and govern many healthcare providers, including physicians and clinical laboratories. Failure to comply with the Standards, the HIPAA Rules, and applicable state privacy and security laws, could result in material adverse effects on our business, results of operations, and our financial condition and could subject us to liability. The HIPAA Rules establish comprehensive federal standards with respect to the uses and disclosures of PHI by certain entities including health plans and healthcare providers, and set standards to protect the confidentiality, integrity, and availability of electronic medical records. The regulations establish a complex regulatory framework governing the use and disclosure of PHI, including, for example, the circumstances under which uses and disclosures of PHI are permitted or required without a specific authorization by the patient; a patient's right to access, amend, and receive an accounting of certain disclosures of PHI; the content of notices of privacy practices describing how PHI is used and disclosed and individuals' rights with respect to their PHI; and implementation of administrative, technical, and physical safeguards to protect privacy and security of PHI. The federal privacy regulations restrict our ability to use or disclose certain individually identifiable patient health information, without patient authorization, for purposes other than payment, treatment, or healthcare operations, as defined by HIPAA, except for disclosures for various public policy purposes and other permitted purposes outlined in the HIPAA Rules. The HIPAA Rules do not supersede state laws that may be more stringent; therefore, we are required to comply with both federal privacy and security regulations and varying state privacy and security laws and regulations. The HIPAA Rules also require healthcare providers like us to notify affected individuals, the Secretary of the U.S. Department of Health and Human Services, and in some cases, the media, when PHI has been "breached," as defined by HIPAA. Many states have similar breach notification laws. In the event of a breach, we could incur substantial operational and financial costs related to mitigation and remediation, including preparation and delivery of notices to affected individuals. Additionally, HIPAA and its implementing regulations provide for significant civil fines, criminal penalties, and other sanctions for failure to comply with the privacy, security, and breach notification rules, including for wrongful or impermissible use or disclosure of PHI. Although the HIPAA statute and regulations do not expressly provide for a private right of action for damages, we could incur damages under state laws to private parties for the wrongful or impermissible use or disclosure of confidential health information or other private personal information. Additionally, HIPAA allows state Attorneys General to bring an action against a covered entity, such as us, for a violation of HIPAA. We insure some of our risk with respect to HIPAA security breaches, but operational costs and penalties associated with HIPAA breaches easily could exceed our insured limits. HIPAA imposes additional requirements, restrictions, and penalties on covered entities and their business associates to, among other things, deter breaches of security. As a result, in addition to the aforementioned reporting requirements, covered entities and their business associates may be required to take preventative and remedial actions, as well as face stringent sanctions for a breach. Our electronic health records system is periodically modified to meet applicable security standards. Despite our implementation of various security measures, our infrastructure may be vulnerable to computer viruses, break-ins, and other disruptive problems inadvertently introduced by authorized users such as employees and clients, or purposefully targeted by hackers and other cybercriminals which could lead to interruption, delays, or cessation in service to our clients. Further, such incidents, whether electronic or physical, could jeopardize the security of confidential information, including PHI and other sensitive information stored in our computer systems related to clients, patients, and other parties connected through us, which may deter potential clients and give rise to uncertain liability to parties whose security or privacy has been infringed. A significant security breach could result in fines, loss of clients, damage to our reputation, direct damages, costs of repair and detection, costs to remedy the breach, government penalties, and other expenses. We insure some of our risk with respect to security breaches but the occurrence of any of the foregoing events could have a material adverse effect on our business, results of operations, and our financial condition. In the United States, in addition to the HIPAA Rules described above, the Company is subject to additional federal and state laws regarding the handling and disclosure of patient records and patient health information. Effective April 5, 2021, HHS published a final rule implementing the information blocking provisions ("Information Blocking Rules") of the 21st Century Cures Act. The Information Blocking Rules prohibit covered actors, including healthcare providers, from engaging in activity that is likely to interfere with the access, exchange, or use of EHI unless such activity falls into one of eight exceptions. The Information Blocking Rules provide for civil monetary penalties for noncompliance by healthcare IT vendors and, separately, "appropriate disincentives" for noncompliance by healthcare providers. The HIPAA Rules do not supersede state laws that may be more stringent; therefore, we are required to comply with both federal privacy and security regulations as well as varying state privacy and security laws and regulations. These laws vary widely. For example, many states have implemented genetic testing and privacy laws imposing specific patient consent requirements and limiting the disclosure of genetic test results. Penalties for violation include sanctions against a laboratory's licensure as well as civil or criminal penalties. Additionally, private individuals may have a right of action against the Company for violations of a state's privacy laws. Numerous other federal, state, and international laws govern the collection, use, and disclosure of personal information and may complicate our compliance efforts. Failure to comply with these laws can result in the imposition of significant fines and impact our ability to process certain personal data. For example, in the U.S., the CCPA affords California residents expanded privacy rights and protections and provides for civil penalties for violations and a private right of action related to certain data security breaches. These protections have been expanded by the CPRA, which became operational in most key respects on January 1, 2023. Similar laws have been proposed or passed at the U.S. federal and state level, including the Virginia Consumer Data Protection Act, which took effect on January 1, 2023, the Colorado Consumer Protection Act, which took effect on July 1, 2023, the Connecticut Data Privacy Act, which took effect on July 1, 2023, and the Utah Consumer Privacy Act, which took effect on December 31, 2023. A number of other states have enacted laws related to the privacy and security of consumer health information and personal data which will become effective within the next two years, including Delaware, Florida, Indiana, Iowa, Montana, Nevada, Oregon, Tennessee, Texas, and Washington, and more states have proposed legislation under consideration. The legislative and regulatory landscape for privacy and data protection continues to evolve, and there has been an increasing amount of focus on privacy and data protection issues with the potential to affect our business, including laws in all 50 states requiring security breach notification in some circumstances. These and other laws could increase regulatory compliance risk, create liability for us or increase our cost of doing business. Outside of the U.S., the European Union's data privacy law, the GDPR, for example, imposes penalties of up to 4.0% of annual global revenue. The GDPR imposes a number of strict obligations and restrictions on the ability to process (which includes collection, analysis, and transfer of) personal data, including health data from performance of clinical tests, clinical trials and adverse event reporting. The GDPR also includes requirements relating to establishing a legal basis for processing personal data, the information provided to the individuals prior to processing their personal data or personal health data, notification of data processing obligations to the national data protection authorities, standards for binding vendors that process personal data, and the security and confidentiality of the personal data. Further, the GDPR prohibits the transfer of personal data to countries outside of the EU that are not considered by the European Commission to provide an adequate level of data protection, including to the United States, except if the data controller meets very specific requirements. In July 2020, the Court of Justice of the European Union (CJEU) invalidated the E.U.-U.S. Privacy Shield Framework, under which personal data could be transferred from the EEA to U.S. entities that had self-certified under the Privacy Shield scheme. This framework has been replaced by the E.U.-U.S. Data Privacy Framework for which the European Commission adopted an adequacy decision in July 2023. It is likely there will be legal challenges to this framework in the future, which could draw into question the legitimacy of other cross-border transfer mechanisms, including the standard contractual clauses which remain a commonly used mechanism used to transfer personal data from the EEA to the U.S. and other jurisdictions. These recent developments may require us to review and amend the legal mechanisms by which we make and/ or receive personal data transfers to/ in the United States. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the standard contractual clauses cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

