Cardio Diagnostics Holdings (CDIO) Risk Analysis

The clinical epigenetic testing, artificial intelligence/machine learning-based solutions and the cardiovascular diagnostics markets are undergoing rapid technological change, frequent product and service innovation and evolving industry standards. If we are unable to provide enhancements and new features for our existing tests and services or additional tests and services that achieve market acceptance or that keep pace with these technological developments, our business could be adversely affected. The success of enhancements, new tests and services depends on several factors, including the timely completion, introduction and market acceptance of the innovations. Failure in this regard may significantly impair our revenue growth. In addition, because our solutions are designed to operate on existing cloud software and technologies, we will need to continuously modify and enhance our solutions to keep pace with changes in internet-related hardware, software, communication, browser and database technologies, alongside changes in laboratory technologies. We may not be successful in either developing these modifications and enhancements or in bringing them to market in a timely fashion. Furthermore, uncertainties about the timing and nature of new diagnostic tests, network platforms or technologies, including laboratory technologies, or modifications to existing tests, platforms or technologies, could increase our research and development expenses. Any failure of our solutions to keep pace with technological changes or operate effectively with future network platforms and technologies, including laboratory technologies, could reduce the demand for our solutions, result in customer dissatisfaction and adversely affect our business.

The University of Iowa Research Foundation, or UIRF, license agreement grants to us a worldwide, exclusive, non-transferable license under the Patent Rights, as defined in the agreement, to make, have made, use, sell, offer for sale and import the Licensed Products(s) and/or Licensed Processes, as defined in the agreement, in the field of research tools and clinical diagnostics for cardiovascular disease, stroke, congestive heart failure and diabetes in humans. However, the agreement also confers a non-exclusive license as to Technical Information. Technical Information is defined as certain research and development information, materials, confidential information, technical data, unpatented inventions, know-how and supportive information owned and controlled by the licensor that was not in the public domain as of May 2, 2017 and that describes the Invention, as defined in the agreement, its manufacture and/or use and selected by the licensor to provide to us for use in or with the development, manufacture or use of the Licensed Products and/or Licensed Processes. Technical Information further includes materials, all progeny and derivatives of the materials made by us or our sublicensees, as well as software or other copyrightable work, all derivatives of such software and other copyrightable work made by us and our sublicensees. The ability of UIRF to grant non-exclusive licenses to third parties in and to this broad definition of Technical Information raises the possibility that unaffiliated third parties could use such Technical Information, including Technical Information used by the Company, to make, use, sell, offer to sell and import products and/or processes that compete with the Company's exclusively-licensed products and/or processes or are positioned in markets that the Company may enter in the future. Increased competition could result in reduced demand for the Company's products and/or processes, slow its growth and materially adversely affect its business, operating results and financial condition.

In order to provide our products, we currently use a variety of technologies including, for example, genotyping, digital methylation assessment and data processing technologies owned by third parties. The terms of these agreements, and any other "open source" software agreements we may rely upon in the future, are subject to change without notice and may increase our costs. Moreover, our failure to comply with the terms of one or more of these agreements could expose us to business disruption because the license may be terminated automatically due to non-compliance. The use and distribution of open-source software may also entail greater risks than the use of third-party commercial software, as open-source licensors generally do not provide warranties or other contractual protections regarding infringement claims or the quality of the code. Many of the risks associated with use of open-source software cannot be eliminated and could negatively affect our business. In addition, the wide availability of open-source code used in our current and future products could expose us to security vulnerabilities. From time to time, we may face claims from third parties asserting ownership of, or demanding release of, the open-source software or derivative works that we developed using such software (which could include our proprietary source code), or otherwise seeking to enforce the terms of the applicable open-source license. These claims could result in litigation that could be costly to defend, have a negative effect on our operating results and financial condition or require us to devote additional research and development resources to change our existing or future proprietary source code. Responding to any infringement or noncompliance claim by an open-source vendor, regardless of its validity, discovering certain open-source software code in our products, or a finding that we have breached the terms of an open-source software license, could harm our business, results of operations and financial condition. In each case, we would be required to either seek licenses to software or services from other parties and redesign our products to function with such other parties' software or services or develop these components internally, which would result in increased costs and could result in delays to product launches. Furthermore, we might be forced to limit the features available in our current or future solutions. If these delays and feature limitations occur, our business, results of operations and financial condition could be adversely affected.

