Tactile Systems Technology (TCMD) Risk Analysis

Our products are medical devices subject to extensive regulation in the United States. The FDA and other U.S. and foreign governmental agencies regulate, among other things, with respect to medical devices: - design, development and manufacturing;- establishment registration and product listing;- testing, labeling, content and language of instructions for use, storage and servicing;- clinical trials;- product safety;- marketing, sales and distribution;- unique device identifiers;- premarket clearance and approval;- record keeping procedures;- advertising and promotion;- recalls and field safety corrective actions;- post-market surveillance, including reporting of deaths or serious injuries and malfunctions that, if they were to recur, could lead to death or serious injury;- post-market approval studies; and - product and component import and export. Unless an exemption applies, each medical device we seek to distribute commercially in the United States requires marketing authorization from the FDA prior to distribution. The two primary types of FDA marketing authorizations applicable to a medical device are premarket notification, also called a 510(k) clearance, and premarket approval. The type of marketing authorization is generally linked to the classification of the device. When a 510(k) clearance is required, we must submit a premarket notification to the FDA demonstrating that our proposed device is "substantially equivalent" to a legally marketed device previously found substantially equivalent through a 510(k) premarket notification, a legally marketed device which has been reclassified from high to low or moderate risk or a legally marketed device in commercial distribution before May 28, 1976 for which the FDA does not require the submission of a premarket approval application. Such a device is commonly known as a ‘‘predicate device.'' In 2019, the FDA released a final guidance for industry regarding an optional Safety and Performance Based Pathway for 510(k) clearance, which allows a submitter to demonstrate that an eligible new device of a well-understood type meets FDA-identified performance criteria to demonstrate that the device is as safe and effective as a legally marketed device. The FDA may require further information, including clinical data, to make a determination regarding substantial equivalence. A medical device may be found not to be equivalent if it has different intended uses from the predicate device or possesses different technological characteristics from the predicate device which raise new questions of safety and effectiveness. A premarket approval application must be submitted to the FDA if the device cannot be cleared through the 510(k) process. The premarket approval application process is much more demanding and in-depth than the 510(k) premarket notification process and requires the payment of more significant user fees. A premarket approval application must be supported by valid scientific evidence, which typically requires extensive data to demonstrate the reasonable assurance of safety and effectiveness of the device. The approval process involves FDA review of information, including but not limited to, technical, pre-clinical (bench and/or animal), clinical trials, manufacturing and labeling. The FDA clearance and approval processes frequently take longer than anticipated due to increasing FDA demands for clarification of data or new data requirements. If there is no predicate device that would permit the device to be cleared through the 510(k) path and the device is not 510(k)-exempt, then the FDA will automatically classify the device as a Class III high risk product which requires premarket approval. In the event of this possibility, the sponsor can request a risk-based classification determination for the device in accordance with the FDA's De Novo classification request process, which is a route to market for novel medical devices that are low to moderate risk and are not substantially equivalent to a predicate device. A company files a De Novo request when it does not have a predicate to which it can claim substantial equivalence. The FDA reviews the request for a De Novo decision and grants or denies the request. If the request is granted, the FDA issues an order indicating that the device may legally be marketed and the device is classified as a Class I or II device, depending on risk. Once a device is classified through the De Novo process, future devices from the company or a competitor may use that device as a 510(k) predicate. The advantage of the De Novo process is that it generally requires less data than a premarket approval. The disadvantage is that it may require more data than a 510(k) and most often will include human clinical data. The FDA may move devices with slightly different proposed indication statements or different technological features off the 510(k) path and on to the De Novo path resulting in more time and expense for the company. Both the 510(k) and premarket approval processes can be expensive and lengthy and require the payment of significant fees. The FDA's 510(k) clearance process usually takes from approximately three to 12 months, but may take longer. The process of obtaining a premarket approval is much more costly and uncertain than the 510(k) clearance process and generally takes from approximately one to five years, or longer, from the time the application is submitted to the FDA until an approval is obtained. The process of obtaining regulatory clearances or approvals to market a medical device can be costly and time consuming, and we may not be able to obtain these clearances