SERA PROGNOSTICS INC

Previous wording

•The inflationary environment could materially adversely impact our business and results of operations.

Current wording

An inflationary environment could materially adversely impact our business and results of operations.

Previous wording

We have incurred net losses each year since our inception in 2008. To date, we have financed our operations primarily through private placements of our equity and debt securities, bank loans and the sale and issuance of Class A common stock in our initial public offering (“IPO”), which was completed in July 2021. Our net loss for the six months ended June 30, 2024 and 2023 was $16.4 million and $21.1 million, respectively. As of June 30, 2024, we had an accumulated deficit of $263.3 million. Our losses may continue to increase in the future as we continue to devote a substantial portion of our resources to efforts to increase the adoption of, and reimbursement for, the PreTRM test, make improvements to this product, and research, develop, and commercialize new products and services.

Current wording

We have incurred net losses each year since our inception in 2008. To date, we have financed our operations primarily through private placements of our equity and debt securities, bank loans and the sale and issuance of Class A common stock in our initial public offering (“IPO”), which was completed in July 2021. Our net loss for the nine months ended September 30, 2024 and 2023 was $24.3 million and $28.3 million, respectively. As of September 30, 2024, we had an accumulated deficit of $271.2 million. Our losses may continue to increase in the future as we continue to devote a substantial portion of our resources to efforts to increase the adoption of, and reimbursement for, the PreTRM test, make improvements to this product, and research, develop, and commercialize new products and services.

Previous wording

Some of our products and services rely heavily on access to internal and external databases, and loss of access to such databases could materially harm our business.

Current wording

Some of our products and services rely heavily on access to internal and external databases, and loss of access to data or such databases could materially harm our business.

Previous wording

The inflationary environment could materially adversely impact our business and results of operations.

Current wording

An inflationary environment could materially adversely impact our business and results of operations.

Previous wording

Our operating results could be materially impacted by changes in the overall macroeconomic environment and other economic factors that impact customer confidence and spending, including capital spending. Changes in economic conditions, supply chain constraints, logistics challenges, labor shortages, global conflicts, and steps taken by governments and central banks, particularly in response to public health threats as well as other stimulus and spending programs, have led to higher inflation, which is likely, in turn, to lead to an increase in costs and may cause changes in fiscal and monetary policy, including increased interest rates. In a higher inflationary environment, we may be unable to raise the prices of our products sufficiently to keep up with the rate of inflation. Impacts from inflationary pressures could be more pronounced and materially adversely impact aspects of our business where revenue streams and cost commitments are linked to contractual agreements that extend further into the future, as we may not be able to quickly or easily adjust pricing, reduce costs, or implement counter measures.

Current wording

Our operating results could be materially impacted by changes in the overall macroeconomic environment and other economic factors that impact customer confidence and spending, including capital spending. Changes in economic conditions, supply chain constraints, logistics challenges, labor shortages, global conflicts, and steps taken by governments and central banks, particularly in response to public health threats as well as other stimulus and spending programs, could lead to higher inflation, which is likely, in turn, to lead to an increase in costs and may cause changes in fiscal and monetary policy, including increased interest rates. In a higher inflationary environment, we may be unable to raise the prices of our products sufficiently to keep up with the rate of inflation. Impacts from inflationary pressures could be more pronounced and materially adversely impact aspects of our business where revenue streams and cost commitments are linked to contractual agreements that extend further into the future, as we may not be able to quickly or easily adjust pricing, reduce costs, or implement counter measures.

Previous wording

The implementation of Medicare rates pursuant to PAMA has negatively impacted overall pricing and reimbursement for many clinical laboratory testing services and may do so in the future. Since January 1, 2018, the Medicare payment rate for such tests is equal to the weighted median private payer rate reported to CMS, which for many tests is lower than the previous CLFS payment rates due to the often lower negotiated commercial insurer rates applicable to large commercial laboratories that were required to report data to CMS. Likewise, because commercial insurers often base their pricing for laboratory testing on a percentage of the price set on the CLFS, PAMA has in turn affected rates paid by commercial insurers.

