Oncocyte Corp

We are a partner in the healthcare and life science field to researchers and physicians through our development and acquisitions of proprietary molecular technologies in the fields of oncology and transplantation. Through a series of acquisitions, we have built a portfolio of differentiated content with utility in well-established clinical and research markets.

With the increased adoption of precision medicine, healthcare providers are relying on advanced testing to identify patients who will benefit from new, targeted treatments and therapies that are more effective and often have fewer side effects than chemotherapy and other traditional treatments. In addition to identifying these individualized treatment options, researchers and healthcare providers are looking to new technologies to rapidly identify when medical or therapeutic interventions are necessary. We are leveraging our experience in oncology and transplantation to develop and commercialize diagnostic testing at our licensed and accredited laboratory as well as focusing on the development of distributable kitted formats of these technologies so that researchers may study how these tests can be further utilized in other types of cancers. Commercialization of these products, which are intended to be sold for research purposes in the United States and labeled “For Research Use Only” (“RUO”), is expected to occur through a mix of direct sales, partnering and distribution agreements, and licensing.

We have a laboratory and pharma services lab, certified under the Clinical Laboratory Improvements Amendment (“CLIA”) and accredited by the Collage of American Pathologists (“CAP”), in Nashville, Tennessee, and a research and development lab in Göttingen, Germany. We may sometimes refer to our technologies as “diagnostic tests.” Our laboratory developed tests (“LDTs”) are intended to help support and inform physician decision-making but are not themselves diagnostic or prescriptive of treatment decisions. They are critical to our ability to carry out our mission to improve patient outcomes by providing patient specific insights that inform critical provider decisions throughout the patient care journey. We believe that if clinicians are given the right information and educational tools, they will make the right choices with their patients.

We believe that the experience of our team with diverse technologies through our pharma services activities (acquired through Insight Genetics (“Insight”)) (“Pharma Services”), strong scientific integrity regarding evidence generation and innovation mentality, alongside our flexibility in operations and regulatory strategy, will drive our success, differentiate us from our competition, and are foundational to our future.

We plan to expand our role in the rapidly evolving healthcare market by strengthening our positions across our portfolio of capabilities, growing strategic opportunities that drive new business, and differentiating our unique offerings, capabilities, and financial performance. To do so, we are focusing on executing the technology priorities discussed below, which have evolved to reflect our operations and strategic vision.

1. Priorities and Resource Allocation

Spin-off of DetermaRx

As part of our initial strategy on the broader diagnostic continuum, we launched the DetermaRx test via our majority acquisition of Razor Genomics, Inc. (“Razor”) in September 2019. During February 2021, we acquired all outstanding shares of Razor’s common stock which made Razor a wholly-owned subsidiary of Oncocyte.

In February 2023, we sold approximately 70% of the issued and outstanding equity interests of Razor to buyers who are experienced in the development of early-stage lung cancer diagnostics and the provision of gene-expression-based prognostic tests. As part of the same transaction, we transferred to Razor all of the assets and liabilities related to DetermaRx. We continue to retain approximately 30% of the issued and outstanding equity interests of Razor on a fully-diluted basis. For more information regarding this transaction, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations” – “Recent Developments” – “Razor Genomics Purchase Agreement.”

DetermaRx

DetermaRx is the first and only test to predict patient’s risk of cancer recurrence following surgery and response to chemotherapy in early-stage lung cancer, and was our first test to be commercialized and reimbursed by Medicare. DetermaRx serves an unmet clinical need by helping to guide treatment decisions given the 30-50% mortality rate in patients in the absence of timely chemotherapy treatment. Prior to our transfer to Razor in February 2023 of all of the assets and liabilities related to DetermaRx, we commercialized and performed DetermaRx testing at a CLIA certified laboratory in Irvine.

2. Expand Biomarker Technologies to Drive Advancements for Patient Management – Oncology

The field of oncology receives significant investment in research, development, and treatment, yet it remains an area of great unmet medical need. For patients diagnosed with cancer, immunotherapies, particularly immune checkpoint inhibitors (“ICI’s”) targeting PD-1 and PD-L1, help recruit the body’s immune system to attack the growing tumor. Current predictive biomarkers, including PD-L1 and Tumor Mutational Burden (“TMB”), have shown only limited ability to accurately predict which patients will respond to immunotherapy.

According to published literature, more than half of PD-L1 positive patients do not respond to immune-checkpoint inhibitors, and 1 in 6 patients who will respond are missed. ICIs are approved in 16 different tumor types, and it is estimated that 4.1 million patients are eligible for these drugs worldwide. Pharmaceutical companies are continuing to invest heavily in this space, with hundreds of clinical trials ongoing, and a number of drugs approved by the U.S. Food and Drug Administration (“FDA”), including pembrolizumab (“Keytruda”), nivolumab (“Opdivo”), atezolizumab (“Tecentriq”), and Imfinzi.

Although ICI treatments can be highly effective in the right patients, ICI’s can also have significant side effects which include exacerbation of latent autoimmune disorders. There is a compelling medical and health economic unmet need for a biomarker that can (i) identify responder populations missed by current biomarkers, (ii) inform the use of ICI’s in combination with traditional cytotoxic chemotherapy, (iii) support patient stratification clinical trials for next generation immunomodulating therapies, and (iv) provide a reliable measurement of the tumor immune microenvironment for researchers in biopharma and academia.

DetermaIO

Through the acquisition of Insight in January 2020, we expanded our oncology portfolio to include a novel gene expression-based test called DetermaIO, which assesses the tumor microenvironment and identifies patients whose immune system is poised to benefit from immunotherapy. DetermaIO measures the expression level of 27 selected genes which are interpreted through the use of a proprietary algorithm (patent pending) which computes a quantitative score (“IO Score”) that incorporates information from the immune inflammatory infiltrates within and around the tumor combined with information from the wound response surrounding the tumor.

We successfully completed the CLIA Validation of DetermaIO in April 2020 at our laboratory in Nashville, Tennessee. DetermaIO has demonstrated in multiple clinical studies, including a gold-standard randomized clinical trial (RCT) to provide incremental utility beyond established biomarkers used to identify patients who will have a response to ICIs. The test has been successfully validated in four tumor types and across the four major ICIs (Keytruda, Opdivo, Tecentriq and Imfinzi).

In the fourth quarter of 2021, this test became available as part of an early access program with leaders in the immuno-oncology field. A kitted research product format of the underlying technology began proof-of-concept development in the first quarter of 2023.

DetermaIO as a Clinically Validated Laboratory Test

DetermaIO incorporates measurement of activity of genes expressed in immune effector cells, genes expressed in activated wound response cells, and in some cases, genes expressed by the tumor itself. It is the measurement of these three signals that we believe distinguishes DetermaIO from most other approaches. An established threshold is used to classify patients as a likely responder or as a likely non-responder whose association with response to immune therapy has now been validated in several independent clinical studies in multiple different cancer types.

Based on our projected reimbursable pricing model, we believe that the clinical use of DetermaIO will address a potential $3.0 billion total addressable market (“TAM”) opportunity. The actual TAM for DetermaIO in medical practice will depend upon a variety of factors including our ability to demonstrate the efficacy and clinical utility of the test, the extent of physician acceptance of the test, whether the test will be approved for Medicare reimbursement, and, if reimbursement is approved, the actual approved reimbursement price.

DetermaIO’s “IO Score” as a Biomarker for Further Research

The early success of ICIs has stimulated deeper investigation into the mechanism by which tumors evade the immune system which has revealed a complex interplay between tumor evasion strategies, the activity of immune effector cells and the tissue repair mechanisms that modulate anti-tumor activity. The balance between signal from the tumor, signals from the inflammatory cells invading the tumor, and signals from the wound response are now understood to account for resistance to ICI’s and are the target of second-generation therapeutic strategies to overcome resistance.