Our ability to grow and generate revenue depends, in part, on our ability to maintain and grow our relationships with existing customers and convince them to increase their usage of our tests and services. If our customers do not increase their use of our tests and services, then our revenue may not grow, and our results of operations may be harmed. It is difficult to accurately predict customers' usage levels and the loss of customers or reductions in their usage levels may have a negative impact on our business, results of operations and financial condition. If a significant number of customers cease using, or reduce their usage of our tests and services, then we may be required to expend significantly more on sales and marketing than we currently plan to expend in order to maintain or increase revenue from customers. These additional expenditures could adversely affect our business, results of operations and financial condition.

We currently do not have broad-based coverage and reimbursement for the Epi+Gen CHD™ and PrecisionCHD™ tests. However, our strategy is to expand access to our tests by pursuing coverage and reimbursement by third-party payors, including government payors. Coverage and reimbursement by third-party payors, including managed care organizations, private health insurers, and government healthcare programs, such as Medicare and Medicaid in the United States and similar programs in other countries, for the types of risk assessment and detection tests we perform can be limited and uncertain. Healthcare providers may not order our products unless third-party payors cover and provide adequate reimbursement for a substantial portion of the price of the products. If we are not able to obtain adequate coverage and an acceptable level of reimbursement for our products from third-party payors, there could be a greater co-insurance or co-payment obligation for any individual for whom a test is ordered. The individual may be forced to pay the entire cost of a test out-of-pocket, which could dissuade physicians from ordering our products and, if ordered, could result in delay in or decreased likelihood of collection of payment. Medicare is the single largest U.S. payor and a particularly important payor for many cardiac-related laboratory services, given the demographics of the Medicare population. Generally, traditional Medicare fee-for-service will not cover screening tests that are performed in the absence of signs, symptoms, complaints, personal history of disease, or injury except when there is a statutory provision that explicitly covers the test. Epi+Gen CHD™ could be considered a screening test under Medicare and, accordingly, may not be eligible for traditional Medicare fee-for-service coverage and reimbursement unless we pursue substantial additional measures, which would require significant investments, and may ultimately be unsuccessful or may take several years to achieve. If eligible for reimbursement, laboratory tests such as ours generally are classified for reimbursement purposes under CMS's Healthcare Common Procedure Coding System ("HCPCS") and the American Medical Association's ("AMA") Current Procedural Terminology ("CPT") coding systems. We and payors must use those coding systems to bill and pay for our diagnostic tests, respectively. These HCPCS and CPT codes are associated with the particular product or service that is provided to the individual. Accordingly, without a HCPCS or CPT code applicable to our products, the submission of claims could be a significant challenge. Once CMS creates an HCPCS code or the AMA establishes a CPT code, CMS establishes payment rates and coverage rules under traditional Medicare, and private payors establish rates and coverage rules independently. Under Medicare, payment for laboratory tests is generally made under the Clinical Laboratory Fee Schedule ("CLFS") with payment amounts assigned to specific HCPCS and CPT codes. In addition, effective January 1, 2018, a new Medicare payment methodology went into effect for clinical laboratory tests, under which laboratory-reported private payor rates are used to establish Medicare payment rates for tests reimbursed via the CLFS. The new methodology implements Section 216 of the Protecting Access to Medicare Act of 2014 ("PAMA") and requires laboratories that meet certain requirements related to volume and type of Medicare revenues to report to CMS their private payor payment rates for each test they perform, the volume of tests paid at each rate, and the HCPCS code associated with the test. CMS uses the reported information to set the Medicare payment rate for each test at the weighted median private payor rate. The full impact of the PAMA rate-setting methodology and its applicability to our products remains uncertain at this time. Coverage and reimbursement by a third-party payor may depend on a number of factors, including a payor's determination that a product is appropriate, medically necessary, and cost-effective. Each payor will make its own decision as to whether to establish a policy or enter into a contract to cover our products and the amount it will reimburse for such products. Obtaining approvals from third-party payors to cover our products and establishing adequate coding recognition and reimbursement levels is an unpredictable, challenging, time-consuming, and costly process, and we may never be successful. If third-party payors do not provide adequate coverage and reimbursement for our products, our ability to succeed commercially will be limited. Even if we establish relationships with payors to provide our products at negotiated rates, such agreements would not obligate any healthcare providers to order our products or guarantee that we would receive reimbursement for our products from these or any other payors at adequate levels. Thus, these payor relationships, or any similar relationships, may not result in acceptable levels of coverage and reimbursement for our products or meaningful increases in the number of billable tests we sell to healthcare providers. We believe it may take at least several years to achieve coverage and adequate reimbursement with a majority of third-party payors, including with those payors offering negotiated rates. In addition, we cannot predict whether, under what circumstances, or at what payment levels payors will cover and reimburse for our products. We do not expect Epi+Gen CHD™ or PrecisionCHD™ to have Medicare or other third-party coverage or reimbursement in the near term. However, if we fail to establish and maintain broad-based coverage and reimbursement for our products, our ability to expand access to our products, generate increased revenue, and grow our test volume and customer base will be limited, and our overall commercial success will be limited.

