ContraFect (CFRXQ) Risk Factors

Healthcare providers, physicians and third-party payors play a primary role in the recommendation and prescription of any product candidates for which we obtain marketing approval. Our business operations and current and future arrangements with third-party payors, healthcare providers and customers may expose us to broadly applicable fraud and abuse and other healthcare laws and regulations that may constrain the business or financial arrangements and relationships through which we research, develop, market, sell and distribute our products for which we obtain marketing approval. Restrictions under applicable federal and state healthcare laws and regulations include the following: -   the federal healthcare Anti-Kickback Statute prohibits, among other things, persons from knowingly and willfully soliciting, offering, receiving or providing remuneration, directly or indirectly, in cash or in kind, to induce or reward either the referral of an individual for, or the purchase, order or recommendation of, any good or service, for which payment may be made under federal and state healthcare programs such as Medicare and Medicaid. A person or entity does not need to have actual knowledge of the federal Anti-Kickback Statute or specific intent to violate it to have committed a violation;-   the federal False Claims Act imposes criminal and civil penalties, including through civil whistleblower or qui tam actions, against individuals or entities for knowingly presenting, or causing to be presented, to the federal government, claims for payment that are false or fraudulent or making a false statement to avoid, decrease or conceal an obligation to pay money to the federal government. In addition, the government may assert that a claim including items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the False Claims Act;-   HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, imposes criminal and civil liability for executing a scheme to defraud any healthcare benefit program;-   the federal false statements statute prohibits knowingly and willfully falsifying, concealing or covering up a material fact or making any materially false statement in connection with the delivery of or payment for healthcare benefits, items or services. Similar to the federal Anti-Kickback Statute, a person or entity does not need to have actual knowledge of the statute or specific intent to violate it to have committed a violation;-   the federal transparency requirements under the ACA requires certain manufacturers of drugs, devices, biologics and medical supplies for which payment is available under Medicare, Medicaid or the Children's Health Insurance Program (with certain exceptions) to report to the Department of Health and Human Services information related to physician payments and other transfers of value and ownership and investment interests held by physicians (defined to include doctors, dentists, optometrists, podiatrists and chiropractors), certain non-physician practitioners (physician assistants, nurse practitioners, clinical nurse specialists, certified nurse anesthetists, anesthesiologist assistants and certified nurse midwives), and their immediate family members and payments or other transfers of value made to such physician owners;-   analogous state laws and regulations, such as state anti-kickback and false claims laws, and transparency laws, may apply to sales or marketing arrangements and claims involving healthcare items or services reimbursed by non-governmental third-party payors, including private insurers, and some state laws require pharmaceutical companies to comply with the pharmaceutical industry's voluntary compliance guidelines and the relevant compliance guidance promulgated by the federal government in addition to requiring drug manufacturers to report information related to payments to physicians and other health care providers or marketing expenditures and pricing information; and -   similar healthcare laws and regulations in the EU and other jurisdictions, including reporting requirements detailing interactions with and payments to healthcare providers. Efforts to ensure that our business arrangements with third parties will comply with applicable healthcare laws and regulations will involve substantial costs. It is possible that governmental authorities will conclude that our business practices may not comply with current or future statutes, regulations or case law involving applicable fraud and abuse or other healthcare laws and regulations. If our operations are found to be in violation of any of these laws or any other governmental regulations that may apply to us, we may be subject to significant civil, criminal and administrative penalties, damages, fines, exclusion from government funded healthcare programs, such as Medicare and Medicaid, additional reporting obligations and oversight if we become subject to a corporate integrity agreement or other agreement to resolve allegations of non-compliance with these laws, imprisonment and the curtailment or restructuring of our operations. Further, defending against any such actions, even if successful, can be costly, time-consuming and may require significant personnel resources. If any of the physicians or other providers or entities with whom we expect to do business are found to be not in compliance with applicable laws, they may be subject to criminal, civil or administrative sanctions, including exclusions from government funded healthcare programs.