We believe DetermaIO is a direct measure of the status of the tumor immune microenvironment and as such identifies those tumors poised to respond to the addition of ICI’s. We believe that the integration of the signal from the “Hot” component of the tumor, the “Cold” immune repressive features, and in some cases the exclusion of immune cells altogether, an immune desert, is superior to measuring any of these physiologies alone.

There are approximately 3,000 PD-1/PD-L1 targeted therapy clinical trials ongoing that are expected to recruit over 500,000 patients. This represents a potential $1.0 billion market opportunity for immune-therapy clinical trial services to pharma companies developing ICIs which could be supported by our laboratory in Nashville, Tennessee or through a future kitted RUO product.

DetermaCNI

Therapy response monitoring is an emerging estimated $6.0 billion clinical opportunity in the United States. The current standard of care, CT/MRI imaging, can struggle to differentiate between progression and pseudo-progression, where a tumor will appear larger but is actually a side-effect of the immunotherapy working. Minimally invasive blood-based monitoring technology, like DetermaCNI, provides physicians a secondary data point to assess the effectiveness of therapy.

The test converts cell-free DNA (“cfDNA”) next-generation sequencing (“NGS”) results into a proprietary genome-wide copy number instability (“CNI”) score which can be used to monitor and guide ongoing treatment decisions. This test is differentiated from other monitoring tests in two ways; (i) it does not require tumor tissue upfront which can be hard or impossible to obtain, and (ii) the test measures copy number variation instead of mutations identified in a patient’s diagnostic biopsy specimen.

3. Expand Biomarker Technologies to Drive Advancements for Patient Management – Transplant

Clinicians have limited options in assessing graft health post-transplantation. Traditional methods to assess transplant organ damage are imprecise, invasive, and/or inadequate. Donor-derived cell-free DNA (“dd-cfDNA”) is one of the best investigated biomarkers, with an increasing number of clinical validation studies published. Most of these studies focused on the fractional concentration (percentage) of the total cfDNA in the patients’ plasma (“dd-cfDNA(%)”), however, changes in host cfDNA, which represents the denominator in the percentage calculations, over time adds an additional source of possible uncertainty. If the denominator (concentration of total cfDNA in plasma) is not constant, or at least does not have a narrow window under all conceivable clinical conditions, dd-cfDNA(%) values can fluctuate without a change in the value of the relevant analyte dd-cfDNA being measured. To remove this variable and cause of uncertainty, we have introduced VitaGraft, a test to measure not only the percentage of dd-cfDNA, but also the absolute quantification dd-cfDNA, expressed as copies/mL.

VitaGraft

Through the acquisition of Chronix Biomedical, Inc. (“Chronix”), we gained access to two patents in the field of the detection and quantification of dd-cfDNA in patients after organ transplantation. The dd-cfDNA biomarker has been shown to be a very valuable tool to the traditional surveillance of graft health after transplantation and is currently an estimated $2.0 billion reimbursed market in the United States under a blanket local coverage determination (“LCD”).

VitaGraft as a Clinically Validated Laboratory Test

In October 2021, our patent filing for the use of digital PCR for the quantification of dd-cfDNA was issued by the United States Patent and Trademark Office (the “USPTO”). We successfully completed the technology transfer of VitaGraft to our laboratory in Nashville, Tennessee in the second quarter of 2022. The assay is analytically and clinically validated in three major solid organ transplant types (kidney, liver and heart) by peer reviewed international publications. We received a positive coverage decision from the Molecular Diagnostics Services (“MolDx”) for VitaGraft Kidney in August of 2023, and it became commercially available for ordering in January 2024 through our CLIA Laboratory in Nashville, Tennessee. VitaGraft Kidney is now broadly available to transplant professionals upon request.

VitaGraft’s dd-cfDNA Quantification as a Biomarker for Further Research

Several questions remain unanswered in transplant graft management and offer interesting areas for research. Among these are, immunosuppression dosing optimization, the utility of the absolute quantification of dd-cfDNA in long-term management, and the viability of xenograft and 3-D printed organs. To support these and other areas of groundbreaking research, we have initiated the development of a kitted RUO product, GraftAssure, and a prototype was completed in the fourth quarter of 2023.

In April 2024, we entered into an agreement to collaborate in the development and the commercialization of research use only and in vitro diagnostics kitted transplant products. See Note 14, “Subsequent Events,” to our consolidated financial statements included elsewhere in this Report for additional information.

4. Billing, Coverage, and Reimbursement for our Laboratory Tests

We are currently in the process of developing and commercializing DetermaIO, VitaGraft and DetermaCNI.

In the absence of reimbursement by a health insurance plan or Medicare, patients who would be candidates for the use of our tests may decline to use our tests, and physicians may be reluctant to prescribe our tests, due to the cost of the test to the patients. Due to this patient cost factor, revenues from any new cancer test that we market may experience slow growth until the test is approved for reimbursement by larger payer plans which cover many patients.

Medicare

For diagnostics tests, Medicare or the Centers for Medicare & Medicaid Services (“CMS”) reimbursement approval is critical. CMS relies on a network of Medicare Administrative Contractors (“MACs”) to make LCDs approving a test for reimbursement. The MolDx Program was developed by Palmetto GBA (the previous MAC for California) to identify and establish coverage and reimbursement for molecular diagnostics tests. The program has developed guidelines for the level of evidence of efficacy required to be obtained through clinical trials. Palmetto, which contracted with CMS to administer the MolDx, issues LCDs that affect coverage, coding, and billing of many molecular tests and the current MAC for California, Noridian Healthcare Solutions, LLC, has adopted the coverage policies from Palmetto. MACs also serve as the primary operational contact between the Medicare Fee-For-Service program, for paying Medicare claims, and approximately 1.5 million health care providers enrolled in the program. Delays in obtaining MAC approval, or any changes made related to any favorable LCDs, could have a material adverse impact on our business.

Private Third-Party Payers

In addition to seeking Medicare reimbursement approval, we will seek reimbursement approval from private payers such as health insurance companies and HMOs. Private payers generally will determine whether to approve a diagnostic test for reimbursement based on the published results of clinical validity and clinical utility studies, and may base their decision on whether to cover a test, and at what level to reimburse, on the MAC’s LCD. Obtaining private payer medical coverage generally takes twelve to twenty-four months from the time that sufficient evidence is demonstrated. In the interim we will bill commercial payers and appeal any denials using the published clinical evidence supporting the utility of the test.

Reimbursement rates paid by private third-party payers can vary based on whether the provider is considered to be an “in-network” provider, a participating provider, a covered provider, an “out-of-network” provider or a non-participating provider. Currently, we are out-of-network with all commercial payers. While these definitions can vary among payers, an in-network provider usually has a contract with the payer or benefits provider. Such contract governs, among other things, service-level agreements and reimbursement rates. In certain instances, an insurance company may negotiate an in-network rate for our testing. An in-network provider may have rates that are lower per test than those that are out-of-network, and that rate can vary widely. Rates vary based on the payer, the testing type and often the specifics of the patient’s insurance plan. If a laboratory agrees to contract as an in-network provider, it generally expects to receive quicker payment and access to additional covered patients. However, it is likely that we will initially be considered an “out-of-network” or non-participating provider by payers who cover the vast majority of patients until we can negotiate contracts with the payers.

We cannot predict whether, or under what circumstances, payers will reimburse for patients for our tests or whether our efforts to appeal denied claims will be successful. While we have a rigorous process for prior authorization and appeals to overturn denials and to get contracted with commercial payers, full or partial denial of coverage by payers, or reimbursement at inadequate levels, would have a material adverse impact on our business and on market acceptance of our tests.

Billing and Collection

Where there is a private or governmental third-party payer coverage policy in place, we will bill the payer and the patient in accordance with the established policy. Our efforts in obtaining reimbursement based on individual claims, including pursuing appeals or reconsiderations of claims denials, could take a substantial amount of time, and bills may not be paid for many months, if at all. Furthermore, if a third-party payer denies coverage after final appeal, payment may not be received at all.