Current wording

The implementation of Medicare rates pursuant to PAMA has negatively impacted overall pricing and reimbursement for many clinical laboratory testing services and may do so in the future. Since January 1, 2018, the Medicare payment rate for each such test is equal to the weighted median private payer rate reported to CMS, which for many tests is lower than the previous CLFS payment rates due to the often lower negotiated commercial insurer rates applicable to large commercial laboratories that were required to report data to CMS. Likewise, because commercial insurers often base their pricing for laboratory testing on a percentage of the price set on the CLFS, PAMA has in turn affected rates paid by commercial insurers.

Previous wording

Our laboratory is also accredited by the College of American Pathologists, or CAP. CMS has deemed CAP standards to be equally or more stringent than CLIA regulations and has approved CAP as a recognized accrediting organization. Inspection by CAP is performed in lieu of inspection by CMS for CAP-accredited laboratories. Because we are accredited by CAP, we are deemed to also comply with CLIA. Many commercial insurers require CAP accreditation as a condition to contracting with clinical laboratories to cover their tests.

Current wording

Our laboratory is also accredited by the College of American Pathologists, or CAP. CMS has deemed CAP standards to be equal to or more stringent than CLIA regulations and has approved CAP as a recognized accrediting organization. Inspection by CAP is performed in lieu of inspection by CMS for CAP-accredited laboratories. Because we are accredited by CAP, we are deemed to also comply with CLIA. Many commercial insurers require CAP accreditation as a condition to contracting with clinical laboratories to cover their tests.

Previous wording

We currently market the PreTRM test as an LDT and may in the future market other tests as LDTs. Although historically the FDA applied a policy of enforcement discretion with respect to LDTs whereby the agency does not generally actively enforce its regulatory requirements for such tests, in October 2023, the FDA issued a proposed rule aimed at regulating LDTs under the current medical device framework and phasing out its current enforcement discretion policy over several years. This FDA rulemaking was initiated after years of failed congressional attempts to harmonize the regulatory paradigms applicable to LDTs and otherin vitro diagnostic tests, as discussed further below. The agency’s final rule was released to the public on April 29, 2024 and was officially published in the Federal Register on May 6, 2024, with an effective date of July 5, 2024.

Current wording

We currently market the PreTRM test as an LDT and may in the future market other tests as LDTs. Although historically the FDA applied a policy of enforcement discretion with respect to LDTs whereby the agency did not generally actively enforce its regulatory requirements for such tests, in May 2024, the FDA issued a final rule aimed at regulating LDTs under the current medical device framework and phasing out its current enforcement discretion policy over several years. This FDA rulemaking was initiated after years of failed congressional attempts to harmonize the regulatory paradigms applicable to LDTs and otherin vitro diagnostic tests, as discussed further below. The effective date of the agency’s final rule was July 5, 2024.

Previous wording

FDA’s final rule provides that the LDT enforcement policy phase-out process will occur in gradual stages over a total period of four years, with premarket approval applications for high-risk tests to be submitted by the 3.5-year mark. Moderate-risk and low-risks tests are expected to be in compliance at the 4-year mark, although the FDA has stated that if premarket submissions are pending review it will continue to exercise enforcement discretion with respect to those tests. The FDA’s final rule is complex and, concurrently, the agency announced several exceptions from the requirement to comply with full medical device regulatory controls, depending upon the specific nature of the LDT and the clinical laboratory that is offering such LDT for use by health care providers. We have begun the process of evaluating the final rule’s potential impact on our PreTRM tests, our operations, and our business more generally.

Current wording

FDA’s final rule provides that the LDT enforcement policy phase-out process will occur in gradual stages over a total period of four years, with premarket approval applications for high-risk tests to be submitted by the 3.5-year mark. Moderate-risk and low-risks tests are expected to be in compliance at the 4-year mark, although the FDA has stated that if premarket submissions are pending review it will continue to exercise enforcement discretion with respect to those tests. The FDA’s final rule is complex and, concurrently, the agency announced several exceptions from the requirement to comply with full medical device regulatory controls, depending upon the specific nature of the LDT and the clinical laboratory that is offering such LDT for use by health care providers. Of potential relevance is the agency’s position on LDTs that were marketed prior to the official publication date of the final rule. Such “currently marketed” tests are subject to many of the device regulatory controls but are exempted from the premarket review and FDA authorization requirements (unless or until significant modifications are made to such “currently marketed” tests). Similarly, FDA has created a partial enforcement discretion policy for tests approved by the NY DOH’s Clinical Laboratory Evaluation Program whereby such tests also do not need to undergo FDA premarket review but must come into compliance with all other device general controls in a staggered fashion between 2025 and 2027.

