GeneDx Holdings Corp
For the period ended Jun 30, 2024. Filed Jul 30, 2024.
View on SEC.govAbout this filing
A company's report for each of its first three quarters. The financial statements are not audited. It shows how the business has moved since the last annual report, and what management says changed.
Jun 30, 2024 · Filed Jul 30, 2024
WGS$62.37-3.1%Stored close · as of Nov 6, 2026
What changed in Risk Factors?
Read the current filingPrevious report: 10-Q
Period ended 2024-03-31; filed 2024-04-29.
0001818331-24-000023
Item 1A. Risk FactorsCurrent report: 10-Q
Period ended 2024-06-30; filed 2024-07-30.
0001818331-24-000042
Item 1A. Risk FactorsThe baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.
Compared 20 previous paragraphs and 10 current paragraphs.
1 unchanged; 5 reworded; 4 added; 14 removed; 0 previous and 0 current paragraphs rearranged.
Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.
A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.
Added paragraphs (4)
Current report
We no longer qualify as a “smaller reporting company” and as a result, we will no longer be able to avail ourselves of certain reduced reporting requirements applicable to smaller reporting companies starting with our first quarterly report in 2025.
Current report
We currently take advantage of certain of the scaled disclosures available to smaller reporting companies. However, based on the market value of our Class A common stock held by non-affiliates as of June 30, 2024, we will no longer be eligible to rely on the scaled disclosure exemptions available to smaller reporting companies starting with our quarterly report on Form 10-Q for the quarter ending March 31, 2025.
Current report
We expect that the loss of our “smaller reporting company” status and compliance with additional requirements will increase our legal and financial compliance costs. Any failure to comply with additional requirements in a timely manner, or at all, could have an adverse effect on our business and results of operations and could cause a decline in the price of our Class A common stock.
Current report
On May 29, 2024, the American Clinical Laboratory Association filed a lawsuit challenging the FDA’s authority to regulate LDTs as medical devices under the Federal Food, Drug, and Cosmetic Act. The outcome of this lawsuit is uncertain at this time.
Removed paragraphs (14)
Previous report
Compliance with the HIPAA security, privacy and breach notification regulations may increase our costs.
Previous report
The HIPAA privacy, security and breach notification regulations, which include requirements implemented under the HITECH Act, establish federal standards with respect to the uses and disclosures of protected health information (“PHI”), by health plans, healthcare providers and healthcare clearinghouses. The HIPAA regulations generally prohibit the use and disclosure of PHI without patient authorization, unless the use or disclosure is for payment, treatment or healthcare operations purposes. In setting standards to protect the confidentiality, integrity and security of PHI, the regulations establish a regulatory framework that addresses a variety of subjects, including:
Previous report
•the circumstances under which uses and disclosures of PHI are permitted or required without a written authorization from the patient, including but not limited to treatment purposes, activities to obtain payments for our services, and our healthcare operations activities;
Previous report
•a patient’s rights to access, amend and receive an accounting of certain disclosures of PHI;
Previous report
•requirements to notify individuals if there is a breach of their PHI;
Previous report
•the contents of notices of privacy practices related to the use and disclosure of PHI;
Previous report
•administrative, technical and physical safeguards required of entities that use or receive PHI;
Previous report
•criteria related to the deidentification and aggregation of PHI; and
Previous report
We are also required to comply with applicable state privacy, security and breach notification laws and regulations, which may be more stringent than federal HIPAA requirements. In addition, for healthcare data transfers from other countries relating to citizens and/or residents of those countries, we are also required to comply with the laws of those countries. Furthermore, on December 1, 2022, the U.S. Department of Health and Human Services, Office for Civil Rights (“OCR”) issued a Bulletin highlighting the obligations of HIPAA covered entities and business associates with respect to the use of online tracking technologies. OCR updated this Bulletin on March 18, 2024. To the extent that a covered entity or business associate permits a tracking technology vendor to collect PHI of its customers, the parties must enter into a business associate agreement. In addition, the PHI collected may only be used for treatment or health care operation purposes, in accordance with HIPAA. The PHI cannot be used for marketing purposes that are not connected with treatment or health care operations absent a HIPAA compliant authorization from each customer whose information is being shared.
Previous report
Although HIPAA does not provide for private rights of action, HIPAA gives OCR and the Department of Justice the authority to assess significant fines and other penalties for wrongful use or disclosure of PHI, including potential civil and criminal fines and penalties. OCR may require an entity to enter into a settlement agreement which may include ongoing oversight and auditing of a company’s HIPAA compliance program.