Where there is no coverage policy in place, we will pursue reimbursement on a case-by-case basis. In some cases, if not prohibited by law or regulation, we may bill physicians, hospitals and other laboratories directly for the services that they order. However, laws and regulations in certain states prohibit laboratories from billing physicians or other purchasers for testing that they order. Some states may allow laboratories to bill physicians directly but may prohibit the physician and, in some cases, other purchasers from charging more than the purchase price for the services, or may allow only for the recovery of acquisition costs, or may require disclosure of certain information on the invoice. An increase in the number of states that impose similar restrictions could adversely affect us by encouraging physicians to perform laboratory services in-house or by causing physicians to refer services to other laboratories that are not subject to the same restrictions. Adoption or expansion of laws and regulations that limit our ability to bill and obtain reimbursement for the full costs of our services would have a material adverse impact on our business and on market acceptance of our tests.

Corporate Information

We were incorporated in September 2009 in the state of California. Our principal executive offices are located at 15 Cushing, Irvine, California 92618. Our telephone number is (949) 409-7600. Our website iswww.oncocyte.com. Information contained on, or that can be accessed through, our website, is not, and shall not be deemed to be, incorporated into or be considered a part of this Report.

Competition

Our industry is highly competitive and characterized by rapid technological change. Key competitive factors in our industry include, among others, the ability to successfully complete clinical studies, the ability to obtain any required regulatory approval, average selling prices of competing tests, CLIA laboratory capacity and costs, intellectual property and patent rights, and sales and marketing capabilities. We are an early-stage company with limited resources and operating history and many of our competitors have substantially more resources than we do, including financial, technical and sales resources. In addition, many of our competitors have more experience than we have in the development and commercialization of diagnostics. We are also competing with academic institutions, governmental agencies and private organizations that are conducting research in the field of diagnostics. Our competition will be determined in part by the potential indications for which our lead test candidates are developed and ultimately marketed. Additionally, the timing of market introduction of our diagnostic tests or of competitors’ tests may be an important competitive factor.

The DetermaIO test competes with multiple biomarkers already in clinical use or in development for predicting response to immunotherapy. The most commonly used clinical tests employed in the immunotherapy response market are PD-L1 expression testing and TMB. We believe, however, the current standard of care for PD-L1 testing has important limitations. According to published literature, more than half of PD-L1 positive patients do not respond to immune- checkpoint inhibitors, and 1 in 6 patients who will respond are missed (referred to as a “false negative”). Furthermore, data presented at recent oncology medical conferences suggests that TMB is not a reliable predictor of immunotherapy response. Further, data presented at the Society for Immunotherapy of Cancer, suggested that DetermaIO outperformed both PD-L1 and TMB in predicting response to checkpoint inhibitors in patients with NSCLC. In 2021, we presented data at four major scientific conferences supporting the association of DetermaIO and response to checkpoint inhibitor therapy and comparing to PD-L1 and TMB. Notably, data presented at both the European Society for Medical Oncology and the San Antonio Breast Cancer Symposium demonstrated the predictive value of the test.

DetermaCNI competes with tumor-informed tests that are on market for treatment monitoring as well as blood-only targeted panels. We believe we are differentiated from the former in that the test requires no tissue. DetermaCNI is differentiated from targeted approaches because it assesses changes across the whole genome broadly as opposed to changes in a subset of genes and is applicable in both adjuvant and neo-adjuvant patient scenarios, versus tests that monitor Minimal Residual Disease which are typically only used when the tumor is removed.

VitaGraft competes with multiple other tests from competitors that measure donor derived cell-free DNA. While our competitors have an established customer base, we believe that through the use of digital PCR, VitaGraft’s reduced need for batching to achieve attractive sample economics, fast turnaround time and native absolute quantification will be differentiators in the marketplace. Based on our research of customer needs, we believe that this fast turnaround time is critical to inform timely, critical medical decisions.

Facilities

We lease a building located at 15 Cushing in Irvine, California that serves as our principal executive and administrative offices. We also operate a CLIA certified laboratory in Nashville, Tennessee, and through the acquisition of Chronix, we also have a research and development facility in Göttingen, Germany, which serves as the center of excellence for our blood-based monitoring program.

Materials

There is a limited number of manufacturers of molecular testing equipment and related chemical reagents necessary for the provision of our tests. Additionally, the chemical reagents used with the testing equipment we choose are available only from the equipment manufacturer. This situation poses a risk to us. If we were to encounter inconsistent results using testing equipment and reagents from one manufacturer, we would need to switch to testing equipment from a different manufacturer. If issues were to arise with the testing equipment or with the reagents we are using, causing us to acquire different testing equipment again, we would need to conduct additional laboratory studies to determine whether our previous test results can be reproduced using the new equipment. If similar issues were to arise after commercialization of a test, we could experience a disruption for a period of time in providing the tests to patients and we would lose revenue and potentially market share as a result.

Patents and Trade Secrets

We rely primarily on patents and contractual obligations with employees and third parties to protect our proprietary rights. We have sought, and intend to continue to seek, appropriate patent protection for important and strategic components of our proprietary technologies by filing patent applications in the United States and certain foreign countries. There can be no assurance that any of our patents will guarantee protection or market exclusivity for our diagnostic tests and diagnostic test candidates. We may also use license agreements both to access technologies developed by other companies and universities and to convey certain intellectual property rights to others. Our financial success will be dependent, in part on our ability to obtain commercially valuable patent claims, to protect our intellectual property rights, and to operate without infringing upon the proprietary rights of others.

Through our acquisition of Insight in January 2020 and Chronix in April 2021, we obtained exclusive rights to additional intellectual property, including trade secrets, registered trademarks, domain names, copyrights, issued and reissued patents and pending applications, and software material, and have, since our acquisition of Insight, filed our own patents to protect DetermaIO.

Through our acquisition of Chronix in April 2021, we obtained intellectual property rights to 10 patent families in the field of detection of cell-free tumor DNA and quantification of donor derived cell-fee DNA, with numerous already issued patents in the United States and European Union (“EU”), expiring between April 2031 and October 2034. In addition, we obtained trade secrets, registered trademarks, domain names, copyrights and proprietary software material.

In addition to relying on patents, we rely on trade secrets, know-how, continuing technological advancement, and licensing opportunities to maintain our competitive position. The molecular diagnostics that we are developing use gene expression classifiers or algorithms, which are mathematical models that weigh the biomarkers to produce a score. We treat the mathematical models as trade secrets. We have entered into intellectual property, invention, and non-disclosure agreements with our employees, and it is our practice to enter into confidentiality agreements with our consultants. There can be no assurance, however, that these measures will prevent the unauthorized disclosure or use of our trade secrets and know-how, or that others may not independently develop similar trade secrets and know-how or obtain access to our trade secrets, know-how, or proprietary technology.

General Risks Related to Obtaining and Enforcing Patent Protection

Our patents and patent applications are directed to compositions of matter, formulations, methods of use and/or methods of manufacturing. The patent positions of pharmaceutical and biotechnology companies, including ours, are generally uncertain and involve complex legal and factual questions. Our business could be negatively impacted by any of the following:

In addition, others may independently develop similar or alternative technologies, duplicate any of our technologies and, if patents are licensed or issued to us, design around the patented technologies licensed to or developed by us. Moreover, we could incur substantial costs in litigation if we have to defend ourselves in patent lawsuits brought by third parties or if we initiate such lawsuits.