We believe our Epi+Gen CHD™ and PrecisionCHD™ tests are LDTs. The FDA generally considers an LDT to be a test that is designed, manufactured, and used within a single laboratory that is certified under CLIA and meets the regulatory requirements under CLIA to perform high complexity testing The FDA has historically taken the position that it has the authority to regulate LDTs as in-vitro diagnostics ("IVDs") under the Federal Food, Drug, and Cosmetic Act ("FDC Act"), although it has generally exercised enforcement discretion with regard to LDTs. This means that even though the FDA believes it can impose regulatory requirements on LDTs, such as requirements to obtain premarket approval, de novo authorization or clearance of LDTs, it has generally chosen not to enforce those requirements. On May 6, 2024, the FDA published a final rule amending the definition of an IVD device to include IVDs manufactured by a clinical laboratory. The final rule also announced the FDA's intention to phase out its general enforcement discretion policy. On May 29, 2024, the American Clinical Laboratory Association filed a lawsuit against FDA in the Eastern District of Texas challenging the FDA's agency authority to regulate LDTs. On August 19, 2024, the Association for Molecular Pathology filed a separate lawsuit in challenging FDA's authority the Southern District of Texas. These lawsuits have been consolidated and briefing is expected to be completed by the end of 2024.The ultimate success of these lawsuits, or any future lawsuits that may be brought against the FDA challenging the LDT rule, is uncertain. It is also unclear whether a court would delay the implementation of the final rule while the litigation is ongoing, which means we may need to initiate steps to comply with the final rule even if it is ultimately overturned. Unless the rule is overturned by a court or Congress, the medical device requirements for most LDTs will be phased in beginning on May 6, 2025. The requirements established in the Final Rule include premarket authorization for some LDTs (510(k) clearance, de novo authorization or premarket approval) performed by a laboratory, and postmarket registration and listing, medical device reporting, correction, removal, and recall, complaint handling, labeling, investigational device, and quality system requirements. Certain categories of LDTs will be subject to enforcement discretion with respect to some or all of these requirements. For example, FDA will apply enforcement discretion to currently marketed LDTs that were first offered prior to May 6, 2024, with respect to most quality system requirements and the requirement for premarket authorization if they are not modified or modified in only limited ways. Laboratories performing these tests are subject to other requirements, including the requirement to submit the labeling for the LDT to FDA for review, which could be burdensome and expensive. FDA will similarly exercise enforcement discretion with respect to premarket clearance, de novo classification, or premarket approval requirements for LDTs approved by the New York State Clinical Laboratory Evaluation Program. Compliance with these additional regulatory requirements will be time-consuming and expensive. If we are required to obtain premarket notification, de novo authorization or premarket approval for our existing tests, or for any future tests we may develop, we may be required to successfully complete analytical, pre-clinical and/or clinical studies beyond the studies we have already performed or planned to perform for our LDTs. These studies may be extensive and costly and may take a substantial period of time to complete. Any such studies may fail to generate data that meet the FDA's requirements. The studies may also not be conducted in a manner that meets the FDA's requirements, and therefore may not support the marketing application. There can be no assurance that the submission of such an application will result in a timely response by the FDA or a favorable outcome that will allow the test to be marketed. In addition, we may be forced to stop selling our tests or we may be required to modify claims for or make other changes to our tests while we work to obtain FDA clearance approval or de novo authorization. Our business may be adversely affected while such review is ongoing and if we are ultimately unable to obtain premarket clearance. de novo authorization or premarket approval. Various bills have been introduced in Congress seeking to substantially revamp the regulation of both LDTs and IVDs, but no legislation has been enacted thus far.