or approvals on a timely basis, if at all. In the United States, our currently commercialized products are marketed pursuant to 510(k) premarket clearances under Section 510(k) of the Federal Food, Drug and Cosmetic Act, or FDCA. If the FDA requires us to go through a lengthier, more rigorous examination for future products or modifications to existing products than we had expected, our product introductions or modifications could be delayed or canceled, which could cause our sales to decline. In addition, the FDA may determine that future products will require the more costly, lengthy and uncertain premarket approval process. Although we do not currently market any devices under a premarket approval, the FDA may demand that we obtain a premarket approval prior to marketing certain of our future products. In addition, if the FDA disagrees with our determination that a product we currently market is subject to an exemption from premarket review, the FDA may require us to submit a 510(k) or premarket approval application in order to continue marketing the product. Further, even with respect to those future products where a premarket approval is not required, we cannot assure you that we will be able to obtain the 510(k) clearances required with respect to those products. The FDA can delay, limit or deny clearance or approval of a device for many reasons, including: - for non-premarket approval devices, failure of the applicant to demonstrate to the FDA's satisfaction that its products meet the definition of "substantial equivalence" or meet the standard for the FDA to grant a petition for De Novo classification;- failure of the applicant to demonstrate that there is reasonable assurance that the medical device is safe or effective under the conditions of use prescribed, recommended or suggested in the proposed labeling;- insufficient data from the pre-clinical studies and clinical trials; and/or - the manufacturing processes, methods, controls or facilities used for the manufacture, processing, packing or installation of the device do not meet applicable requirements. Any delay in, or failure to receive or maintain, clearances or approvals for our products could prevent us from generating revenue from these products or achieving profitability. Additionally, the FDA and other governmental authorities have broad enforcement powers. Our failure to comply with applicable regulatory requirements could lead governmental authorities or a court to take action against us, including, but not limited to: - issuing untitled (notice of violation) letters or public warning letters to us;- imposing fines and penalties on us;- obtaining an injunction or administrative detention preventing us from manufacturing or selling our products;- seizing products to prevent sale or transport or export;- bringing civil or criminal charges against us;- recalling our products or mandating a product correction;- detaining our products or their components at U.S. Customs;- delaying the introduction of our products into the market;- delaying pending requests for clearance or approval of new uses or modifications to our existing products; and - withdrawing or denying approvals or clearances for our products. If we fail to obtain and maintain regulatory clearances or approvals our ability to sell our products and generate revenue will be materially harmed. In addition, the FDA may change its clearance and approval policies, adopt additional regulations or revise existing regulations, or take other actions which may prevent or delay approval or clearance of our products under development or impact our ability to modify our currently approved or cleared products on a timely basis. For example, in response to industry and healthcare provider concerns regarding the predictability, consistency and rigor of the 510(k) regulatory pathway, the FDA published a draft guidance on the 510(k) regulatory pathway in 2014, finalized in 2019, and again in 2023 through draft guidance, which altered and clarified the manner in which the 510(k) regulatory pathway is administered and interpreted. The FDA intends these reform actions to improve the efficiency and transparency of the clearance process, as well as bolster patient safety. Any new guidance could impose additional regulatory requirements upon us which could delay our ability to obtain new 510(k) clearances, increase the costs of compliance or restrict our ability to maintain our current clearances. In addition, as part of the Food and Drug Administration Safety and Innovation Act, Congress reauthorized the Medical Device User Fee Amendments with various FDA performance goal commitments and enacted several "Medical Device Regulatory Improvements" and miscellaneous reforms which are further intended to clarify and improve medical device regulation both pre- and post-market. Medical devices may only be promoted and sold for the indications for which they are approved or cleared unless an exemption applies. In addition, even if the FDA has approved or cleared a product, it can take action affecting such product approvals or clearances if serious safety or other problems develop in the marketplace. Delays in obtaining clearances or approvals could adversely affect our ability to introduce new products or modifications to our existing products in a timely manner, which would delay or prevent commercial sales of our products. Additionally, the FDA and other regulatory authorities have broad enforcement powers. Regulatory enforcement or inquiries, or other increased scrutiny on us, could affect the perceived safety and efficacy of our products and dissuade patients and clinicians from using our products.