The United States Supreme Court’s decisions inMayo Collaborative Services v. Prometheus Laboratories, Inc. andAssociation for Molecular Pathology v. Myriad Genetics may limit our ability to obtain patent protection on diagnostic methods that merely recite a correlation between a naturally occurring event and a diagnostic outcome associated with that event. Our cancer diagnostic tests are based on the presence of certain genetic markers for a variety of cancers. InMayo Collaborative Services v. Prometheus Laboratories, Inc., the Supreme Court ruled that patent protection is not available for the simple use of a mathematical correlation of the presence of a well-known naturally occurring metabolite as a means of determining proper drug dosage. The claims in the contested patents that were the subject of that decision were directed to measuring the serum level of a drug metabolite and adjusting the dosing regimen of the drug based on the metabolite level. The Supreme Court said that a patent claim that merely claimed a correlation between the blood levels of a drug metabolite and the best dosage of the drug was not patentable subject matter because it did no more than recite a correlation that occurs in nature.

InAssociation for Molecular Pathology v. Myriad Genetics, the Supreme Court ruled that the discovery of the precise location and sequence of certain genes, mutations of which can dramatically increase the risk of breast and ovarian cancer, was not patentable. Knowledge of the gene location and sequences was used to determine the genes’ typical nucleotide sequence, which, in turn, enabled the development of medical tests useful for detecting mutations in these genes in a particular patient to assess the patient’s cancer risk. But the mere discovery of an important and useful gene did not render the genes patentable as a new composition of matter.

Also, inAriosa Diagnostics, Inc. v. Sequenom, Inc., the Federal Circuit ruled that a method for detecting a paternally inherited nucleic acid of fetal origin performed on a maternal serum or plasma sample from a pregnant female was not patent eligible subject matter under the framework set forth inMayo Collaborative Services v. Prometheus Laboratories, Inc. The court examined the elements of the claim to determine whether the claim contained an inventive concept sufficient to transform the claimed naturally occurring phenomenon into a patent eligible application and found that the method steps did not support patentability because they used conventional amplification and detection techniques. Although the claims can be distinguished from the claims at issue inMayo Collaborative Services v. Prometheus Laboratories, Inc., the court was bound by the language of the Supreme Court decision to hold Sequenom’s claims unpatentable.

InIllumina, Inc. v. Ariosa Diagnostics, Inc., the Federal Circuit reversed and remanded the lower court and found that claims directed to methods of preparing plasma to isolate extracellular fetal DNA, based on the inventors’ discovery that fetal DNA strands in maternal plasma are relatively short compared to maternal DNA, were directed to patent-eligible subject matter. The majority reasoned that the claimed methods include process steps that lead to a DNA fraction that is different from the naturally-occurring fraction present in the mother’s blood due to enrichment of cell-free fetal DNA. Thus, the process achieves more than simply observing that fetal DNA is shorter than maternal DNA or detecting the presence of that phenomenon. The majority noted that the inclusion of specific techniques for carrying out the steps of the method, illustrated the concrete nature of the claimed process steps. These concrete process steps were used, not merely to observe the presence of the phenomenon that fetal DNA is shorter than maternal DNA, but to exploit that discovery in a method for preparation of a mixture enriched in fetal DNA and thus supported a finding of patent eligible subject matter.

While the cases discussed above are instructive, the USPTO has also issued guidelines in light of the Supreme Court decisions indicating that process claims having a natural principle as a limiting step will be evaluated to determine if the claim includes additional steps that practically apply the natural principle such that the claim amounts to significantly more than the natural principle itself. Because the diagnostic tests that we are developing combine an innovative methodology with newly discovered compositions of matter, we are hopeful that this Supreme Court decision will not preclude the availability of patent protection for our diagnostic tests. However, there is no guarantee that such pending patent applications will issue nor that our existing patents would survive a challenge in light of the above-referenced case law.

The USPTO has also issued multiple Subject Matter Eligibility Updates to provide further guidance in determining subject matter eligibility. The Subject Matter Eligibility Updates include new Subject Matter Eligibility Examples for the Life Sciences. These examples provide favorable exemplary subject matter eligibility analysis of hypothetical claims covering diagnostic tests and claims drawn from case law. This update from the USPTO does not change our opinion on our ability to obtain meaningful patent protection.

There is a risk that any patent applications that we file and any patents that we hold or later obtain could be challenged by third parties and declared invalid or infringing of third-party claims. A patent interference proceeding may be instituted with the USPTO when more than one person files a patent application covering the same technology, or if someone wishes to challenge the validity of an issued patent filed before March 16, 2013. At the completion of the interference proceeding, the USPTO will determine which competing applicant is entitled to the patent, or whether an issued patent is valid. Patent interference proceedings are complex, highly contested legal proceedings, and the USPTO’s decision is subject to appeal. This means that if an interference proceeding arises with respect to any of our patent applications, we may experience significant expenses and delay in obtaining a patent, and, if the outcome of the proceeding is unfavorable to us, the patent could be issued to a competitor rather than to us. In addition to interference proceedings, the USPTO can review issued patents at the request of a third party seeking to have the patent invalidated. Currently an inter partes review proceeding will allow third parties to challenge the validity, based on issues of novelty and non-obviousness, in view of patents and printed publications, of an issued patent where there is a reasonable likelihood of invalidity. This means that patents owned or licensed by us may be lost if the outcome of the review is unfavorable to us.

Post Grant Review under the America Invents Act makes available opposition-like proceedings in the United States. As with the USPTO interference proceedings, Post Grant Review proceedings will be very expensive to contest and can result in invalidation of a recently issued patent. To invoke a post-grant review, a challenge must be filed within nine months of a patent’s issuance or reissuance. Post-grant review can be sought based on any grounds that can be used to challenge the validity of a patent claim, with the exception of failure to disclose the best mode. Also, a derivation proceeding may be instituted by the USPTO or an inventor alleging that a patent or application was derived from the work of another inventor.

Oppositions to the issuance of patents may be filed under European patent law and the patent laws of certain other countries. As with the USPTO interference proceedings, these foreign proceedings can be very expensive to contest and can result in significant delays in obtaining a patent or can result in a denial of a patent application.

The enforcement of patent rights often requires litigation against third party infringers, and such litigation can be costly to pursue. Even if we succeed in having new patents issued or in defending any challenge to issued patents, there is no assurance that our patents will be comprehensive enough to provide us with meaningful patent protection against our competitors. Further, should we sue a third-party infringer for patent infringement, the infringer may assert counter claims and attempt to invalidate some or all of the asserted patent claims. There is always some risk that such a counter claim could result in invalidation of one or more claims of an asserted patent.

Government Regulation

CLIA—Clinical Laboratory Improvement Amendments of 1988 and State Regulation

We expect that DetermaIO, VitaGraft and DetermaCNI will be regulated under the CLIA as LDTs. In 1988, Congress enacted CLIA, which established quality standards for all laboratories that provide testing services to ensure the accuracy, reliability and timeliness of patient test results regardless of where the test is performed.

Under CLIA, a laboratory is defined as any facility that performs laboratory testing on specimens derived from humans for the purpose of providing information for the diagnosis, prevention or treatment of disease, or the impairment of, or assessment of health of human beings. Since our laboratory in Nashville, Tennessee meets this definition, CLIA requires that we hold a certificate applicable to the complexity of the categories of testing we perform and that we comply with certain standards. Laboratories performing high complexity testing are required to meet more stringent requirements than laboratories performing less complex tests. CLIA regulations require clinical laboratories like ours to comply with various operational, personnel, facilities administration, quality, and proficiency testing requirements intended to ensure that testing services are accurate, reliable and timely. CLIA certification is a prerequisite for reimbursement eligibility for services provided to state and federal health care program beneficiaries. CLIA is user-fee funded. Therefore, all costs of administering the program must be covered by the regulated facilities, including certification and survey costs. CMS enforces CLIA compliance. CMS granted the CAP Laboratory Accreditation Program deeming authority, which allows CAP inspection in lieu of a CMS inspection. Our laboratory in Nashville, Tennessee is CLIA-certified and CAP-accredited.