We face an inherent risk of product liability exposure related to the testing of our product candidates that we develop in human clinical trials and we will face higher degrees of this risk if we commercially sell any products that we develop. If we cannot successfully defend ourselves against claims that our product candidates or products caused injuries, we will incur substantial liabilities. Regardless of merit or eventual outcome, liability claims may result in: -   distraction of our management or other internal resources from pursuing our business strategies;-   decreased demand for any product candidates or products that we may develop;-   injury to our reputation and significant negative media attention;-   withdrawal of clinical trial participants;-   significant costs to defend the related litigation;-   substantial monetary awards to trial participants or patients;-   loss of revenue; and -   the inability to commercialize any products that we may develop. We maintain product liability insurance coverage in relation to our clinical trials. Such coverage may not be adequate to cover all liabilities that we may incur. Insurance coverage is increasingly expensive. We may not be able to maintain insurance coverage at a reasonable cost or in an amount adequate to satisfy any liability that may arise.

The global data protection landscape is rapidly evolving, and we are or may become subject to numerous state, federal and foreign laws, requirements and regulations governing the collection, use, disclosure, retention, and security of personal data, such as information that we may collect in connection with clinical trials in the U.S. and abroad. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business. This evolution may create uncertainty in our business, affect our ability to operate in certain jurisdictions or to collect, store, transfer use and share personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us to comply with federal, state or foreign laws or regulation, our internal policies and procedures or our contracts governing our processing of personal information could result in negative publicity, government investigations and enforcement actions, claims by third parties and damage to our reputation, any of which could have a material adverse effect on our operations, financial performance and business. As our operations and business grow, we may become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention from regulatory authorities. In the U.S., HIPAA imposes, among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information. Certain states have also adopted comparable privacy and security laws and regulations, some of which may be more stringent than HIPAA. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. In addition, the CCPA went into effect on January 1, 2020. The CCPA creates individual privacy rights for California consumers and increases the privacy and security obligations of entities handling certain personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability, and many similar laws have been proposed at the federal level and in other states. Further, the CPRA recently passed in California. The CPRA will impose additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It will also create a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The majority of the provisions will go into effect on January 1, 2023, and additional compliance investment and potential business process changes may be required. Similar laws have passed in Virginia and Colorado and have been proposed in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. In the event that we are subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition. Our activities outside the United States impose additional compliance requirements and generate additional risks of enforcement for noncompliance. For example, the GDPR repealed the Data Protection Directive (95/46/EC) and is directly applicable in all E.E.A. countries (which consists of the 27 EU member states plus Norway, Liechtenstein and Iceland) since its effective date of May 25, 2018. The GDPR applies to companies established in the EEA, as well as companies that are not established in the EEA and which collect and use personal data in relation to offering goods or services to, or monitoring the behavior of, individuals located in the EEA, including, for example, through the conduct of clinical trials (whether the trials are conducted directly by the company itself or through a clinical vendor or collaborators). The GDPR permits EEA countries derogations for certain matters and, accordingly, we are also subject to national laws relating to the processing of certain data such as genetic data, biometric data and health data. It imposes a strict data protection compliance regime including: providing detailed disclosures about how personal data is collected and processed (in a concise, intelligible and easily accessible form); demonstrating that valid consent or another an appropriate legal basis is in place or otherwise exists to justify data processing activities; appointing data protection officers in certain circumstances; granting new rights for data subjects in regard to their personal data (including the right to be "forgotten" and the right to data portability), as well as enhancing current rights (e.g., data subject access requests); introducing the obligation to notify data protection regulators or supervisory authorities (and in certain cases, affected individuals) of significant data breaches; imposing limitations on retention of personal data; maintaining a record of data processing; defining for the first time pseudonymized (i.e., key-coded) data; and complying with principal of accountability and complying with the obligation to demonstrate compliance through policies, procedures, training and audit. We are also subject to EU rules with respect to cross-border transfers of personal data out of the E.E.A. These rules are under scrutiny from time to time. For example, in July 2020, the Court of Justice of the European Union (the "CJEU") limited how organizations could lawfully transfer personal data from the EU/EEA to the United States by invalidating the EU-U.S. Privacy Shield for purposes of international transfers and imposing further restrictions on the use of standard contractual clauses ("SCCs"). Following the decision of the CJEU, the EU-U.S. Privacy Shield can no longer be used as a legal basis for transferring personal data from the European Union to the United States and the CJEU made clear that reliance on standard contractual clauses (SCCs) may not necessarily be a sufficient alternative. The European Commission issued revised SCCs on June 4, 2021 to account for the decision of the CJEU and recommendations made by the European Data Protection Board. The revised SCCs must be used for relevant new data transfers from September 27, 2021; existing standard contractual clauses arrangements were required to be migrated to the revised clauses by December 27, 2022. The new SCCs apply only to the transfer of personal data outside of the EEA and not the UK; the UK's Information Commissioner's Office launched a public consultation on its draft revised data transfers mechanisms in August 2021 and laid its proposal before Parliament, with the UK SCCs expected to come into force in March 2022, with a two-year grace period. There is some uncertainty around whether the revised clauses can be used for all types of data transfers, particularly whether they can be relied on for data transfers to non-EEA entities subject to the GDPR. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the standard contractual clauses cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. If we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we conduct our clinical trials and could adversely affect our business and financial results. Further, we have had to comply with the GDPR and the GDPR as incorporated into United Kingdom national law, the latter regime having the ability to separately fine up to the greater of £17.5 million or 4% of global turnover. The European Commission has adopted an adequacy decision in favor of the UK, enabling data transfers from EU member states to the UK without additional safeguards. However, the UK adequacy decision will automatically expire in June 2025 unless the European Commission re-assesses and renews/ extends that decision and remains under review by the Commission during this period. The relationship between the UK and the EU in relation to certain aspects of data protection law remains unclear, and it is unclear how UK data protection laws and regulations will develop in the medium to longer term, and how data transfers to and from the UK will be regulated in the long term. These changes may lead to additional costs and increase our overall risk exposure. We depend on a number of third parties in relation to the operation of our business (including clinical research organizations), a number of which process personal data on our behalf. There is no assurance that our own privacy and security-related safeguards and/or any contractual measures that we enter into with these providers will protect us from the risks associated with the third-party processing, storage and transmission of such information. Any violation of data or security laws by our third-party processors could have a material adverse effect on our business and result in the fines and penalties outlined below. Fines for certain breaches of the GDPR are significant for companies: up to the greater of 4% of total annual worldwide turnover of the preceding financial year, or €20 million. In addition to the foregoing, a breach of the GDPR could result in regulatory investigations, reputational damage, orders to cease/ change our processing of our data, enforcement notices, assessment notices (for a compulsory audit), as well potential civil claims including class action type litigation where individuals suffer harm. Our actual or alleged failure to comply with the GDPR could result in enforcement actions and significant penalties against us (as outlined above), which could result in negative publicity, increase our operating, business and/or legal costs, subject us to claims or other remedies and have a material adverse effect on our clinical trials, business, financial condition, and operations. We are also subject to evolving EU privacy laws on cookies, and e-marketing. We are likely to be required to expend further capital and other resources to ensure compliance with these changing laws and regulations. Although we work to comply with applicable laws, regulations and standards, our contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. Any failure or perceived failure by us or our employees, representatives, contractors, consultants, collaborators, or other third parties to comply with such requirements or adequately address privacy and security concerns, even if unfounded, could result in additional cost and liability to us, damage our reputation, and adversely affect our business and results of operations.