Previous wording

On May 29, 2024, the American Clinical Laboratory Association (ACLA) and one of its members filed a complaint against the FDA in the Eastern District of Texas, alleging that the agency does not have authority to promulgate the LDT final rule and seeking to vacate the FDA’s action. The outcome of such litigation is uncertain. The ongoing litigation could potentially affect FDA’s plans to implement these new LDT requirements, making the potential implementation timeline somewhat uncertain. Affected stakeholders also continue to press for a comprehensive legislative solution to create a harmonized paradigm for oversight of LDTs by both the FDA and CMS, instead of administrative agency action via FDA’s final rule approach, which may be disruptive to the industry and to patient access to certain diagnostic tests. However, it is unclear whether any future legislative efforts would be successful.

Current wording

On May 29, 2024, the American Clinical Laboratory Association (ACLA) and one of its members filed a complaint against the FDA in the Eastern District of Texas, alleging that the agency does not have authority to promulgate the LDT final rule and seeking to vacate the FDA’s action. A second lawsuit was also filed against FDA by the Association for Molecular Pathology (AMP) on August 19, 2024 in the Southern District of Texas, and subsequently the two cases were consolidated into a single action pending in the Eastern District of Texas. Briefing is ongoing in the consolidated case, and the outcome of such litigation is uncertain. The litigation could potentially affect FDA’s plans to implement these new LDT requirements, making the potential implementation timeline somewhat uncertain, although no preliminary injunction has been issued to date. Accordingly the agency has continued its implementation efforts by actively providing guidance and training to clinical laboratories on how to comply with medical device general controls.

Previous wording

In addition, as noted above, Congress has been working on legislation to create an LDT and In Vitro Diagnostic, or IVD, regulatory framework that would be separate and distinct from the existing medical device regulatory framework. For example, as drafted and re-introduced for consideration by the current Congress, reform legislation called the Verifying Accurate, Leading-edge IVCT Development (VALID) Act would codify the term “in vitro clinical test,” or IVCT, and create a new medical product category separate from medical devices to include products currently regulated as IVDs as well as LDTs, among other provisions. The VALID Act would also create a new system for laboratories to use to submit their tests electronically to the FDA for approval, which is aimed at reducing the amount of time it would take for the agency to approve such tests, and establish a new program to expedite the development of diagnostic tests that can be used to address a current unmet need for patients. On March 21, 2024, the House Energy and Commerce held a subcommittee hearing titled “Evaluating Approaches to Diagnostic Test Regulation and the Impact of the FDA’s Proposed Rule.” The private witnesses testifying at the hearing expressed broad support for the bipartisan VALID Act instead of the FDA’s plan to use its medical devices authorities. More recently, following FDA’s release of the final rule at the end of April, certain members of Congress have objected strenuously to the agency’s action. The FY2025 funding bill for FDA that was passed by the House Appropriations Committee on July 17, 2024 also recommends that the agency suspend its efforts to implement the rule and to instead partner with Congress on developing legislation for the field.

Current wording

In addition, as noted above, Congress has been working on legislation to create an LDT and In Vitro Diagnostic, or IVD, regulatory framework that would be separate and distinct from the existing medical device regulatory framework. For example, as drafted and re-introduced for consideration by the current Congress, reform legislation called the Verifying Accurate, Leading-edge IVCT Development (VALID) Act would codify the term “in vitro clinical test,” or IVCT, and create a new medical product category separate from medical devices to include products currently regulated as IVDs as well as LDTs, among other provisions. The VALID Act would also create a new system for laboratories to use to submit their tests electronically to the FDA for approval, which is aimed at reducing the amount of time it would take for the agency to approve such tests, and establish a new program to expedite the development of diagnostic tests that can be used to address a current unmet need for patients. On March 21, 2024, the House Energy and Commerce held a subcommittee hearing titled “Evaluating Approaches to Diagnostic Test Regulation and the Impact of the

Previous wording

The outcome and ultimate impact on our business of any changes to the federal government’s regulation of LDTs is difficult to predict. Potential future increased regulation of our LDTs could result in increased costs and administrative and legal actions for noncompliance, including warning letters, fines, penalties, product suspensions, product recalls, injunctions and other civil and criminal sanctions, which could have a material and adverse effect upon our business, operating results, and financial condition. In addition, at this time it is unclear what testing and data may be required to support any required FDA clearance or approval of our tests, should the final rule be fully implemented as envisioned by FDA and HHS.