The Federal Anti-Kickback Statute prohibits, among other things, knowingly and willfully offering, paying, soliciting or receiving remuneration, whether directly or indirectly and overtly or covertly, to induce or in return for purchasing, leasing, ordering, or arranging for the purchase, lease or order of any healthcare item or service reimbursable under Medicare, Medicaid, or other federal healthcare programs. The statutory exceptions and regulatory safe harbors protecting certain common activities from prosecution are drawn narrowly, and any remuneration to or from a prescriber or purchaser of healthcare products or services may be subject to scrutiny if they do not qualify for an exception or safe harbor. Our practices may not in all cases meet all of the criteria for safe harbor protection from anti-kickback liability. Federal false claims laws prohibit, in part, any person from knowingly presenting or causing to be presented a false claim for payment to the federal government, or knowingly making or causing to be made a false statement to obtain payment. The majority of states also have statutes or regulations similar to the Federal Anti-Kickback Statute and Federal False Claims Act that apply to items or services reimbursed under Medicaid and other state programs, or, in several states, apply regardless of payer. These false claims statutes allow any person to bring suit in the name of the government alleging false and fraudulent claims presented to or paid by the government (or other violations of the statutes) and to share in any amounts paid by the entity to the government in fines or settlement. Such suits, known as qui tam actions, have increased significantly in the healthcare industry in recent years. We are aware of two qui tam complaints against us, which allege violations related to the Federal Anti-Kickback Statute and the Federal False Claims Act.  See Item 3., "Legal Proceedings," for additional information regarding these actions. Sanctions under these federal and state laws may include civil monetary penalties, exclusion of a manufacturer's products from reimbursement under government programs, criminal fines and imprisonment. In addition, the ACA, among other things, amended the intent requirement of the Federal Anti-Kickback Statute and criminal healthcare fraud statutes. A person or entity does not need to have actual knowledge of this statute or specific intent to violate it. In addition, the ACA provides that the government may assert that a claim, including items or services resulting from a violation of the Federal Anti-Kickback Statute, constitutes a false or fraudulent claim for purposes of the false claims statutes. Because of the breadth of these laws and the narrowness of the safe harbors and exceptions, some of our business activities could be subject to challenge under one or more of such laws. Such a challenge, regardless of the outcome, could have a material adverse effect on our business, business relationships, reputation, financial condition and results of operations. In addition, there are many federal and state regulations covering payments made to physicians. The ACA imposed reporting and disclosure requirements on device and drug manufacturers for any "transfer of value" made or distributed to teaching hospitals and other qualified healthcare providers. Device and drug manufacturers are also required to report and disclose any investment interests held by physicians and their immediate family members during the preceding calendar year. Failure to submit required information may result in significant civil monetary penalties for all payments, transfers of value or ownership or investment interests not reported in an annual submission. Manufacturers are required to collect data and are required to submit their data reports to CMS for each calendar year by the 90th day of the subsequent calendar year. Certain states have their own versions of the Physician Payments Sunshine Act, and may also mandate implementation of compliance programs and/or the tracking and reporting of gifts, compensation and other remuneration to physicians or other healthcare professionals. The shifting compliance environment and the need to build and maintain robust and expandable systems to comply with different compliance and/or reporting requirements in multiple jurisdictions increase the possibility that a manufacturer may violate one or more of the requirements. The Federal Civil Monetary Penalties Law prohibits, in part, the offering or giving of remuneration to a Medicare or Medicaid beneficiary that the person knows or should know is likely to influence the beneficiary's selection of a particular supplier of items or services reimbursable by a Federal or state governmental program. We sometimes offer customers various discounts and other financial incentives in connection with the sales of our products. While it is our intent to comply with all applicable laws, the government may find that our marketing activities violate the Civil Monetary Penalties Law. If we are found to be in noncompliance, we could be subject to significant civil money penalties for each wrongful act, assessment of three times the amount claimed for each item or service and exclusion from the Federal healthcare programs. The scope and enforcement of each of these laws is uncertain and subject to rapid change in the current environment of healthcare reform, especially in light of the lack of applicable precedent and regulations in some areas. If our operations are found to be in violation of any of the laws described above or any other government regulations that apply to us, we may be subject to penalties, including civil and criminal penalties, damages, fines and the curtailment, restructuring, or restricting of our operations. Any penalties, damages, fines, curtailment or restructuring of our operations could harm our ability to operate our business and our financial results. Responding to any action or threat of action against us for violation of these laws, even if we successfully defend against it, could cause us to incur significant legal expenses and divert our management's attention from operation of our business. Moreover, achieving and sustaining compliance with applicable federal and state fraud laws may prove costly.