Successful and timely completion of clinical trials will require that we enroll a sufficient number of patient candidates. These trials and other trials we conduct may be subject to delays for a variety of reasons, including as a result of patient enrollment taking longer than anticipated, patient withdrawal or adverse events. These types of developments could cause us to delay the trial or halt further development. Our clinical trials will compete with other clinical trials that are in the same therapeutic areas as our product candidates, and this competition reduces the number and types of patients available to us, as some patients who might have opted to enroll in our trials may instead opt to enroll in a trial being conducted by one of our competitors. Because the number of qualified clinical investigators and clinical trial sites is limited, we expect to conduct some of our clinical trials at the same clinical trial sites that some of our competitors use, which will reduce the number of patients who are available for our clinical trials at such clinical trial sites. In addition, there may be limited patient pools from which to draw for clinical studies. In addition to the rarity of some diseases, the eligibility criteria of our clinical studies will further limit the pool of available study participants as we will require that patients have specific characteristics that we can measure or to assure their disease is either severe enough or not too advanced to include them in a study. Patient enrollment depends on many factors, including: -   the size and nature of the patient population;-   the severity of the disease under investigation;-   eligibility criteria for the trial;-   the proximity of patients to clinical sites;-   the design of the clinical protocol;-   the ability to obtain and maintain patient consent;-   the ability to recruit clinical trial investigators with the appropriate competencies and experience;-   the risk that patients enrolled in clinical trials will drop out of the trials before the administration of our product candidates or trial completion;-   the availability of competing clinical trials;-   the availability of new drugs approved for the indication the clinical trial is investigating; and -   clinicians' and patients' perceptions as to the potential advantages of the drug being studied in relation to other available therapies. These factors may make it difficult for us to enroll enough patients to complete our clinical trials in a timely and cost-effective manner. For example, our Phase 3 DISRUPT clinical trial experienced some delays in patient enrollment as a result of the COVID-19 pandemic, as some clinical sites in high impact areas delayed new patient enrollment as dictated by local conditions. Such delays impacted and could further adversely affect the expected timelines for our product development and approval process and may adversely affect our business, financial condition and results of operations. Delays in the completion of any clinical trial of our product candidates increase our costs, slow down our product candidate development and approval process and delay or potentially jeopardize our ability to commence product sales and generate revenue. In addition, some of the factors that cause, or lead to, a delay in the commencement or completion of clinical trials may also ultimately lead to the denial of regulatory approval of our product candidates.