Current wording

The outcome and ultimate impact on our business of changes to the federal government’s regulation of LDTs is difficult to predict. Increased regulation of our LDTs under the FDA’s final rule is expected to result in increased costs and administrative and legal actions for noncompliance, including warning letters, fines, penalties, product suspensions, product recalls, injunctions and other civil and criminal sanctions, which could have a material and adverse effect upon our business, operating results, and financial condition. In addition, at this time it is unclear what testing and data may be required to support any required FDA clearance or approval of our tests, should the final rule be fully implemented as envisioned by FDA and HHS following resolution of any pending or future litigation.

Previous wording

Certain states have also adopted privacy and security laws and regulations, some of which may be more stringent than HIPAA and/or regulate information other than PHI. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. At the state level, for example, California has enacted the California Consumer Privacy Act, or CCPA, an extremely comprehensive and stringent privacy law. The CCPA took effect on January 1, 2020, and became enforceable by the California Attorney General on July 1, 2020. It creates individual privacy rights for California consumers (as that term is broadly defined) and increases the privacy and security obligations of entities handling certain personal data, including obligations to provide disclosures to California consumers that include detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches. CCPA does not apply to health information that is protected by HIPAA or the California Confidentiality of Medical Information Act, but CCPA still applies to other types of personal information held by HIPAA covered entities, such as personnel or marketing information. The regulations issued under the CCPA have been modified several times, and there is still some uncertainty about how the law will be interpreted and enforced.

Current wording

Certain states have also adopted privacy and security laws and regulations, some of which may be more stringent than HIPAA and/or regulate information other than PHI. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. At the state level, for example, California has enacted the California Consumer Privacy Act, or CCPA, an extremely comprehensive and stringent privacy law. The CCPA took effect on January 1, 2020, and became enforceable by the California Attorney General on July 1, 2020. It creates individual privacy rights for California consumers (as that term is broadly defined) and increases the privacy and security obligations of certain entities handling certain personal data, including obligations to provide disclosures to California consumers that include detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches. CCPA does not apply to health information that is protected by HIPAA or the California Confidentiality of Medical Information Act, but CCPA still applies to other types of personal information held by HIPAA covered entities, such as personnel or marketing information. The regulations issued under the CCPA have been modified several times, and there is still some uncertainty about how the law will be interpreted and enforced.

Previous wording

In addition, California voters also approved the California Privacy Rights Act, or CPRA, on November 3, 2020 which went into effect in January 2023 with enforcement commencing in July 2023. CPRA modifies the CCPA significantly, resulting in further uncertainty, additional costs and expenses stemming from efforts to comply, and additional potential for harm and liability for failure to comply. The CPRA imposes additional obligations on companies covered by the legislation and expands consumers’ rights with respect to certain sensitive personal information. The CPRA also creates a new regulatory entity, the California Privacy Protection Agency, which is vested with authority to implement and enforce the

Current wording

In addition, California voters also approved the California Privacy Rights Act, or CPRA, on November 3, 2020 which went into effect in January 2023 with enforcement commencing in July 2023. CPRA modifies the CCPA significantly, resulting in further uncertainty, additional costs and expenses stemming from efforts to comply, and additional potential for harm and liability for failure to comply. The CPRA imposes additional obligations on companies covered by the legislation and expands consumers’ rights with respect to certain sensitive personal information. The CPRA also creates a new regulatory entity, the California Privacy Protection Agency, which is vested with authority to implement and enforce the CCPA and the CPRA. In addition to California, more U.S. states are enacting similar legislation, increasing compliance complexity and increasing risks of failures to comply. In 2023, comprehensive privacy laws in Virginia, Colorado, Connecticut, and Utah all took effect, and laws in Montana, Oregon, and Texas took effect in 2024. In addition, laws in other U.S. states are set to take effect beyond 2024, and additional U.S. states have proposals under consideration.