To continue operating our business under our direct-to-patient and -provider model, we must maintain our Durable Medical Equipment certification from the Accreditation Commission for Health Care. In May 2008, we became a Durable, Medical Equipment, Prosthetics, Orthotics, and Supplies accredited supplier by the Accreditation Commission for Health Care. This accreditation status must be renewed every three years through a recredentialing process that includes an on-site review. We last renewed our accreditation with our accrediting body in May 2023. If we are deemed out of compliance with accreditation standards, our enrollment status in the Medicare program could be jeopardized, up to and including termination. In addition to maintaining our Durable Medical Equipment certification from the Accreditation Commission for Health Care, we also must maintain certain state-required licenses. If we were found to be noncompliant, we could lose our licensure in that state. Losing any license could subject us to financial penalties and/or prohibit us from selling our current or future products to patients in a particular state and our business, financial condition and results of operations could be adversely affected as a result of any such prohibition.

The FDA regulations require the submission and clearance of a new 510(k) premarket notification, or possibly, premarket approval, for significant changes or modifications made in the design, components, method of manufacture or intended use of a device including changes or modifications to a 510(k)-cleared device that could significantly affect the device's safety or effectiveness, or would constitute a major change or modification in the device's intended use. The FDA requires each manufacturer to make this determination, but the FDA may review any manufacturer's decision. The FDA may not agree with our decisions regarding whether new clearances or approvals are necessary. We have modified some of our 510(k) cleared products, and have determined based on our review of the applicable FDA guidance that in certain instances new 510(k) clearances or premarket approval are not required. If the FDA disagrees with our determination and requires us to submit new 510(k) notifications or premarket approval for modifications to our previously cleared products for which we have concluded that new clearances or approvals are unnecessary, we may be required to cease marketing or to recall the modified product until we obtain clearance or approval, and we may be subject to significant regulatory fines or penalties. Furthermore, the FDA's ongoing review of the 510(k) program may make it more difficult for us to make modifications to our previously cleared products, either by imposing more strict requirements as to when a manufacturer must submit a new 510(k) for a modification to a previously cleared product, or by applying more onerous review criteria to such submissions. If the FDA requires us to cease marketing a modified device until we obtain a new 510(k) clearance or premarket approval, our business, financial condition, operating results and future growth prospects could be materially adversely affected. Further, in this situation, our products could be subject to recall. Any recall or FDA requirement that we seek additional approvals or clearances could result in significant delays, fines, increased costs associated with modification of a product, loss of revenue and potential operating restrictions imposed by the FDA.

Our marketed products are subject to Medical Device Reporting, or MDR, obligations, which require that we report to the FDA any incident in which our products may have caused or contributed to a death or serious injury, or in which our products malfunctioned and, if the malfunction were to recur, it could likely cause or contribute to a death or serious injury. The timing of our obligation to report under the MDR regulations is triggered by the date we become aware of the adverse event as well as the nature of the event. We may fail to report adverse events of which we become aware within the prescribed timeframe. We may also fail to recognize that we have become aware of a reportable adverse event, especially if it is not reported to us as an adverse event, if it is an adverse event that is unexpected, if the occurrence of the adverse event is not immediately associated with our product, or if an adverse event occurs subsequent to completing use of our product. If we fail to comply with our reporting obligations, the FDA could take action including warning letters, untitled letters, administrative actions, criminal prosecution, imposition of civil monetary penalties, revocation of our device clearances, seizure of our products, or delay in clearance of future products.

From time to time, legislation is drafted and introduced that could significantly change the statutory provisions governing the clearance or approval, manufacture and marketing of a medical device. In addition, FDA and other applicable regulations and guidance are often revised or reinterpreted in ways that may significantly affect our business and our products, and new regulations or guidance documents may be promulgated. It is impossible to predict whether legislative changes will be enacted or regulations, guidance or interpretations changed or added, and what the impact of such changes or additions, if any, may be.

In the United States, the legislative landscape, particularly as it relates to healthcare regulation and reimbursement coverage, continues to evolve. In March 2010 the ACA was passed and substantially changed healthcare financing by both governmental and private insurers. Other legislative changes have been proposed and adopted in the United States since the ACA was enacted. The Budget Control Act of 2011 requires, among other things, mandatory across-the-board reductions in Federal spending, also known as sequestration. The American Taxpayer Relief Act of 2012 postponed sequestration for two months. As required by law, a sequestration order was issued on March 1, 2013. As a result of the sequestration order, Medicare Fee-for-Service claims with dates-of-service or dates-of-discharge on or after April 1, 2013 will continue to incur a 2% reduction in the Medicare payment until further notice. Claims for durable medical equipment, prosthetics, orthotics and supplies, including claims under the DME Competitive Bidding Program, are reduced by 2% based upon whether the date-of-service, or the start date for rental equipment or multi-day supplies, is on or after April 1, 2013. This 2% reduction based on the sequestration was suspended in 2020 due to the public health emergency, and Congress extended the sequestration moratorium through March 31, 2022. From April 1, 2022 through June 30, 2022, the reduction went back into effect at a 1% reduction level, and beginning July 1, 2022, the reduction returned to a 2%reduction level. We expect that additional state and federal healthcare reform measures will be adopted in the future, any of which could limit the amounts that federal and state governments will pay for healthcare products and services, which could result in reduced demand for our products or additional pricing pressures. There have been judicial and Congressional challenges to certain aspects of the ACA. Additional state and federal health care reform measures that may be adopted in the future could have a material adverse effect on our industry generally and on our customers. Any changes in, or uncertainty with respect to future reimbursement rates, or changes in hospital admission rates could impact our customers' demand for our products and services, which in turn could impact our ability to successfully commercialize our products, or could limit or eliminate our spending on certain development projects. These changes could adversely affect our business and results of operations. There have been, and we expect there will continue to be, a number of legislative and regulatory changes to the healthcare system that could affect our future revenue and profitability and the future revenue and profitability of our customers. Federal and state lawmakers regularly propose and, at times, enact legislation that results in significant changes to the healthcare system, some of which are intended to contain or reduce the costs of medical products and services. Such uncertainty and any changes could negatively impact our ability to successfully commercialize our products or product candidates and could result in reduced demand for our products and additional pricing pressures.