Even if resolved in our favor, litigation or other legal proceedings relating to intellectual property claims may cause us to incur significant expenses, and could distract our technical and management personnel from their normal responsibilities. In addition, there could be public announcements of the results of hearings, motions or other interim proceedings or developments and if securities analysts or investors perceive these results to be negative, it could have a substantial adverse effect on the price of our common stock. Such litigation or proceedings could substantially increase our operating losses and reduce the resources available for development, sales, marketing or distribution activities. We may not have sufficient financial or other resources to adequately conduct or defend such litigation or proceedings. Some of our competitors may be able to sustain the costs of such litigation or proceedings more effectively than we can because of their greater financial resources. Uncertainties resulting from the initiation and continuation of patent litigation or other proceedings could have a material adverse effect on our ability to compete in the marketplace. In addition to seeking patents for some of our technology and products, we also rely on trade secrets, including unpatented know-how, technology and other proprietary information, to maintain our competitive position. We seek to protect these trade secrets, in part, by entering into non-disclosure and confidentiality agreements with parties who have access to them, such as our employees, corporate collaborators, outside scientific collaborators, contract manufacturers, consultants, advisors and other third parties. However, we cannot guarantee that we have executed these agreements with each party that may have or have had access to our trade secrets, nor can we guarantee that such agreements will always be adequately drafted so as to be enforceable. If we are unable to protect the confidentiality of our trade secrets, our business and competitive position would be harmed. Enforcing a claim that a party illegally disclosed or misappropriated a trade secret is difficult, expensive and time-consuming, and the outcome is unpredictable. In addition, because of potential differences in laws in different jurisdictions, some courts inside and outside the United States are less willing or unwilling to protect trade secrets. If any of our trade secrets were to be lawfully obtained or independently developed by a competitor, we would have no right to prevent them, or those to whom they communicate it, from using that technology or information to compete with us. If any of our trade secrets were to be disclosed to or independently developed by a competitor, our competitive position would be harmed.

The ACA includes a subtitle called the Biologics Price Competition and Innovation Act of 2009, or BPCIA, which created an abbreviated approval pathway for biological products that are biosimilar to or interchangeable with an FDA-licensed reference biological product. Under the BPCIA, an application for a biosimilar product may not be submitted to the FDA until four years following the date that the reference product was first licensed by the FDA. In addition, the approval of a biosimilar product may not be made effective by the FDA until 12 years from the date on which the reference product was first licensed. During this 12-year period of exclusivity, another company may still market a competing version of the reference product if the FDA approves a full BLA for the competing product containing the sponsor's own preclinical data and data from adequate and well-controlled clinical trials to demonstrate the safety, purity and potency of their product. We believe that any of our product candidates approved as a biological product under a BLA should qualify for the 12-year period of exclusivity. However, there is a risk that this exclusivity could be shortened due to congressional action or otherwise, or that the FDA will not consider our product candidates to be reference products for competing products, potentially creating the opportunity for generic competition sooner than anticipated. In the EU, these exclusivity periods are even shorter. Upon receiving marketing authorization, new chemical or biological entities generally receive eight years of data exclusivity and an additional two years of market exclusivity. If granted, data exclusivity prevents regulatory authorities in the EU from referencing the innovator's data to assess a generic/biosimilar application. During the additional two-year period of market exclusivity, a generic/biosimilar marketing authorization can be submitted, and the innovator's data may be referenced, but no generic/biosimilar product can be marketed until the expiration of the market exclusivity. Moreover, the extent to which a biosimilar, once approved, will be substituted for any one of our reference products in a way that is similar to traditional generic substitution for non-biological products is not yet clear, and will depend on a number of marketplace and regulatory factors that are still developing.