FDA Regulation of Diagnostic Tests

We have designed, developed, and are validating our tests as LDTs, and consequently, believe our tests are governed under the CLIA regulations, as administered by CMS, as well as by applicable state laws.

Historically, the FDA had exercised enforcement restraint with respect to most LDTs and had not required laboratories that offer LDTs to comply with FDA requirements for medical devices, such as registration, device listing, quality systems regulations, premarket clearance or premarket approval, and post-market controls.

However, in recent years, the FDA has stated it intends to end its policy of enforcement restraint and begin regulating certain LDTs as medical devices.

In September 2023, the FDA announced a proposed rule aimed at helping to ensure the safety and effectiveness of these tests. The proposed rule seeks to amend the FDA’s regulations to make explicit that in vitro diagnostics (“IVDs”) are devices under the Federal Food, Drug, and Cosmetic Act (the “FD&C Act”), including when the manufacturer of the IVD is a laboratory. Along with this amendment, the FDA is proposing a policy under which the FDA intends to provide greater oversight of LDTs through a phaseout of its general enforcement discretion approach for most LDTs.

In October 2023, the FDA published a proposed rule entitled “Medical Devices; Laboratory Developed Tests.” Following publication of the proposed rule, the FDA received requests for an extension of the comment period. After considering the requests and other factors, including the extensive background of public comment on this topic and the public health benefits of proceeding expeditiously, the FDA determined to proceed with the standard 60-day comment period. As stated in the notice of proposed rulemaking, comments on the proposed rule must have been submitted to the docket by December 4, 2023.

This rulemaking would amend the definition of “in vitro diagnostic products” in FDA regulations to state that IVDs are devices under the FD&C Act “including when the manufacturer of these products is a laboratory.” In conjunction with this amendment, the FDA is also proposing a policy under which the FDA intends to phase out its general enforcement discretion approach for LDTs so that IVDs manufactured by a laboratory would generally fall under the same enforcement approach as other IVDs. The FDA has also made a preliminary determination that the general enforcement discretion approach should be phased out in a manner that accounts for the level of public health concern and the importance of avoiding undue disruption to the testing market, including undue disruption to the provision of care. Therefore, the FDA is proposing a gradual phaseout to occur in stages over a total period of four years. The FDA anticipates that this phaseout policy should ultimately enable IVDs offered as LDTs that are supported by sound science to remain on the market. The FDA also recognizes that some IVDs may need to come off the market, because, for example, the IVD cannot meet applicable requirements under the FD&C Act and its implementing regulations, or the laboratory chooses not to invest resources to meet those requirements.

While the FDA’s general enforcement discretion approach has been focused on LDTs, the FDA is proposing a broader scope for the phaseout policy. Specifically, the FDA is proposing to apply the phaseout policy to IVDs that are manufactured and offered as LDTs by laboratories that are certified under CLIA and that meet the regulatory requirements under CLIA to perform high complexity testing, even if those IVDs do not fall within the FDA’s traditional understanding of an LDT because they are not designed, manufactured, and used within a single laboratory. Throughout this preamble, these IVDs are referred to as “IVDs offered as LDTs.” The FDA is proposing this scope because it recognizes that not all laboratories have understood the limited nature of the FDA’s general enforcement discretion approach and have been offering IVDs based on the approach even when they do not fit what the FDA generally considers to be an LDT. As previously discussed, the FDA has made a preliminary determination to structure the phaseout in a way that avoids undue disruption to the testing market. This is important even for certain IVDs currently on the market that do not fall within the scope of the FDA’s general enforcement discretion approach. The FDA notes that the manufacturing of test components outside of a laboratory—for example, when the same entity owns both the laboratory and a manufacturing facility separate from the laboratory—does not fall within the FDA’s general enforcement discretion approach. The FDA’s approach has long been specific to laboratory development (e.g., 61 FR 10484 (“in-house developed tests have not been actively regulated by the Agency”) (describing an LDT as an IVD that is “designed, manufactured, and used within a single laboratory”). The proposed phaseout policy would not change the FDA’s longstanding expectation that IVD manufacturing activities occurring outside of a CLIA-certified laboratory comply with applicable device requirements. The FDA has structured the phaseout policy to contain five key stages:

Although the FDA is proposing this broader scope for the phaseout policy, it does not intend to sweep in certain tests that were excluded from the general enforcement discretion approach, as reflected in compliance patterns, multiple public FDA actions and communications, or both.

If the FDA is successful with their rulemaking or other means, and ultimately regulates certain LDTs, our tests may be subject to certain additional regulatory requirements. Complying with the FDA’s requirements can be expensive, time-consuming, and subject us to significant or unanticipated delays. Insofar as we may be required to obtain premarket clearance or approval to perform or continue performing an LDT, we cannot assure that we will be able to obtain such authorization. Even if we obtain regulatory clearance or approval where required, such authorization may not be for the intended uses that we believe are commercially attractive or are critical to the commercial success of our tests. As a result, the application of the FDA’s requirements to our tests could materially and adversely affect our business, financial condition, and results of operations.

Notwithstanding the FDA’s current position with respect to oversight of our tests, we will engage with FDA for guidance on the data expectations for our tests, where appropriate and pursue FDA pre-market review for our current tests and tests we may offer in the future, if we determine that doing so would be appropriate from a strategic perspective.

In addition, Congress has considered a number of legislative proposals in recent years that would amend the regulatory framework for LDTs, including, among other requirements, FDA premarket review of certain LDTs. On June 24, 2021, bi-partisan members of both the House and Senate re-introduced the Verifying Accurate, Leading-edge IVCT Development (“VALID”) Act, which features a precertification program. The term IVCT refers to in vitro clinical tests, a category that comprises both test kits and lab-developed tests. The VALID Act includes precertification proposed by the FDA, a process through which diagnostic developers could receive premarket approval or clearance for one test representative of a group of tests using the same technology and have other elements in common. Approval of that representative test would pre-certify other tests in the group and allow the lab to launch them without premarket review. The VALID Act would also create a new system for labs and hospitals to use to submit their tests electronically to the FDA for approval, which is aimed at reducing the amount of time it takes for the agency to approve such tests, and establish a new program to expedite the development of diagnostic tests that can be used to address a current unmet need for patients. The introduced VALID Act also includes specific language designed to address public health emergencies, including COVID-19. If enacted, the impact of the VALID Act will be minimal for IVD manufacturers because of the alignment between the VALID Act and existing medical device statutory and regulatory requirements and the fact that such requirements have been enforced for IVD manufacturers for decades; however, it will have a significant impact on clinical laboratories as laboratories will need to comply with many new requirements, including: registration and listing with the FDA; quality requirements; investigational studies; premarket review and approval; adverse event reporting; and corrections and removals (recalls). While the VALID Act outlines a framework for these elements (among others), the law, if enacted, would direct the FDA to promulgate regulations and issue guidance documents within two years of its enactment, and establishes an effective date for the new IVCT regulatory system as four years after enactment, giving clinical laboratories and others ample opportunity to participate in shaping and preparing for the new IVCT regulatory program.

In May 2021, Senator Rand Paul re-introduced a bill, called the Verified Innovative Testing in American Laboratories (“VITAL”) Act of 2021, which strikes a counterpoint to the proposed VALID Act. The VITAL Act seeks to update existing federal lab standards under the CLIA, specifically stating that all aspects of lab-developed testing procedures would be regulated by the U.S. Health and Human Services Secretary under the Public Health Services Act, and that no aspects of lab-developed testing procedures would be regulated under the FD&C Act, including during a public health emergency.

We cannot predict whether the either the VALID Act or the VITAL, Act as proposed, or any modified version of either act will be enacted into law.

