GeneDx Holdings Corp

Rule 10b5-1 Plan Adoptions and Modifications

None.

Supplemental Disclosure to our Annual Report on Form 10-K for the year ended December 31, 2023

The following updates Part I, Item 1. “Business—Government Regulation—Reimbursement and Billing” in our 2023 Form 10-K:

Reimbursement and Billing

In April 2014, Congress passed the Protecting Access to Medicare Act of 2014 (“PAMA”), which included substantial changes to the way in which clinical laboratory services are paid under Medicare. Under PAMA (as amended) and its implementing regulations, laboratories that realize at least $12,500 in Medicare Clinical Laboratory Fee Schedule (“CLFS”) revenues during the six month reporting period and that receive the majority of their Medicare revenue from payments made under the CLFS or the Physician Fee Schedule must report, beginning in 2017, and then in 2025 and every three years thereafter (or annually for “advanced diagnostic laboratory tests”), private payor payment rates and volumes for their tests. None of our tests meet the current definition of advanced diagnostic laboratory tests, and therefore we believe we are required to report private payor rates for our tests on an every-three-years basis, starting next in 2025. The Centers for Medicare & Medicaid Services (“CMS”) use the rates and volumes reported by laboratories to develop Medicare payment rates for the tests equal to the volume-weighted median of the private payor payment rates for the tests. Laboratories that fail to report the required payment information may be subject to substantial civil money penalties.

As set forth under the regulations implementing PAMA, for tests furnished on or after January 1, 2018, Medicare payments for clinical diagnostic laboratory tests are paid based upon these reported private payor rates. For clinical diagnostic laboratory tests that are assigned a new or substantially revised code, initial payment rates for clinical diagnostic laboratory tests that are not advanced diagnostic laboratory tests will be assigned by the cross-walk or gap-fill methodology, as under prior law. Initial payment rates for new advanced diagnostic laboratory tests will be based on the actual list charge for the laboratory test.

The payment rates calculated under PAMA went into effect starting January 1, 2018. Where applicable, reductions to payment rates resulting from the new methodology were limited to 10% per test per year in each of the years 2018 through 2020. Rates were held at 2020 levels during 2021 through 2023 and will continue to be held at such levels in 2024. Then, where applicable based upon median private payor rates reported in 2017 or 2025, reduced by up to 15% per test per year in each of 2025 through 2027 (with a second round of private payor rate reporting in 2025 to establish rates for 2026 through 2028).

PAMA codified Medicare coverage rules for laboratory tests by requiring any local coverage determination to be made following the local coverage determination process. PAMA also authorizes CMS to consolidate coverage policies for clinical laboratory tests among one to four laboratory-specific Medicare Administrative Contractors (“MACs”). These same contractors may also be designated to process claims if CMS determines that such a model is appropriate. It is unclear whether CMS will proceed with contractor consolidation under this authorization.

PAMA also authorized the adoption of new, temporary billing codes and/or unique test identifiers for FDA-cleared or approved tests as well as advanced diagnostic laboratory tests. The American Medical Association has created a section of billing codes, Proprietary Laboratory Analyses (“PLA”), to facilitate implementation of this section of PAMA. These codes may apply to one or more of our tests if we apply for PLA coding.

Reimbursement and billing for diagnostic services is highly complex, and errors in billing potentially can result denied claims and/or in substantial obligations to repay overpayments to payors. Laboratories must bill various payors, such as private third-party payors, including managed care organizations (“MCO”), and state and federal health care programs, such as Medicare and Medicaid, and each may have different billing requirements. Additionally, the audit requirements we must meet to ensure compliance with applicable laws and regulations, as well as our internal compliance policies and procedures, add further complexity to the billing process. Other factors that complicate billing include:

•variability in coverage and information requirements among various payors;

•patient financial assistance programs;

•missing, incomplete or inaccurate billing information provided by ordering physicians;

•billings to payors with whom we do not have contracts;

•disputes with payors as to which party is responsible for payment; and

•disputes with payors as to the appropriate level of reimbursement.

Depending on the reimbursement arrangement and applicable law, the party that reimburses us for our services may be:

•a third party who provides coverage to the patient, such as an insurance company or MCO;

•a state or federal healthcare program; or

•the patient.