We are subject to healthcare fraud and abuse regulation and enforcement by federal and state governments, which could adversely impact our business. Healthcare fraud and abuse and health information privacy and security laws potentially applicable to our operations include: - the federal Anti-Kickback Statute, which applies to our marketing practices, educational programs, pricing policies and any relationships with healthcare providers, by prohibiting, among other things, soliciting, receiving, offering or providing remuneration, whether directly or indirectly and overtly or covertly, intended to induce the referral of an individual for (i) the furnishing or the arranging for the furnishing of items or services reimbursable under a federal healthcare program, such as Medicare or Medicaid; or (ii) the purchase, lease or order of, or the arrangement or recommendation of the purchasing, leasing or ordering of, of an item or service reimbursable under a federal healthcare program. Courts have ruled that a person or entity does not need to have actual knowledge of this statute or specific intent to violate it to have committed a violation;- federal civil and criminal false claims laws and civil monetary penalty laws, including civil whistleblower or qui tam actions that prohibit, among other things, knowingly presenting, or causing to be presented, claims for payment or approval to the federal government that are false or fraudulent, knowingly making a false statement material to an obligation to pay or transmit money or property to the federal government, knowingly concealing or knowingly and improperly avoiding or decreasing an obligation to pay or transmit money or property to the federal government or knowingly offering remuneration to influence a Medicare or Medicaid beneficiary's selection of health care providers. The government may assert that a claim, including items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the false claims statutes;- HIPAA and its implementing regulations, which created federal criminal laws that prohibit, among other things, executing a scheme to defraud any healthcare benefit program or making false statements relating to healthcare matters;- HIPAA, as amended by HITECH, also imposes certain regulatory and contractual requirements regarding the privacy, security and transmission of individually identifiable health information;- federal Open Payments (the Physician Payments Sunshine Act) requirements imposed by the ACA on device manufacturers regarding certain "transfers of value" made or distributed to physicians, certain other healthcare providers, and teaching hospitals. Failure to submit required information may result in significant civil monetary penalties for "knowing failures", for all payments, transfers of value or ownership or investment interests that are not timely, accurately and completely reported in an annual submission. Manufacturers must report detailed payment data and submit legal attestation to the accuracy of such data for each calendar year by the 90th day of the subsequent calendar year;- federal consumer protection and unfair competition laws, which broadly regulate marketplace activities and activities that potentially harm consumers; and - state law equivalents of each of the above federal laws, such as anti-kickback and false claims laws that may apply to items or services reimbursed by any third-party payer, including commercial insurers; state laws that require device companies to comply with the industry's voluntary compliance guidelines and the relevant compliance guidance promulgated by the federal government or otherwise restrict payments that may be made to healthcare providers; state laws that require device manufacturers to report information related to payments and other transfers of value to physicians and other healthcare providers or marketing expenditures; and state laws governing the privacy and security of certain health information, many of which differ from each other in significant ways and often are not preempted by HIPAA. The risk of our being found in violation of these laws and regulations is increased by the fact that many of them have not been fully interpreted by the regulatory authorities or the courts, and their provisions are open to a variety of interpretations. We are unable to predict what additional federal or state legislation or regulatory initiatives may be enacted in the future regarding our business or the healthcare industry in general, or what effect such legislation or regulations may have on us. Federal or state governments may impose additional restrictions or adopt interpretations of existing laws that could have a material adverse effect on us. Because of the breadth of these laws and the narrowness of the statutory exceptions and safe harbors available under such laws, some of our business activities, including certain sales and marketing practices and financial arrangements, including the provision of stock options as partial compensation for consulting services, with physicians, some of whom use or purchase our products, and other customers, could be subject to challenge under one or more of such laws. Responding to any action or threat of action against us for violation of these laws, even if we successfully defend against it, could cause us to incur significant legal expenses and divert our management's attention from the operation of our business. If our operations are found to be in violation of any of the laws described above or any other governmental regulations that apply to us, we may be subject to penalties, including civil and criminal penalties, damages, fines, exclusion from governmental healthcare programs, disgorgement, contractual damages, reputational harm, diminished profits and future earnings, and the curtailment or restructuring of our operations, any of which could adversely impact our business.