Our success depends on our ability to develop new tests and other related products while improving the performance, cost-effectiveness and timeliness of our existing products. Our products that are under development have taken time and considerable resources to develop, and we may not be able to complete the development and commercialization of such products for clinical use on a timely basis, or at all. For example, there can be no assurance that we will be able to produce commercial products for early detection of cancer. Before we can commercialize any new products, we will need to expend significant funds in order to: - conduct substantial research and development, including validation studies and clinical studies;- further develop and scale our laboratory processes to accommodate different products, including the expansion of our medical staff and PhDs; and - further develop and scale our infrastructure to be able to analyze increasingly large amounts of data; and - seek and obtain regulatory clearance or approvals of our new products, as required by applicable regulations. Our product development process involves a high degree of risk, and product development efforts may fail for many reasons, including: - failure of the product to perform as expected, including defects and errors;- lack of validation data; or - failure to demonstrate the clinical utility of the product. As we develop products, we have made and will have to make significant investments in product development, marketing and selling resources, including investing heavily in clinical studies, which could adversely affect our future cash flows.

We regard our copyrights, trademarks, trade secrets, and similar intellectual property as critical to our success, and we rely upon trademark law, copyright law, trade secret protection, and confidentiality and/or license agreements with our employees, clients, partners, and others to protect our proprietary rights. The steps taken by us to protect our proprietary rights may not be adequate or third parties may infringe or misappropriate our copyrights, trademarks, trade secrets, and similar proprietary rights. In addition, other parties may assert infringement claims against us.

We rely heavily on reagents, test kits and instruments manufactured by third parties in our testing services. From time to time, manufacturers have discontinued or recalled, and may in the future discontinue or recall, the reagents, test kits or instruments used by us to perform laboratory testing. Such discontinuations or recalls could adversely affect our costs, testing volume and revenues. We have had certain tests discontinued by manufacturers and have had to develop alternative solutions for our clients.

The revenue attributable to our Advanced Diagnostics clients may also fluctuate in the future, which could have an adverse effect on our financial condition and results of operations. Most of our Advanced Diagnostics segment clients can terminate our contracts without cause upon proper notice, and we experience termination or non-renewal of our Advanced Diagnostics contracts in the ordinary course of business. Our Advanced Diagnostics clients may delay, terminate or reduce the scope of our contracts for a variety of reasons beyond our control, including but not limited to actions by regulatory authorities, negative clinical results, lack of patient enrollment, lack of available financing or shifts in internal priorities. In addition, adverse speculation about our existing or potential relationships with our Advanced Diagnostics clients may be a catalyst for adverse speculation about us, our products and our technology, which can adversely affect our reputation and business. Delays, terminations or reductions in the scope of our contracts impact our ability to convert our backlog into revenue for the Company. Our ability to realize the full benefits of our backlog of contractually committed services due to delay, cancellation or reduction in our client's contractual commitments, would materially impact our revenues. In addition, the terminability of our contracts puts increased pressure on our quality control efforts, since not only can our contracts be terminated by clients as a result of poor performance, but any such termination may also affect our ability to obtain future contracts from the clients involved and others.