The following updates Part I, Item 1. “Business—Government Regulation—Privacy and Security Laws—California Consumer Privacy Act” in our 2023 Form 10-K:

California Consumer Privacy Act

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CPRA,” and together with the California Consumer Privacy Act, the “CCPA”), confers to California consumers, among other things, the right to receive notice of the categories of personal information that will be collected by a business, how the business will use and share the personal information, and the categories of third parties who will receive the personal information. The CCPA also confers rights to access, delete, correct, or request a portable data set, the right to limit processing of “sensitive personal information,” and the right to receive equal service and pricing from a business after exercising a consumer right granted by the CCPA. In addition, the CCPA allows California consumers the right to opt out of the “sale” of their personal information, which the CCPA defines broadly as any disclosure of personal information to a third party in exchange for monetary or other valuable consideration. The CCPA also allows California consumers to opt out of the “sharing” of information, which restricts a company’s use of personal information for cross-context behavioral advertising. The CCPA also requires a business to implement reasonable security procedures to safeguard personal information against unauthorized access, use, or disclosure and imposes purpose limitation, data minimization, data retention and other security compliance obligations on regulated businesses. The CCPA requires businesses to include specific provisions in contracts with third parties that process data on a business’s behalf regarding the third party’s processing and management of such data.

The CCPA does not apply to personal information that is PHI under HIPAA and that is collected by a business associate or covered entity under HIPAA. The CCPA also exempts patient information that is processed by a covered entity and maintained in the same manner as PHI. Accordingly, the CCPA will not apply to much of the genetic testing and patient information we collect and process. However, we are required to comply with the CCPA insofar as we collect other categories of California consumers’ personal information, such as information about California-based employees, contractors, business contacts and website visitors.

The CCPA is enforceable through administrative fines of up to $2,500 for each violation, or $7,500 for intentional violations or where we have actual knowledge that the personal information relates to an individual under 16 years of age.

In addition to the CCPA, four new state privacy laws went into effect in 2023, including the Virginia Consumer Data Protection Act, the Utah Consumer Privacy Act, the Colorado Privacy Act, and the Connecticut Personal Data Privacy and Online Monitoring Act. In 2023, eight other states passed comprehensive consumer data privacy laws, and many others have introduced similar consumer privacy laws. These new state privacy laws and any potential federal consumer privacy law will and would impose additional data protection obligations on covered businesses, including additional consumer rights, limitations on data uses, new audit requirements for higher risk data and opt outs for certain uses of sensitive data. The new and proposed privacy laws may result in further uncertainty and may require us to incur additional expenditures to comply. These regulations and legislative developments have potentially far-reaching consequences and may require us to modify our data management and data use practices and incur substantial compliance expense. Our failure to comply with applicable laws and regulations or other obligations to which we may be subject relating to personal data, or to protect personal data from unauthorized access, use, or other processing, could result in enforcement actions and regulatory investigations against us, claims for damages by customers and other affected individuals, fines, damage to our reputation, and loss of goodwill, any of which could have a material adverse effect on our operations, financial performance, and business.

The following updates Part I, Item 1. “Business—Government Regulation—Information Blocking Prohibition” in our 2023 Form 10-K:

On May 1, 2020, the Office of the National Coordinator for Health Information Technology promulgated final regulations under the authority of the 21st Century Cures Act to impose new conditions to obtain and maintain certification of certified health information technology and prohibit certain covered actors, including developers of certified health information technology, health information networks/health information exchanges, and health care providers, from engaging in activities that are likely to interfere with the access, exchange, or use of electronic health information (information blocking). The final regulations further defined exceptions for activities that are permissible, even though they may have the effect of interfering with the access, exchange, or use of electronic health information. The information blocking regulations compliance date was April 5, 2021 and the HHS subsequently issues a final rule called the HTI-1 Rule that, among other things, revised the information blocking regulations, effective March 11, 2024. Under the 21st Century Cures Act, health care providers that violate the information blocking prohibition will be subject to appropriate disincentives. On November 1, 2023, the HHSpublished in the Federal Registera proposed rule to establish such disincentives. The HHS has not yet issued a final rule. Developers of certified information technology and health information networks/health information exchanges, however, may be subject to civil monetary penalties of up to $1 million per violation. The HHS Office of Inspector General has the authority to impose such penalties and on July 3, 2023, published a final rulein the Federal Register codifying new authority in regulation, which became effective September 1, 2023.