Numerous federal and state laws and regulations, including HIPAA and the HITECH Act, govern the collection, dissemination, security, use and confidentiality of patient-identifiable health information or more broadly personally identifiable information. HIPAA and the HITECH Act require us to comply with standards for the use and disclosure of health information within our company and with third parties. The Privacy Standards and Security Standards under HIPAA establish a set of basic national privacy and security standards for the protection of individually identifiable health information by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates with whom such covered entities contract for services. Notably, whereas HIPAA previously directly regulated only these covered entities, the HITECH Act, which was signed into law as part of the stimulus package in February 2009, makes certain of HIPAA's privacy and security standards also directly applicable to covered entities' business associates. As a result, both covered entities and business associates are subject to significant civil and criminal penalties for failure to comply with Privacy Standards and Security Standards. HIPAA and the HITECH Act also include standards for common healthcare electronic transactions and code sets, such as claims information, plan eligibility, payment information and the use of electronic signatures, and privacy and electronic security of individually identifiable health information. Covered entities, such as healthcare providers, are required to conform to such transaction set standards pursuant to HIPAA. HIPAA requires healthcare providers like us to develop and maintain policies and procedures with respect to protected health information that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information. The HITECH Act expands the notification requirement for breaches of patient-identifiable health information, restricts certain disclosures and sales of patient-identifiable health information and provides a tiered system for civil monetary penalties for HIPAA violations. The HITECH Act also increased the civil and criminal penalties that may be imposed against covered entities, business associates and possibly other persons and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorney fees and costs associated with pursuing federal civil actions. Additionally, certain states have adopted comparable privacy and data security laws and regulations, some of which may be more stringent than HIPAA. If we do not comply with existing or new laws and regulations related to patient health information, we could be subject to criminal or civil sanctions. New health information standards, whether implemented pursuant to HIPAA, the HITECH Act, state or federal congressional action or otherwise, could have a significant effect on the manner in which we handle healthcare related data and communicate with payers, and the cost of complying with these standards could be significant. The 2013 final HITECH omnibus rule, or the HITECH Final Rule, modified the breach reporting standard in a manner that makes more data security incidents qualify as reportable breaches. Any liability from a failure to comply with the requirements of HIPAA or the HITECH Act could adversely affect our financial condition. The costs of complying with privacy and security related legal and regulatory requirements are burdensome and could have a material adverse effect on our results of operations. The HITECH Final Rule is subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us, as well as our clients and strategic partners. In addition, we are unable to predict what changes to the HIPAA Privacy Standards and Security Standards might be made in the future or how those changes could affect our business. Any new legislation or regulation in the area of privacy and security of personal information, including personal health information, could also adversely affect our business operations. In addition, the FDA has issued guidance to which we may be subject concerning data security for medical devices. Additionally, the Federal Trade Commission has issued and several states have issued or are considering new regulations to require holders of certain types of personally identifiable information to implement formal policies and programs to prevent, detect and mitigate the risk of identity theft and other unauthorized access to or use of such information. Further, the U.S. Congress and a number of states have considered or are considering prohibitions or limitations on the disclosure of medical or other information to individuals or entities located outside of the United States. We may need to comply with applicable laws in those jurisdictions that regulate the use and disclosure of individually identifiable information. The Federal Communications Commission maintains oversight of the Federal Telephone Consumer Privacy Act ("TCPA") governing how entities engage with consumers via telephone, including text communications, typically thought of as "telephone solicitations." Several states have issued or may issue similar statutes or regulations. These statutes mandate compliance with requirements such as limiting time of day for calls/outreach, restricting autodial processes, limiting or prohibiting robot-calling, and compliance with "do not call" registries, among other aspects. Violations can subject our company to fines, penalties and consumer actions. We may need to comply with applicable laws in these jurisdictions that regulate telephone and text messaging to consumers, including our patients, which may increase our costs of compliance.

In the course of conducting our business, we must adequately address quality issues that may arise with our products, as well as defects in third-party components included in our products. There can be no assurance that our internal procedures to minimize risks that may arise from quality issues will be able to eliminate or mitigate occurrences of these issues and associated liabilities. If the quality of our products does not meet the expectations of physicians or patients, then our brand and reputation could suffer and our business could be adversely impacted.