We cannot be certain as to which of our tests, if any, would require FDA approval or clearance under any of the proposed frameworks and, if required, that our tests could obtain such approval or clearance. Failure to comply with applicable FDA regulatory requirements may trigger a range of enforcement actions by the FDA including warning letters, civil monetary penalties, injunctions, criminal prosecution, recall or seizure, operating restrictions, partial suspension or total shutdown of operations, and denial of or challenges to applications for clearance or approval, as well as significant adverse publicity.

International Regulations

The EU has adopted the EU in vitro Diagnostics Regulation (the “EU IVDR”), which imposes stricter requirements for the marketing and sale of in vitro diagnostics products (as compared to the predecessor in vitro Diagnostics Directive), including in the areas of clinical evaluation requirements, quality systems, economic operators and post-market surveillance. Manufacturers of currently marketed in vitro diagnostics products had until May 2022 to meet the requirements of the EU IVDR, though the EU Council and Parliament signed an amendment that delays certain previously mandated deadlines to allow more time for Notified Body of EU countries to manage the entire portfolio of IVD products on the European market.

In addition, Russia has enacted more stringent medical product registration and labeling regulations, China has enacted stricter labeling requirements, and we expect other countries, such as Brazil and India, to impose more regulations that impact our product registrations. The United Kingdom’s (“UK”) withdrawal from the EU is resulting in additional regulatory requirements associated with goods manufactured and sold in the UK and additional complexities and delays with respect to goods, raw materials and personnel moving between the UK and the EU. In addition, new government administrations may interpret existing regulations or practices differently. Due to these evolving and diverse requirements, we face uncertain product approval timelines, additional time and effort to comply, as well as the potential for reduced sales and/or fines for noncompliance.

State Laboratory Licensing

In addition to federal certification requirements of laboratories under CLIA, we are required to maintain licensure under Tennessee law for our laboratory in Nashville, Tennessee. State laws generally include standards for the day-to-day operation of a clinical reference laboratory, including the training and skills required of personnel and quality control. In addition, those laws often mandate proficiency testing, which involves testing of specimens that have been specifically prepared for the laboratory.

Some states require licensure of out-of-state laboratories that accept specimens from those states (i.e. Pennsylvania, Rhode Island, Maryland and California). Our laboratories will need to pass various state inspections in order to get licensed to provide LDTs in each of state that requires licensure. CLIA provides that a state may adopt laboratory regulations that are more stringent than those under federal law, and two states, New York and Washington, have met that standard and therefore substitute for the federal CLIA program. In addition, some, but not all, states require a separate state license or permit, which must be obtained in addition to a CLIA certificate, and some states require a laboratory doing business in that state to be licensed even if the laboratory is located in another state.

Our laboratory in Nashville, Tennessee is licensed by the appropriate state agencies in the states in which we do business, if such licensure is required. If our laboratory is out of compliance with state laws or regulations governing licensed laboratories, a state may impose penalties, which penalties vary from state to state but may include suspension, limitation, revocation or annulment of the license, assessment of financial penalties or fines, or imprisonment. We believe that we are in material compliance with all applicable licensing laws and regulations applicable to us.

We may become aware from time to time of certain states that require out-of-state laboratories to obtain licensure to accept specimens from patients within the state. If we identify any other state with such requirements, or if we are contacted by any other state advising us of such requirements, we intend to follow all instructions from the state regulators regarding compliance with such requirements.

International Laboratory Licensing

We also maintain laboratory operations in Germany and could expand our laboratory operations to other foreign jurisdictions. Therefore, we are subject to laboratory quality regulations and accreditation standards in Germany, and will be subject to such regulations and standards in any other jurisdictions where we may operate or accept samples from. These requirements may vary by jurisdiction and differ from those in the United States, and may require us to implement additional compliance measures. We believe that we are in material compliance with all applicable licensing laws and regulations applicable to us.

Regulation of Research Use Only Products

Some of our product development projects are intended to be sold for research purposes in the U.S., and labeled “For Research Use Only” or “for molecular biology applications.” RUO refers to devices that are in the laboratory phase of development, while investigational use only, or IUO, refers to devices that are in the product testing phase of development. These types of devices are exempt from most regulatory controls pursuant to long-standing FDA guidance on RUO/IUO products. These products are exempt from FDA’s premarket review and other requirements as long as they are not promoted for clinical diagnostic use, and Oncocyte does not provide technical assistance to clinical laboratories with respect to these tests. If FDA were to disagree with our designation of any of these products, we could be forced to obtain the appropriate regulatory clearances or approval prior to commercialization.

Regulation of In Vitro Diagnostics

In the future, we may elect to develop IVDs, which are regulated by the FDA as medical devices. Medical devices marketed in the United States are subject to the regulatory controls under CLIA, the FD&C Act, and regulations adopted by the FDA. Some requirements, known as premarket requirements, apply to medical devices before they are marketed, and other requirements, known as post-market requirements, apply to medical devices after they are marketed.

The particular premarket requirements that must be met to market a medical device in the United States will depend on the classification of the device under FDA regulations. Medical devices are categorized into one of three classes, based on the degree of risk they present. Devices that pose the lowest risk are designated as Class I devices; devices that pose moderate risk are designated as Class II devices and are subject to general controls and special controls; and the devices that pose the highest risk are designated as Class III devices and are subject to general controls and premarket approval.

A premarket submission to the FDA will be required for some Class I devices, most Class II devices; and all Class III devices. Most Class I and some Class II devices are exempt from premarket submission requirements. Some Class I and most Class II devices may be marketed after a 510(k) premarket notification, while a more extensive Premarket Approval (“PMA”) is required to market Class III devices.

Until regulatory requirements are finalized by the FDA or required by any new legislation are phased in, our current LDTs will not require FDA filing before launch and we will continue to follow the CLIA certification and inspection pathway for certain products, as determined by our portfolio strategy.

If the new requirements are phased in, or if we elect to develop IVDs, our future screenings diagnostics may require a 510(k) submission or a PMA application to the FDA. In a 510(k) submission, the device sponsor must demonstrate that the new device is “substantially equivalent” to a predicate device in terms of intended use, technological characteristics, and performance testing. A 510(k) requires demonstration of substantial equivalence to another device that is legally marketed in the United States. Substantial equivalence means that the new device is at least as safe and effective as the predicate. A device is substantially equivalent if, in comparison to a predicate it (a) has the same intended use as the predicate and has the same technological characteristics as the predicate; or (b) has the same intended use as the predicate, has different technological characteristics, and the information submitted to the FDA does not raise new questions of safety and effectiveness, and is demonstrated to be at least as safe and effective as the legally marketed predicate device.

A claim of substantial equivalence does not mean the new and predicate devices must be identical. Substantial equivalence is established with respect to intended use, design, energy used or delivered, materials, chemical composition, manufacturing process, performance, safety, effectiveness, labeling, biocompatibility, standards, and other characteristics. A device may not be marketed in the United States until the submitter receives a letter declaring the device substantially equivalent. If the FDA determines that a device is not substantially equivalent, the applicant may resubmit another 510(k) with new data, or request a Class I or II designation through the FDA’sde novo process that allows a new device without a valid predicate to be classified into Class I or II if it meets certain criteria, or file a reclassification petition, or submit a PMA.

A new 510(k) submission is required for changes or modifications to an existing approved device, where the modifications could significantly affect the safety or effectiveness of the device or the device is to be marketed for a new or different indication for use.

A PMA for Class III devices is the most stringent type of premarket submission. Before the FDA approves a PMA, the sponsor must provide valid scientific evidence demonstrating reasonable assurance of safety and effectiveness for the device’s intended use.

Health Insurance Portability and Accountability Act and Other Data Privacy and Security Laws

Under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”), the U.S. Department of Health and Human Services (“HHS”) has issued regulations to protect the privacy and security of protected health information (“PHI”) and to address breach notification requirements. HIPAA also regulates standardization of data content, codes and formats used in health care transactions and standardization of identifiers for health plans and providers. Penalties for violations of HIPAA regulations include civil and criminal penalties.