Numerous state and federal laws and regulations govern the collection, dissemination, use, privacy, confidentiality, security, availability and integrity of Personally Identifiable Information ("PII"), including protected health information. These laws and regulations include the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). HIPAA establishes a set of basic national privacy and security standards for the protection of protected health information, ("PHI"), by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates with whom such covered entities contract for services, which includes Cardio. HIPAA requires healthcare providers like Cardio to develop and maintain policies and procedures with respect to PHI that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information. HIPAA also implemented the use of standard transaction code sets and standard identifiers that covered entities must use when submitting or receiving certain electronic healthcare transactions, including activities associated with the billing and collection of healthcare claims. HIPAA imposes mandatory penalties for certain violations. Penalties for violations of HIPAA and its implementing regulations start at $100 per violation and are not to exceed $50,000 per violation, subject to a cap of $1.5 million for violations of the same standard in a single calendar year. However, a single breach incident can result in violations of multiple standards. HIPAA also authorizes state attorneys general to file suit on behalf of their residents. Courts will be able to award damages, costs and attorneys' fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. In addition, HIPAA mandates that the Secretary of Health and Human Services, or HHS, conduct periodic compliance audits of HIPAA-covered entities or business associates for compliance with the HIPAA Privacy and Security Standards. It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the Civil Monetary Penalty fine paid by the violator. HIPAA further requires that patients be notified of any unauthorized acquisition, access, use or disclosure of their unsecured PHI that compromises the privacy or security of such information, with certain exceptions related to unintentional or inadvertent use or disclosure by employees or authorized individuals. HIPAA specifies that such notifications must be made "without unreasonable delay and in no case later than 60 calendar days after discovery of the breach." If a breach affects 500 patients or more, it must be reported to HHS without unreasonable delay, and HHS will post the name of the breaching entity on its public web site. Breaches affecting 500 patients or more in the same state or jurisdiction must also be reported to the local media. If a breach involves fewer than 500 people, the covered entity must record it in a log and notify HHS at least annually. Numerous other federal and state laws protect the confidentiality, privacy, availability, integrity and security of personally identifiable information, or PII, including PHI. These laws in many cases are more restrictive than, and may not be preempted by, the HIPAA rules and may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us, and our customers and potentially exposing us to additional expense, adverse publicity and liability. New health information standards, whether implemented pursuant to HIPAA, congressional action or otherwise, could have a significant effect on the manner in which we must handle healthcare related data, and the cost of complying with standards could be significant. If we do not comply with existing or new laws and regulations related to PHI, it could be subject to criminal or civil sanctions. Because of the extreme sensitivity of the PII that we store and transmit, the security features of our technology platform are very important. If our security measures, some of which are managed by third parties, are breached or fail, unauthorized persons may be able to obtain access to sensitive customer and patient data, including HIPAA-regulated PHI. As a result, our reputation could be severely damaged, adversely affecting customer and patient confidence. Customers may curtail their use of or stop using our services or our customer base could decrease, which would cause our business to suffer. In addition, we could face litigation, damages for contract breach, penalties and regulatory actions for violation of HIPAA and other applicable laws or regulations and significant costs for remediation, notification to individuals and for measures to prevent future occurrences. Any potential security breach could also result in increased costs associated with liability for stolen assets or information, repairing system damage that may have been caused by such breaches, incentives offered to customers or other business partners in an effort to maintain our business relationships after a breach and implementing measures to prevent future occurrences, including organizational changes, deploying additional personnel and protection technologies, training employees and engaging third-party experts and consultants. While we maintain insurance covering certain security and privacy damages and claims expenses, we may not carry insurance or maintain coverage sufficient to compensate for all liability and in any event, insurance coverage would not address the reputational damage that could result from a security incident. We outsource important aspects of the storage and transmission of customer and customer personnel information, and thus rely on third parties to manage functions that have material cyber-security risks. We attempt to address these risks by requiring outsourcing subcontractors who handle customer and customer personnel information to sign business associate agreements contractually requiring those subcontractors to adequately safeguard personal health data to the same extent that applies to us and in some cases by requiring such outsourcing subcontractors to undergo third-party security examinations. In addition, we periodically hire third-party security experts to assess and test our security posture. However, we cannot assure investors that these contractual measures and other safeguards will adequately protect us from the risks associated with the storage and transmission of client and patient's proprietary and protected health information. In addition, U.S. states are adopting new laws or amending existing laws and regulations, requiring attention to frequently changing regulatory requirements applicable to data related to individuals. For example, California has enacted the California Consumer Privacy Act ("CCPA"). The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined and which can include any of our current or future employees who may be California residents or any other California residents whose data we collect or process) and provide such residents new ways to opt out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. As we expand our operations and customer base, the CCPA may increase our compliance costs and potential liability. Additionally, a new privacy law, the California Privacy Rights Act ("CPRA"), was approved by California voters in the election in November 2020. The CPRA created obligations relating to consumer data beginning on January 1, 2022, with implementing regulations originally required to be adopted by July 1, 2022, but which remain in proposed format as of December 6, 2022. Enforcement is to begin July 1, 2023, unless that deadline is extended due to the delay in the adoption of the final regulations. The CPRA modifies the CCPA significantly, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply. Additionally, other U.S. states continue to propose, and in certain cases adopt, privacy-focused legislation such as Colorado, Virginia, Utah and Connecticut. Aspects of these state laws remain unclear, resulting in further uncertainty and potentially requiring us to modify our data practices and policies and to incur substantial additional costs and expenses in an effort to comply.

