67 • federal civil and criminal false claims laws and civil monetary penalty laws, including the False Claims Act, which impose criminal and civil penalties, including through civil “qui tam” or “whistleblower” actions, against individuals or entities from knowingly presenting, or causing to be presented, claims for payment or approval from Medicare, Medicaid or other third-party payors that are false or fraudulent or knowingly making a false statement to improperly avoid, decrease or conceal an obligation to pay money to the federal government. Similar to the federal Anti- Kickback Statute, a person or entity does not need to have actual knowledge of these statutes or specific intent to violate them in order to have committed a violation; • the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, which created new federal criminal statutes that prohibit knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program or obtain, by means of false or fraudulent pretenses, representations, or promises, any of the money or property owned by, or under the custody or control of, any healthcare benefit program, regardless of the payor (e.g., public or private) and knowingly and willfully falsifying, concealing or covering up by any trick or device a material fact or making any materially false statements in connection with the delivery of, or payment for, healthcare benefits, items or services relating to healthcare matters; • HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, or HITECH, and their respective implementing regulations, which impose requirements on certain covered healthcare providers, health plans and healthcare clearinghouses as well as their respective business associates that perform services for them that involve the use, or disclosure of, individually identifiable health information, relating to the privacy, security and transmission of individually identifiable health information without appropriate authorization; • the federal Physician Payment Sunshine Act, created under the ACA, and its implementing regulations, which require manufacturers of drugs, devices, biologicals and medical supplies for which payment is available under Medicare, Medicaid or the Children’s Health Insurance Program to report annually to the U.S. Department of Health and Human Services under the Open Payments Program, information related to payments or other transfers of value made to physicians and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family members; • federal consumer protection and unfair competition laws, which broadly regulate marketplace activities and activities that potentially harm consumers; and • analogous state and foreign laws and regulations, such as state and foreign anti-kickback, false claims, consumer protection and unfair competition laws which may apply to pharmaceutical business practices, including but not limited to, research, distribution, sales and marketing arrangements as well as submitting claims involving healthcare items or services reimbursed by any third-party payor, including commercial insurers; state laws that require pharmaceutical companies to comply with the pharmaceutical industry’s voluntary compliance guidelines and the relevant compliance guidance promulgated by the federal government that otherwise restricts payments that may be made to healthcare providers and other potential referral sources; state laws that require drug manufacturers to file reports with states regarding pricing and marketing information, such as the tracking and reporting of gifts, compensations and other remuneration and items of value provided to healthcare professionals and entities; and state and foreign laws governing the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Because of the breadth of these laws and the narrowness of the statutory exceptions and safe harbors available, it is possible that some of our business activities could, despite our efforts to comply, be subject to challenge under one or more of such laws. Efforts to ensure that our business arrangements will comply with applicable healthcare laws may involve substantial costs. It is possible that governmental and enforcement authorities will conclude that our business practices may not comply with current or future statutes, regulations or case law interpreting applicable fraud and abuse or other healthcare laws and regulations. If any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, including the imposition of civil, criminal and administrative penalties, damages, disgorgement, monetary fines, possible exclusion from participation in Medicare, Medicaid and other federal healthcare programs, contractual damages, reputational harm, diminished profits and future earnings and curtailment of our operations, any of which could adversely affect our ability to operate our business and our results of operations. In addition, the approval and commercialization of any of our product candidates outside the United States will also likely subject us to foreign equivalents of the healthcare laws mentioned above, among other foreign laws.