Previous wording

The collection, use, disclosure, transfer, or other processing of personal data regarding individuals in the European Union (EU), including personal health data, is subject to the EU’s General Data Protection Regulation, or GDPR, which became effective on May 25, 2018. The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to processing health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches, and taking certain measures when engaging third-party processors. The GDPR also imposes strict rules on the transfer of personal data to countries outside the EU, including the U.S., and permits data protection authorities to impose large penalties for violations of the GDPR, including potential fines of up to €20 million or 4% of annual global revenues, whichever is greater. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. Our operations currently do not subject us to the GDPR. However, contemplated new initiatives, e.g., marketing the PreTRM test in a member country of the EU, may subject us to and require us to comply with the GDPR.

Current wording

The collection, use, disclosure, transfer, or other processing of personal data regarding individuals in the European Union (EU), including personal health data, is subject to the EU’s General Data Protection Regulation, or GDPR, which became effective on May 25, 2018. The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to processing health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches, and taking certain measures when engaging third-party processors. The GDPR also imposes strict rules on the transfer of personal data to countries outside the EU, including the U.S., and permits data protection authorities to impose large penalties for violations of the GDPR, including potential fines of up to €20 million or 4% of annual global revenues, whichever is greater. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. Our operations currently do not subject us to the GDPR. However, contemplated new initiatives, e.g., marketing the PreTRM test or conducting research in a member country of the EU, may subject us to and require us to comply with the GDPR.

Previous wording

Our internal information technology systems, or those of any of our third party service providers, or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations.

Current wording

Our internal information technology systems, or those of any of our third party service providers, or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or other personal data, which could result in regulatory enforcement, additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations.

Previous wording

In the ordinary course of our business, we and the third parties upon which we rely collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) proprietary, confidential, and sensitive data, including personal data, intellectual property, trade secrets, and other sensitive data (collectively, sensitive information). We may implement a variety of security measures designed to protect systems that store our information, given their size and complexity and the increasing amounts of information maintained on our internal information technology systems and those of our third-party service providers and suppliers, and consultants, these systems are potentially vulnerable to breakdown or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war, and telecommunication and electrical failures, as well as cybersecurity incidents from inadvertent or intentional actions by our employees, contractors, consultants, business partners, and/or other third parties, or from cyber-attacks by malicious third parties, which may compromise our system infrastructure or lead to the loss, destruction, alteration or dissemination of, or damage to, our data.

Current wording

In the ordinary course of our business, we and the third parties upon which we rely collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) proprietary, confidential, and sensitive data, including personal data, intellectual property, trade secrets, and other sensitive data (collectively, sensitive information). We may implement a variety of security measures designed to protect systems that store our information, given their size and complexity and the increasing amounts of information maintained on our internal information technology systems and those of our third-party service providers and suppliers, and consultants. These systems are potentially vulnerable to breakdown or other damage or interruption from system malfunction, natural disasters, terrorism, war, and telecommunication and electrical failures, as well as cybersecurity incidents from inadvertent or intentional actions by our employees, contractors, consultants, business partners, and/or other third parties, or from cyber-attacks by malicious third parties, which may compromise our system infrastructure or lead to the loss, destruction, alteration or unauthorized dissemination of, or damage to, our data.

Previous wording

The recent IT outage experienced by CrowdStrike Holdings, Inc. (“CrowdStrike”) serves as a pertinent example of such vulnerabilities. This outage, caused by a defective update to CrowdStrike’s Falcon Sensor for Windows, led to widespread system crashes and “blue screen of death” errors. The incident was further complicated for devices with BitLocker disk encryption enabled, as recovery required keys stored on crashed servers. The faulty update was not subjected to the usual patch management procedures before its release, highlighting the risks associated with inadequate testing. The outage had a global impact, disrupting critical services across various sectors, including airlines, airports, banks, hospitals, and stock markets. Over 5,000 flights were canceled, significantly affecting air travel operations worldwide. Although CrowdStrike provided remediation steps and continuous support, the incident underscores the potential for significant operational disruptions and the extensive efforts required for recovery. Our operations could have been similarly affected by such an IT outage, resulting in disruptions to our services and significant recovery efforts.

Current wording

The recent IT outage experienced by CrowdStrike Holdings, Inc. (“CrowdStrike”) serves as a pertinent example of such vulnerabilities. This outage, caused by a defective update to CrowdStrike’s Falcon Sensor for Windows, led to widespread system crashes and “blue screen of death” errors. The incident was further complicated for devices with BitLocker disk encryption enabled, as recovery required keys stored on crashed servers. The faulty update was not subjected to the usual patch management procedures before its release, highlighting the risks associated with inadequate testing. The outage had a global impact, disrupting critical services across various sectors, including airlines, airports, banks, hospitals, and stock markets. Although CrowdStrike provided remediation steps and continuous support, the incident underscores the potential for significant operational disruptions and the extensive efforts required for recovery. Our operations could have been similarly affected by such an IT outage, resulting in disruptions to our services and significant recovery efforts.