The HIPAA privacy regulations cover the use and disclosure of PHI by covered entities as well as business associates, which are persons or entities that perform certain functions for or on behalf of a covered entity that involve the creation, receipt, maintenance, or transmittal of PHI. Business associates are defined to include a subcontractor to whom a business associate delegates a function, activity, or service, other than in the capacity of the business associate’s workforce. As a general rule, a covered entity or business associate may not use or disclose PHI except as permitted or required under the privacy regulations. The privacy regulations also set forth certain rights that an individual has with respect to his or her PHI, including rights to access or amend certain records, to request restrictions on the use or disclosure of PHI, or to request an accounting of disclosures of his or her PHI.

Covered entities and business associates must also comply with HIPAA’s security regulations, which establish minimum requirements for safeguarding the confidentiality, integrity, and availability of PHI that is electronically transmitted or electronically stored. In addition, HITECH established, among other things, certain breach notification requirements with which covered entities and business associates must comply. In particular, a covered entity must notify any individual whose unsecured PHI is breached according to the specifications set forth in the breach notification rule. A covered entity must also notify the Secretary of the HHS and, under certain circumstances, the media of a breach of unsecured PHI.

CMS and the Office of Civil Rights issued a final rule in February 2014 to amend both the HIPAA and CLIA regulations. The final rule amended the HIPAA privacy rule to remove the CLIA laboratory exceptions, and as a result, HIPAA-covered laboratories are now required to provide individuals, upon request, with access to their completed test reports. Under the 2014 rule, CLIA laboratories and CLIA-exempt laboratories may provide copies of a patient’s completed test reports that, using the laboratory’s authentication process, can be identified as belonging to that patient. These changes to the CLIA regulations and the HIPAA Privacy Rule were intended to provide individuals with a greater ability to access their health information. CLIA laboratories must create and maintain policies, procedures, and other documentation necessary to inform patients of the right to access laboratory test reports and how to exercise that right. In December 2020, aiming to remove regulations that impede communication and data exchange between providers and health plans and expand individuals’ rights to access their own digital health information, HHS proposed further changes to the HIPAA privacy rule. The public comment period for these most recently proposed updates to the HIPAA Privacy Rule closed on May 6, 2021, and the final, updated HIPAA Privacy Rule is expected to be published in the Federal Register at some point in 2024.

The HIPAA privacy, security, and breach notification regulations establish a uniform federal “floor” and do not supersede state laws that are more stringent or provide individuals with greater rights with respect to the privacy or security of, and access to, their records containing PHI or insofar as such state laws apply to personal information that is broader in scope than PHI as defined under HIPAA. Thus, in addition to the federal privacy regulations, there are a number of state laws regarding the privacy and security of health information and personal data that are applicable to clinical laboratories, and more states are considering these laws. The compliance requirements of these laws, including additional breach reporting requirements, and the penalties for violation vary widely and new privacy and security laws in this area are evolving. For example, California has implemented comprehensive privacy laws and regulations. The California Confidentiality of Medical Information Act imposes restrictive requirements regulating the use and disclosure of health information and other personally identifiable information. In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. California’s patient privacy laws, for example, provide for penalties of up to $250,000 and permit injured parties to sue for damages. In addition to the California Confidentiality of Medical Information Act, effective in January 2020, California enacted the California Consumer Privacy Act of 2018 (“CCPA”). The CCPA established a comprehensive privacy framework for covered businesses in the State of California, by creating an expanded definition of personal information, establishing new data privacy rights for consumers imposing special rules on the collection of consumer data from minors, and creating a new and potentially severe statutory damages framework for violations of the CCPA and for businesses that fail to implement reasonable security procedures and practices to prevent data breaches. While data subject to HIPAA and federal regulations governing the conduct of clinical trials is exempt from CCPA, certain of our business activities may be subject to CCPA. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that result from a business’ failure to implement and maintain reasonable data security procedures.

State laws regarding the privacy and security of personal information are also evolving. For example, in November 2020, California passed the California Privacy Rights Act (“CPRA”) through a ballot initiative. The CPRA created a new California Privacy Protection Agency, an “independent watchdog” whose mission is both to “vigorously enforce” the CPRA and “ensure that businesses and consumers are well-informed about their rights and obligations.” Among other things, the CPRA created a new category of “sensitive personal information” and offers consumers the right to limit processing of such information, impose purpose limitation, data minimization, data retention, and security compliance obligations on regulated businesses, and add or modify the rights available to consumers, including by providing a right to correct the information a business holds about them. The CPRA’s amendments to the CCPA took effect on January 1, 2023, and generally apply to personal information collected by businesses on or after January 1, 2022. Similarly, Colorado, Connecticut, Utah and Virginia enacted comprehensive state privacy laws that took effect in 2023. Additional states - including Delaware, Indiana, Iowa, Montana, New Jersey, Oregon, Tennessee, and Texas – have enacted similar comprehensive state privacy laws that will take effect at various points between 2024 and 2026. In addition, every U.S. state has a data breach notification law that requires entities to report certain security breaches to affected consumers and, in some instances, state regulators and consumer reporting agencies. Failure to comply with applicable state laws that impose privacy, security, or breach notification requirements could result in significant civil or criminal penalties, administrative actions, or private causes of action by individuals, and adversely affect our business, results of operations and reputation.

Similar health care and data privacy laws and regulations exist in Europe and other jurisdictions, including reporting requirements detailing interactions with and payments to healthcare providers and requirements regarding the collection, distribution, use, security, and storage of personally identifiable information and other data relating to individuals, including the General Data Protection Regulation (“GDPR”), which went into effect in May 2018. The GDPR applies to any company established in the European Economic Area (“EEA”), as well as to those outside the EEA, if they collect and use personal data in connection with the offering of goods or services to individuals in the EEA or the monitoring of their behavior. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20.0 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. The GDPR provides that EU and EEA member states may introduce further conditions, including limitations, to the processing of genetic, biometric or health data, which could limit our ability to collect, use and share personal data, or could cause our compliance costs to increase, ultimately having an adverse impact on our business. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EU and the United States remains uncertain. For example, in 2016, the EU and United States agreed to a transfer framework for data transferred from the EU to the United States, called the Privacy Shield, but the Privacy Shield was invalidated in July 2020 by the Court of Justice of the EU.

Further, from January 2021, companies have to comply with the GDPR and also the UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, e.g. fines up to the greater of €20.0 million (£17.5 million) or 4% of global turnover. In June 2021, the European Commission implemented an adequacy decision enabling data transfers from EU member states to the UK without additional security measures. However, this adequacy decision includes a so-called “sunset-clause” stipulating that it will expire after four years, and providing that the European Commission will monitor the UK’s legal situation and could intervene at any point if it determines the UK has deviated from the level of protections in place at the time of the decision. The revocation or expiration of the European Commission’s adequacy decision for the UK could require additional measures to ensure adequate protection and GDPR compliance and may lead to additional costs and increases our overall risk exposure.

Physician Referral Prohibitions

Under a federal law directed at “self-referral,” commonly known as the Stark Law, there are prohibitions, with certain exceptions, on Medicare and Medicaid payments for laboratory tests referred by physicians who personally, or through a family member, have a “financial relationship”—including an investment or ownership interest or a compensation arrangement—with the clinical laboratory performing the tests. Several Stark Law exceptions are relevant to arrangements involving clinical laboratories, including: (i) fair market value compensation for the provision of items or services; (ii) payments by physicians to a laboratory for clinical laboratory services; (iii) certain space and equipment rental arrangements that satisfy certain requirements, and (iv) personal services arrangements that satisfy certain requirements. The laboratory cannot submit claims to the Medicare Part B program for services furnished in violation of the Stark Law, and Medicaid reimbursements may be at risk as well. Penalties for violating the Stark Law include the return of funds received for all prohibited referrals, fines, civil monetary penalties and possible exclusion from the federal health care programs. Many states have comparable laws that are not limited to Medicare and Medicaid referrals.