We bill Medicare Part B, Medicaid, the Veterans Administration and other insurers directly for sales and rentals of lymphedema products. As a result, we must comply with all laws, rules and regulations associated with filing claims with the Medicare program, including the Social Security Act, Medicare regulations, the Federal False Claims Act and the Civil Monetary Penalties Law, as well as a variety of additional federal and state laws. During an audit, insurers typically expect to find explicit documentation in the medical record to support a claim. Physicians and other clinicians, who are responsible for prescribing our products for patients, are expected to create and maintain the medical records that form the basis for the claims we submit to Medicare and other insurers. Any failure to properly document the medical records for patients using our products could invalidate claims, impair our ability to collect submitted claims and subject us to overpayment liabilities, False Claims Act liabilities and other penalties including exclusion from the Medicare, Medicaid or private insurance programs. Our reimbursement operations group is responsible for verifying and managing patient claims for our lymphedema products. This group works with physicians and other clinicians to educate physicians and other clinicians on their record keeping responsibilities. From time to time our reimbursement operations group identifies situations where the documentation is missing, incomplete or could be questioned by Medicare or other insurers, and revises its procedures to strengthen our controls, audits and oversight compliance systems based on our experience with Medicare contractors, Medicaid, insurers, physicians and other clinicians. If our procedures are not sufficient to detect deficiencies in the medical records of patients or such procedures are not updated in a timely manner before claims are submitted to Medicare or other insurers, or if the Medicare program or other insurer disagrees with the way the medical necessity support for prescribing our products has been documented, we could face potential liabilities for submitting claims based on inadequate records.

We are exposed to the risk that our employees, distributors and other third parties, in spite of our compliance training and programs, may engage in fraudulent conduct or other illegal activity. Misconduct by employees, distributors and other third parties could include intentional, reckless and/or negligent conduct or disclosure of unauthorized activities that violate FDA regulations, including those laws requiring the reporting of true, complete and accurate information to the FDA, manufacturing standards, federal and state healthcare fraud and abuse laws and regulations, or laws that require the reporting of financial information or data accurately. In particular, sales, marketing and business arrangements in the healthcare industry are subject to extensive laws intended to prevent fraud, kickbacks, self-dealing and other abusive practices. These laws and regulations may restrict or prohibit a wide range of pricing, discounting, marketing and promotion, sales commission, customer incentive programs and other business arrangements. Activities subject to these laws also involve the improper use of information obtained in the course of clinical trials, which could result in regulatory sanctions and serious harm to our reputation. It is not always possible to identify and deter employee and other third-party misconduct, and the steps we take to detect, prevent and remedy any such activity may not protect us from governmental investigations or other actions or lawsuits stemming from a failure to be in compliance with such laws. If any such actions are threatened or instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, including the imposition of significant civil, criminal and administrative penalties, damages, monetary fines, disgorgement, possible exclusion from participation in Medicare, Medicaid and other federal healthcare programs, contractual damages, reputational harm, diminished profits and future earnings and curtailment or restructuring of our operations, any of which could adversely affect our ability to operate.

We often must rely on third parties, such as contract research organizations, medical institutions, clinical investigators and contract laboratories, to conduct our clinical trials and to assist us with pre-clinical development. If these third parties do not successfully carry out their contractual duties or regulatory obligations, have difficulty recruiting sufficient subjects for clinical studies or fail to meet expected deadlines, if these third parties need to be replaced, or if the quality or accuracy of the data they obtain is compromised due to the failure to adhere to our clinical protocols or regulatory requirements or for other reasons, our pre-clinical development activities or clinical trials may be extended, delayed, suspended or terminated, and we may not be able to obtain regulatory approval for, or successfully commercialize, our products on a timely basis, if at all, and our business, operating results and prospects may be adversely affected. Furthermore, our third-party clinical trial investigators may be delayed in conducting our clinical trials for reasons outside of their control.

Any decline in the amount payers are willing to pay for our products could create pricing pressure for us. If we are forced to lower the price we charge for our products, our gross margins will decrease, which will adversely affect our business, financial condition and results of operations. Also, insurance benefits vary substantially by health plan, meaning that some patients have high annual out-of-pocket medical costs, which may make it difficult for those patients to afford our products. Third-party payers, whether foreign or domestic, or governmental or commercial, are developing increasingly sophisticated methods of controlling healthcare costs. In the United States reimbursement for our products exists among the majority of third-party payers. However, reimbursement trends and coverage for our products can differ significantly between third-party payers. In addition, payers, including Medicare, continually review existing technologies for continued coverage and can, without notice, deny or reverse coverage for existing products. We believe any reduction or elimination of coverage or reimbursement of our products by Medicare would likely cause many commercial third-party payers to implement similar reductions or elimination of their coverage or reimbursement of our products. If we are unable to expand coverage of our products by additional commercial payers, or if third-party payers that currently cover or reimburse for our products reverse or limit their coverage or reimbursement in the future, our business and results of operations could be adversely affected. Further, we believe that future coverage and reimbursement may be subject to increased restrictions, such as additional preauthorization requirements. If we are unable to satisfy any new preauthorization requirements or adjust to any future new restrictions on our products, third-party coverage and reimbursement may be limited in the future, which could have an adverse impact on our business. In addition, payers often conduct routine audits and request customer records and other documents to support claims submitted for payment. Recent increases in the frequency and scope of such audits, as well as findings as a result of such audits, could lead to our inability to collect receivables, or require us to repay amounts previously received, which could adversely affect our business and results of operations.