Previous report
In addition, computer networks are always vulnerable to breach and unauthorized persons may in the future be able to exploit weaknesses in the security systems of our computer networks and gain access to PHI. Additionally, we share PHI with third-parties who are legally obligated to safeguard and maintain the confidentiality of PHI. Despite such protections, unauthorized persons may also be able to gain access to PHI stored in such third parties’ computer networks. Any wrongful use or disclosure of PHI by us or such third-parties, including disclosure due to data theft or unauthorized access to us or such third-parties’ computer networks, could subject us to fines or penalties that could adversely affect our business and results of operations. In addition, we distribute PHI to patients in physical form (e.g., test materials and/or test results), which introduces additional risk that human error will result in unauthorized disclosures of PHI. Although HIPAA does not expressly provide for a private right of action for damages, we could also be liable for damages under state privacy laws to private parties for the wrongful use or disclosure of confidential health information or other private personal information.
Previous report
We have implemented practices intended to meet the requirements of the HIPAA privacy, security and breach notification regulations, as required by law, but cannot guarantee that such practices fully satisfy all applicable requirements under HIPAA. In addition, the Company has experienced a number of “security incidents” (as defined under HIPAA) that involved the unauthorized disclosure of PHI. A subset of these incidents was determined to be reportable breaches requiring disclosure to OCR, as well as to the affected patients. Moreover, we cannot confirm that we have identified all previous incidents that could constitute reportable breaches, or that the mitigation steps undertaken in response to known breaches are adequate to satisfy applicable regulatory requirements and prevent any future unauthorized disclosures.
Previous report
As noted above, in addition to HIPAA, we are subject to myriad federal, state, and local requirements pertaining to the collection, retention, and disclosure of genetic material. While we endeavor to remain current with such requirements, we can provide no assurance that we are, or will remain, in compliance with all applicable requirements. Failure to comply with privacy and data security requirements could result in a variety of consequences, including significant fines and penalties as well as damage to our reputation, any of which could have a material adverse effect on our business.
Reworded paragraphs (5)
Previous wording
Except for as set forth below, there have been no material changes in our risk factors from those disclosed in Part I, Item 1A “Risk Factors” of our 2023 Form 10-K, which section is incorporated by reference herein.
Current wording
Except for as set forth below, there have been no material changes in our risk factors from those disclosed in Part I, Item 1A “Risk Factors” of our 2023 Form 10-K and in Part II, Item 1A “Risk Factors” of our Quarterly Report for the quarterly period ended March 31, 2024, filed with the SEC on April 29, 2024, which sections are incorporated by reference herein.
Previous wording
Future changes in FDA enforcement discretion for laboratory developed tests (“LDTs”) could subject our operations to much more significant regulatory requirements.
Current wording
Changes in FDA enforcement discretion for laboratory developed tests (“LDTs”) could subject our operations to much more significant regulatory requirements.
Previous wording
We currently offer an LDT version of certain tests. The FDA currently has a policy of enforcement discretion with respect to most LDTs, whereby the FDA does not actively enforce its medical device regulatory requirements for such tests. However, in October 2014, the FDA issued two draft guidance documents stating that the FDA intended to end enforcement discretion with respect to LDTs in a risk-based manner consistent with the existing classification of medical devices. The FDA halted finalization of the guidance in November 2016 to allow for further public discussion on an appropriate oversight approach to LDTs and to give Congressional authorizing committees the opportunity to develop a legislative solution. The FDA Commissioner and the Director of the Center for Devices and Radiological Health (“CDRH”) have expressed significant concerns regarding disparities between some LDTs andin vitro diagnostics that have been reviewed, cleared, authorized or approved by the FDA.
Current wording
We currently offer an LDT version of certain tests. Historically, the FDA has exercised a policy of enforcement discretion with respect to most LDTs, whereby the FDA did not actively enforce its medical device regulatory requirements for such tests. However, at various points in recent years, FDA has indicated that it intends to end enforcement discretion for many tests offered as LDTs, and to require such tests to comply with certain FDA regulatory requirements. The FDA Commissioner and the Director of the Center for Devices and Radiological Health (“CDRH”) have expressed significant concerns regarding performance disparities between some LDTs and in vitro diagnostics that have been reviewed, cleared, authorized or approved by the FDA.