Previous wording

While we have implemented security measures designed to protect against cybersecurity incidents, there can be no assurance that these measures will be effective. We may be unable in the future to detect vulnerabilities in our information technology systems because such threats and techniques change frequently, are often sophisticated in nature, and may not be detected until after a cybersecurity incident has occurred. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. Applicable data privacy and security obligations may require us to notify relevant stakeholders of cybersecurity incidents. Such disclosures may be costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

Current wording

While we have implemented security measures designed to protect against cybersecurity incidents, there can be no assurance that these measures will be effective. We may be unable in the future to detect vulnerabilities in our information technology systems because such threats and techniques change frequently, are often sophisticated in nature, and may not be detected until after a cybersecurity incident has occurred. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. Applicable data privacy and security obligations may require us to notify relevant stakeholders of cybersecurity incidents. Such disclosures may be costly and may result in reputational harm, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

Previous wording

•Laws and regulations relating to health and safety, labor and employment, public reporting, taxation, and other areas applicable to businesses generally, all of which are subject to change, including, for example, the significant changes to the taxation of business entities were enacted in December 2017.

Current wording

Laws and regulations relating to health and safety, labor and employment, public reporting, taxation, and other areas applicable to businesses generally, all of which are subject to change, including, for example, the significant changes to the taxation of business entities that were enacted in December 2017.

Previous wording

While we believe that the Sunshine Act does not apply to our business, we cannot guarantee that the federal government or other regulators will agree with our determination. Moreover, we could become subject to Sunshine Act reporting requirements if the FDA requires us to obtain premarket authorization for our tests as medical devices (whether because the agency determines that the PreTRM test does not fall within the scope of the agency’s existing LDT definition or because of its recently issued final rule to exercise authority over LDTs as medical devices) or Congress enacts legislative reforms to the federal oversight of LDTs to subject them to FDA regulation and/or the reporting requirements of the Sunshine Act. A determination that we have violated these laws and related CMS regulations, or a public announcement that we are being investigated for possible violations, could adversely affect our business. It is presently unknown how CMS will respond to the recently finalized FDA policy change to effectively render all LDTs medical device products under federal law, and whether or when it will assert that the Sunshine Act’s reporting requirements will begin to apply to the manufacturers of such LDTs. Given that litigation is expected between members of the clinical laboratory industry and FDA/HHS in relation to the May 2024 LDT final rule, it may be many months or even years before we have clarity on the applicability of state and federal Sunshine Act laws to our business.

Current wording

While we believe that the Sunshine Act does not apply to our business, we cannot guarantee that the federal government or other regulators will agree with our determination. Moreover, we could become subject to Sunshine Act reporting requirements if the FDA requires us to obtain premarket authorization for our tests as medical devices (whether because the agency determines that the PreTRM test does not fall within the scope of the agency’s existing LDT definition or because of its recently issued final rule to exercise authority over LDTs as medical devices) or Congress enacts legislative reforms to the federal oversight of LDTs to subject them to FDA regulation and/or the reporting requirements of the Sunshine Act. A determination that we have violated these laws and related CMS regulations, or a public announcement that we are being investigated for possible violations, could adversely affect our business. It is presently unknown how CMS will respond to the recently finalized FDA policy change to effectively render all LDTs medical device products under federal law, and whether or when it will assert that the Sunshine Act’s reporting requirements will begin to apply to the manufacturers of such LDTs. Given that litigation is ongoing between members of the clinical laboratory industry and FDA/HHS in relation to the May 2024 LDT final rule, it may be many months or even years before we have clarity on the applicability of state and federal Sunshine Act laws to our business. Certain states also require medical device manufacturers to maintain compliance programs and/or be licensed as manufacturers or distributors by a state professional board or health department. Because the FDA’s now-in-effect final rule renders a clinical laboratory like ours a “medical device manufacturer,” we have begun the process of evaluating whether and to what extent those kinds of medical device-specific state requirements may be applicable to our operations.