Provisions in our amended and restated certificate of incorporation and amended and restated bylaws, as well as provisions of Delaware law, may delay or prevent an acquisition of us or a change in our management. These provisions include: - authorizing the issuance of "blank check" preferred stock, the terms of which may be established and shares of which may be issued without stockholder approval;- limiting the removal of directors by the stockholders;- prohibiting cumulative voting in the election of directors, which would otherwise allow for less than a majority of stockholders to elect director candidates;- prohibiting stockholder action by written consent, thereby requiring all stockholder actions to be taken at a meeting of our stockholders;- eliminating the ability of stockholders to call a special meeting of stockholders; and - establishing advance notice and compliance requirements for nominations for election to the board of directors, for soliciting proxies in support of nominations or for proposing matters that can be acted upon at stockholder meetings. These provisions may frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board of directors, who are responsible for appointing the members of our management. In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which limits the ability of stockholders owning in excess of 15% of our outstanding voting stock to merge or combine with us. These provisions would apply even if an offer rejected by our board were considered beneficial by some stockholders. Any provision of our amended and restated certificate of incorporation or our amended and restated bylaws or Delaware law that has the effect of delaying or deterring a change of control could limit the opportunity for our stockholders to receive a premium for their shares of our common stock, and could also affect the price that some investors are willing to pay for our common stock.

A primary growth strategy is to establish our products as the standard of care for the treatment of chronic diseases. In order to achieve this growth strategy, we must: - increase clinician and consumer awareness of these diseases, which are often underserved;- introduce the clinical and economic benefits of our solutions to physicians, clinical lymphatic therapists and other clinicians across several specialties and in various clinical settings; and - demonstrate consistent coverage and reimbursement for our solutions by private payers, Medicare, the Veterans Administration and certain Medicaid programs. Clinicians may not adopt our solutions as the standard of care for lymphedema, chronic venous insufficiency and chronic respiratory conditions or may not prescribe our products for a number of reasons, including: - our inability to educate a sufficient number of clinicians on these diseases or our products;- the unavailability or inadequacy of insurance coverage or reimbursement for our products;- failure of evidence supporting clinical benefits or cost-effectiveness of our products over existing alternatives to convince clinicians to change their treatment methods; and - resistance from clinicians to replace traditional treatments with our solutions. We believe recommendations and support of our products by key opinion leaders can influence market acceptance and adoption. If these key opinion leaders choose to not support our products, our ability to achieve broad market acceptance for our products may be impaired.

Our lymphedema products accounted for 89% and 88% of our revenue for the years ended December 31, 2024 and 2023, respectively. We expect that sales of our lymphedema products will continue to account for a majority of our revenue going forward. Therefore, our ability to execute our growth strategy will depend not only upon increasing awareness of lymphedema, but also on the adoption of our products to treat this condition. Many physicians and clinicians may have experience with, and/or invested substantial resources in, developing expertise in traditional or alternative treatments for lymphedema, which may make them less willing to adopt our products. If our lymphedema products fail to achieve wide market acceptance for any reason, our business, financial condition and results of operations could be adversely affected.

Our operating results are directly dependent upon the sales and marketing efforts of our employees and upon our relationships with our distributors and their sales and marketing efforts. If our direct sales force or our distributors fail to adequately promote, market and sell our products, our sales may suffer. Our future success depends largely on our ability to hire, train, retain and motivate skilled sales personnel with significant technical knowledge of lymphedema, chronic venous insufficiency and bronchiectasis. Failure to hire or retain qualified sales personnel would prevent us from building awareness of our solutions, expanding our business and maintaining or generating additional sales. If we are unable to maintain or expand our sales and marketing capabilities, we may not be able to effectively commercialize our products, which could have an adverse impact on our business. For our respiratory therapy products, we rely on DME providers for all aspects of sales, reimbursement, training and support. Our future success with respect to our respiratory therapy products depends largely on our ability to maintain and expand relationships with our current, and to enter into relationships with new, distributors of our airway clearance products. Our ability to continue to market, distribute, and sell our airway clearance products may be at risk if key or multiple of the DME providers choose to stop selling our products or if we are unable to enter into relationships with new distributors. Further, because we fully rely on DME providers related to sales of our AffloVest product, any disruption affecting those DMEs could adversely impact our results, such as the large DME provider that experienced slowed placements of AffloVest due to eligibility requirement changes that led to the decrease in our airway clearance product line revenue in 2023 and the first half of 2024.