11 The federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, which prohibits, among other things, knowingly and willfully executing, or attempting to execute, a scheme or artifice to defraud any healthcare benefit program or obtain, by means of false or fraudulent pretenses, representations, or promises, any of the money or property owned by, or under the custody or control of, any healthcare benefit program, regardless of the payor (e.g., public or private), and knowingly and willfully falsifying, concealing or covering up by any trick or device a material fact or making any materially false, fictitious or fraudulent statements in connection with the delivery of, or payment for, healthcare benefits, items or services relating to healthcare matters. Similar to the federal Anti-Kickback Statute, a person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation. Many states have similar laws and regulations that may differ from federal law in significant ways, thus complicating compliance efforts. For example, states have anti-kickback and false claims laws that may be broader in scope than analogous federal laws and may apply regardless of payer. In addition, the federal physician payment transparency requirements, sometimes referred to as the “Physician Payments Sunshine Act,” created under the ACA and its implementing regulations, require certain manufacturers of drugs, devices, biologics and medical supplies for which payment is available under Medicare, Medicaid or the Children’s Health Insurance Program (with certain exceptions) to report annually to CMS information related to payments or other transfers of value made to physicians (defined to include doctors, dentists, optometrists, podiatrists and chiropractors), other healthcare professionals (such as physician assistants and nurse practitioners) and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family members. HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH) and their respective implementing regulations, impose requirements on certain covered healthcare providers, health plans, and healthcare clearinghouses and their respective business associates that perform services for them that involve the use, or disclosure of, individually identifiable health information as well as their covered subcontractors, relating to the privacy, security, and transmission of such individually identifiable health information. In addition, state data privacy laws that protect the security of health information may differ from each other and may not be preempted by federal law. Moreover, several states and local jurisdictions have enacted legislation requiring pharmaceutical manufacturers to, among other things, establish marketing compliance programs, file periodic reports with the state, make periodic public disclosures on sales and marketing activities, report information related to drug pricing, require the registration of sales representatives, and prohibit certain other sales and marketing practices. In addition, the approval and commercialization of any of our product candidates outside the United States will also likely subject us to foreign equivalents of the healthcare laws mentioned above. Pricing and rebate programs must comply with the Medicaid rebate requirements of the U.S. Omnibus Budget Reconciliation Act of 1990 and more recent requirements in the ACA. If products are made available to authorized users of the Federal Supply Schedule of the General Services Administration, additional laws and requirements apply. Products must meet applicable child-resistant packaging requirements under the U.S. Poison Prevention Packaging Act. Manufacturing, sales, promotion and other activities also are potentially subject to federal and state consumer protection and unfair competition laws. The distribution of biologic and pharmaceutical products is subject to additional requirements and regulations, including extensive record-keeping, licensing, storage and security requirements intended to prevent the unauthorized sale of pharmaceutical products. Failure to maintain compliance with these healthcare laws could result in the imposition of significant civil, criminal and administrative penalties, damages, disgorgement, monetary fines, imprisonment, possible exclusion from participation in Medicare, Medicaid and other federal healthcare programs, contractual damages, reputational harm, diminished profits and future earnings and curtailment of our operations, any of which could adversely affect our ability to operate our business and our results of operations. Data Privacy Privacy laws in the U.S. are also increasingly complex and changing rapidly. For example, the California legislature enacted the California Consumer Privacy Act, or CCPA, which took effect on January 1, 2020. The CCPA requires covered companies to provide new disclosures to California residents, and honor their requests to access, delete and opt-out of certain sharing of their personal information. The CCPA provides for civil penalties for violations. Since the enactment of the CCPA, new privacy and data security laws have been proposed in more than half of the states and in the U.S. Congress, reflecting a trend toward more stringent privacy legislation in the U.S. The CCPA itself will expand substantially as a result of California voters approving a November 2020 ballot measure that adopted the California Privacy Rights Act of 2020, or CPRA, which will, among other things, create a new administrative agency to implement and enforce California’s privacy laws effective January 1, 2023.