Previous wording
More recently, on September 29, 2023, the FDA published a proposed rule on LDTs, in which FDA proposes to end enforcement discretion for virtually all LDTs in five stages over a four-year period from the date FDA publishes a final rule. In Phase 1 (effective one year post-finalization), clinical laboratories would be required to comply with medical device (adverse event) reporting and correction/removal reporting requirements. In Phase 2 (effective two years post-finalization), clinical laboratories would be required to comply with all other device requirements (e.g., registration/listing, labeling, investigational use), except for quality systems and premarket review. In Phase 3 (effective three years post-finalization), clinical laboratories would be required to comply with quality systems requirements. In Phase 4 (effective three and a half years post-finalization, but not before October 1, 2027), clinical laboratories would be required to comply with premarket submission requirements for high-risk tests (i.e., tests subject to premarket approval (PMA) requirement). Finally, in Phase 5 (effective four years post-finalization, but not before April 1, 2028), clinical laboratories would be required comply with premarket submission requirements for moderate- and low-risk tests (i.e., tests subject tode novo or 510(k) requirement). Unlike previous proposals, the proposed rule does not “grandfather” existing tests. The content and timing of any final rule on LDTs is uncertain at this time.
Current wording
Most recently, on April 29, 2024, the FDA published a final rule on LDTs, in which FDA outlines its plans to end enforcement discretion for many LDTs in five stages over a four-year period. In Phase 1 (effective May 6, 2025), clinical laboratories would be required to comply with medical device (adverse event) reporting, correction/removal reporting, and certain quality systems complaint handling requirements. In Phase 2 (effective May 6, 2026), clinical laboratories would be required to comply with all other device requirements (e.g., registration/listing, labeling, investigational use), except for remaining quality systems requirements and premarket review. In Phase 3 (effective May 6, 2027), clinical laboratories would be required to comply with all remaining applicable quality systems requirements. In Phase 4 (effective November 6, 2027), clinical laboratories would be required to comply with premarket submission requirements for high-risk tests (i.e., tests subject to premarket approval (PMA) requirement). Finally, in Phase 5 (effective May 6, 2028), clinical laboratories would be required comply with premarket submission requirements for moderate- and low-risk tests (i.e., tests subject to de novo or 510(k) requirement). The final rule potentially extends enforcement discretion for certain tests – e.g., LDTs approved by the New York State Department of Health, and LDTs first marketed prior to May 6, 2024 which are not modified or are modified in certain limited ways – from certain FDA regulatory requirements, provided certain important limitations have been met. We are actively reviewing the final rule to evaluate its applicability to our operations, and the extent to which we may be required to modify our operations to comply with its requirements.
Previous wording
If the FDA were to determine that certain tests offered by us as LDTs are no longer eligible for enforcement discretion for any reason, including new rules, policies or guidance, or due to changes in statute, our tests may become subject to extensive FDA requirements or our business may otherwise be adversely affected. If the FDA were to actively regulate our LDTs, we could experience reduced revenue or increased costs, which could adversely affect our business, prospects, results of operations and financial condition. If required, the regulatory marketing authorization process required to bring our current or future LDTs into compliance may involve, among other things, successfully completing additional clinical validations and submitting to and obtaining clearance from the FDA for a premarket clearance (510(k)) submission or authorization for ade novo submission or approval of a premarket approval application. Furthermore, pending legislative proposals, if enacted, such as the VALID Act, could create new or different regulatory and compliance burdens on us and could have a negative effect on our ability to keep products on the market or develop new products, which could have a material effect on our business. In the event that the FDA requires marketing authorization of our LDTs in the future, the FDA may not ultimately grant any clearance, authorization or approval requested by us in a timely manner, may limit our indication in a way that is not commercially desirable, or refuse to provide such authorization at all. In addition, if the FDA inspects our laboratory in relation to the marketing of any FDA-authorized test, any enforcement action the FDA takes might not be limited to the FDA-authorized test carried by us and could encompass our other testing services.
Current wording
If the FDA were to determine that certain tests offered by us as LDTs are no longer eligible for enforcement discretion for any reason, including new rules, policies or guidance, or due to changes in statute, our tests may become subject to extensive FDA requirements or our business may otherwise be adversely affected. If the FDA were to actively regulate our LDTs, we could experience reduced revenue or increased costs, which could adversely affect our business, prospects, results of operations and financial condition. If required, the regulatory marketing authorization process required to bring our current or future LDTs into compliance may involve, among other things, successfully completing additional clinical validations and submitting to and obtaining clearance from the FDA for a premarket clearance (510(k)) submission or authorization for a de novo submission or approval of a premarket approval application. Furthermore, pending legislative proposals, if enacted, such as the VALID Act, could create new or different regulatory and compliance burdens on us and could have a negative effect on our ability to keep products on the market or develop new products, which could have a material effect on our business. In the event that the FDA requires marketing authorization of our LDTs in the future, the FDA may not ultimately grant any clearance, authorization or approval requested by us in a timely manner, may limit our indication in a way that is not commercially desirable, or refuse to provide such authorization at all. In addition, if the FDA inspects our laboratory in relation to the marketing of any FDA-authorized test, any enforcement action the FDA takes might not be limited to the FDA-authorized test carried by us and could encompass our other testing services.