We are highly dependent upon the talents and services of a number of key employees, specifically Meeshanthini Dogan, PhD and Robert Philibert, MD PhD and other senior technical and management personnel, including our other executive officers, all of whom would be difficult to replace. In 2022, we entered into multi-year employment agreements with each of our executive officers and a consulting agreement with our non-executive chairman. The loss of the services of one or more of these key employees would disrupt our business and harm its results of operations. As competition is intense for the type of highly skilled scientific and medical professionals our business requires, we may not be able to successfully attract and retain senior leadership necessary to grow our business.

A significant natural disaster, such as a tornado, hurricane or a flood, occurring at our headquarters or where a business partner is located could adversely affect our business, results of operations and financial condition. Further, if a natural disaster or man-made problem were to affect our network service providers or Internet service providers, this could adversely affect the ability of our customers to use our products and platform. In addition, health epidemics or pandemics, natural disasters and acts of terrorism could cause disruptions in our business, or the businesses of our customers or service providers. We also rely, and will continue to rely, on our network and third-party infrastructure and enterprise applications and internal technology systems for our engineering, sales and marketing and operations activities. In the event of a major disruption caused by a health epidemic or pandemic, natural disaster or man-made problem, we may be unable to continue our operations and may endure system interruptions, reputational harm, delays in our development activities, lengthy interruptions in service, breaches of data security and loss of critical data, any of which could adversely affect our business, results of operations and financial condition.