In November 2020, CMS issued a final rule to modernize and clarify the regulations that interpret self-referral law. The final rule was issued in conjunction with the CMS Patients over Paperwork initiative and the HHS Regulatory Sprint to Coordinated Care and establishes exceptions to the physician self-referral law for certain value-based compensation arrangements between or among physicians, providers, and suppliers. It also establishes a new exception for certain arrangements under which a physician receives limited remuneration for items or services actually provided by the physician; establishes a new exception for donations of cybersecurity technology and related services; and amends the existing exception for electronic health records items and services. While the final rule presents significant opportunities for new arrangements, it also necessitates revisions to current arrangements involving healthcare providers, others involved in the healthcare industry, and patients.

Corporate Practice of Medicine

A number of states, including California, do not allow business corporations to employ physicians to provide professional services. This prohibition against the “corporate practice of medicine” is aimed at preventing corporations such as us from exercising control over the medical judgments or decisions of physicians. The state licensure statutes and regulations and agency and court decisions that enumerate the specific corporate practice rules vary considerably from state to state and are enforced by both the courts and regulatory authorities, each with broad discretion. If regulatory authorities or other parties in any jurisdiction successfully assert that we are engaged in the unauthorized corporate practice of medicine, we could be required to restructure our contractual and other arrangements. In addition, violation of these laws may result in sanctions imposed against us and/or the professional through licensure proceedings, and we could be subject to civil and criminal penalties that could result in exclusion from state and federal health care programs.

Federal and State Fraud and Abuse Laws

A variety of federal and state laws prohibit fraud and abuse. These laws are interpreted broadly and enforced aggressively by various state and federal agencies, including CMS, the Department of Justice, the Office of Inspector General for HHS, and various state agencies. In addition, the Medicare and Medicaid programs increasingly use a variety of contractors to review claims data and to identify improper payments as well as fraud and abuse. These contractors include Recovery Audit Contractors, Medicaid Integrity Contractors and Zone Program Integrity Contractors. In addition, CMS conducts Comprehensive Error Rate Testing audits, the purpose of which is to detect improper Medicare payments. Any overpayments identified must be repaid unless a favorable decision is obtained on appeal. In some cases, these overpayments can be used as the basis for an extrapolation, by which the error rate is applied to a larger universe of claims, and which can result in even higher repayments.

The federal Anti-Kickback Statute prohibits, among other things, knowingly and willfully offering, paying, soliciting, receiving, or providing remuneration, directly or indirectly, to induce or in return for either the referral of an individual, or the furnishing, recommending, or arranging for the purchase, lease or order of any health care item or service reimbursable, in whole or in part, under a federal health care program. The definition of “remuneration” has been broadly interpreted to include anything of value, including gifts, discounts, credit arrangements, payments of cash, ownership interests and providing anything at less than its fair market value. Recognizing that the Anti- Kickback Statute is broad and may technically prohibit many innocuous or beneficial arrangements within the health care industry, the Office of Inspector General for HHS has issued a series of regulatory “safe harbors.” These safe harbor regulations set forth certain requirements that, if met, will assure immunity from prosecution under the federal Anti-Kickback Statute. Although full compliance with these provisions ensures against prosecution under the federal Anti-Kickback Statute, the failure of a transaction or arrangement to fit within a specific safe harbor does not necessarily mean that the transaction or arrangement is illegal or that prosecution under the federal Anti-Kickback Statute will be pursued.

Federal civil and criminal false claims laws, including the False Claims Act, prohibit any person from knowingly presenting, or causing to be presented, a false claim for payment to the federal government or knowingly making, or causing to be made, a false statement to get a false claim paid. Violations of the False Claims Act can result in very significant monetary penalties and treble damages. Over the past few years, several healthcare companies have been prosecuted under these laws for a variety of alleged promotional and marketing activities, including without limitation, allegedly providing free trips, free goods, sham consulting fees and grants and other monetary benefits to prescribers. In addition, the government may assert that a claim including items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the federal False Claims Act. Most states also have statutes or regulations similar to the federal anti-kickback law and false claims laws, which apply to items and services reimbursed under Medicaid and other state programs, or, in several states, apply regardless of the payor.

Federal civil monetary penalties laws impose civil fines for, among other things, the offering or transfer of remuneration to a Medicare or state healthcare program beneficiary if the person knows or should know it is likely to influence the beneficiary’s selection of a particular provider, practitioner, or supplier of services reimbursable by Medicare or a state healthcare program, unless an exception applies.

The Eliminating Kickbacks in Recovery Act (“EKRA”) specifically targets laboratories, clinics, recovery centers, and other clinical treatment centers from accepting or paying kickbacks for referrals. EKRA is broader than the federal Anti-Kickback Statute because it applies to private health insurance plans in addition to the federal health care programs, and it prohibits arrangements that may otherwise be exempt from liability under the Anti-Kickback Statute’s safe harbors, including certain compensation arrangements with laboratory sales and marketing personnel.

HIPAA also created new federal crimes, including health care fraud and false statements relating to health care matters. The health care fraud statute prohibits knowingly and willfully executing a scheme to defraud any health care benefit program, including private third-party payers. A violation of this statute is a felony and may result in fines, imprisonment or exclusion from federal health care programs, such as the Medicare and Medicaid programs. The false statements statute prohibits knowingly and willfully falsifying, concealing or covering up a material fact or making any materially false, fictitious or fraudulent statement in connection with the delivery of or payment for health care benefits, items or services. A violation of this statute is a felony and may result in fines, imprisonment or exclusion from federal health care programs.

Many states have laws similar to the federal laws described above, and state laws may be broader in scope and may apply regardless of payer.

Additionally, the U.S. Foreign Corrupt Practices Act (“FCPA”) prohibits U.S. corporations and their representatives from offering, promising, authorizing or making payments to any foreign government official, government staff member, political party or political candidate in an attempt to obtain or retain business abroad. The scope of the FCPA includes interactions with certain healthcare professionals in many countries. Other countries have enacted similar anti-corruption laws and/or regulations.

Other Regulatory Requirements

Our laboratory is subject to federal, state and local regulations relating to the handling and disposal of regulated medical waste, hazardous waste and biohazardous waste, including chemical, biological agents and compounds, blood samples and other human tissue. Typically, we use outside vendors who are contractually obligated to comply with applicable laws and regulations to dispose of such waste. These vendors will be licensed or otherwise qualified to handle and dispose of such waste.

The Occupational Safety and Health Administration has established extensive requirements relating to workplace safety for health care employers, including requirements to develop and implement programs to protect workers from exposure to blood-borne pathogens by preventing or minimizing any exposure through needle stick or similar penetrating injuries.

In May 2020, the Office of the National Coordinator for Health Information Technology promulgated final regulations under the authority of the 21st Century Cures Act that impose new conditions to obtain and maintain certification of certified health information technology and prohibit certain covered actors, including operators of laboratories which are considered “health care providers” under the final regulation, from engaging in activities that are likely to interfere with the access, exchange, or use of electronic health information (information blocking). The final regulations further defined exceptions for activities that are permissible, even though they may have the effect of interfering with the access, exchange, or use of electronic health information. The information blocking effective date is April 5, 2021. Under the 21st Century Cures Act, health care providers that violate the information blocking prohibition will be subject to appropriate disincentives, which HHS services has yet to establish through required rulemaking. Developers of certified information technology and health information networks and health information exchanges, however, may be subject to civil monetary penalties of up to $1.0 million per violation. The HHS Office of Inspector General has the authority to impose such penalties and, in July 2023, published a final rule to codify its new authority in regulation, which became effective in August and September 2023.

Human Capital

As of December 31, 2023, we employed 46 persons, of which 43 were on a full-time basis and three were on a part-time basis.