Under our various license agreements with Rockefeller, we are obligated to use our diligent efforts to develop and commercialize licensed products, including exebacase. Rockefeller may terminate the agreement in the event of our breach of the terms of the license agreements. In the event of such termination, Rockefeller has the right to retain its license and other rights under the agreement, subject to continuing royalties and other obligations. Our breach of the agreement, including non-payment of any milestone payment, and Rockefeller's subsequent termination of the agreement, could result in the loss of our rights to develop and commercialize exebacase, which would seriously harm our ability to generate revenues or achieve profitability.

We have relied and will continue to rely on CROs for the execution of our preclinical and clinical studies and to recruit patients and monitor and manage data for our clinical programs for our product candidates. We control only certain aspects of our CROs' activities, but we are responsible for ensuring that each of our studies is conducted in accordance with the applicable protocol and legal, regulatory and scientific standards. Our reliance on the CROs does not relieve us of these regulatory responsibilities. We and our CROs are required to comply with the FDA's and similar foreign regulations and GCPs requirements, which are regulations and guidelines enforced by the FDA and comparable regulatory authorities meant to protect the rights and health of clinical trial subjects. The FDA and comparable regulatory authorities enforce their regulations and GCPs through periodic inspections of trial sponsors, principal investigators and clinical trial sites. If we or our CROs fail to comply with applicable GCPs, the clinical data generated in our clinical trials may be deemed unreliable, and the FDA (or similar foreign authorities) may require us to perform additional clinical trials before approving our product candidates. We cannot assure you that, upon inspection, the FDA (or similar foreign authorities) will determine that any of our clinical trials comply with GCPs. In addition, to evaluate the safety and effectiveness of any of our product candidates to a statistically significant degree, our clinical trials will require an adequately large number of test subjects. Any clinical trial that a CRO conducts abroad on our behalf is subject to similar regulation. Accordingly, if our CROs fail to comply with these regulations or recruit a sufficient number of patients, we may have to repeat clinical trials, which would delay the regulatory approval process. In addition, our CROs are not our employees and we cannot control whether or not they devote sufficient time and resources to our non-clinical, preclinical or clinical programs. Our CROs may also have relationships with other commercial entities, including our competitors, for whom they may also be conducting clinical studies or other drug development activities, which could impede their ability to devote appropriate time to our clinical programs. If our CROs do not successfully carry out their contractual duties or obligations or meet expected deadlines, if they need to be replaced, or if the quality or accuracy of the clinical data they obtain is compromised due to the failure to adhere to our clinical protocols or regulatory requirements, or for other reasons, our clinical trials may be extended, delayed or terminated, and we may not be able to obtain regulatory approval for or successfully commercialize any of our product candidates that we seek to develop. As a result, our financial results and the commercial prospects for any of our product candidates that we seek to develop would be harmed, our costs could increase and our ability to generate revenues could be delayed or ended. If any of our relationships with these CROs change or terminate, we may not be able to enter into arrangements with alternative CROs or clinical study management organizations, or be able to do so on commercially reasonable terms. Switching or adding additional CROs or other clinical study management organizations involves additional cost and requires management time and focus. In addition, there is a natural transition period when a new CRO or clinical study management organization commences work. As a result, delays could occur, which could compromise our ability to meet our desired development timelines.

The global economy, including credit and financial markets, has recently experienced extreme volatility and disruptions, including severely diminished liquidity and credit availability, the failure of multiple financial institutions, rising interest and inflation rates, declines in consumer confidence, declines in economic growth, increases in unemployment rates and uncertainty about economic stability. If the equity and credit markets continue to deteriorate or the United States enters a recession, it may make any necessary debt or equity financing more difficult to obtain in a timely manner or on favorable terms, more costly or more dilutive. If any of our financial institutions fail, the funds in operating accounts at our financial institutions could exceed FDIC insurance limits and our cash balances could be negatively impacted. In addition, there is a risk that one or more of our CROs, suppliers or other third-party providers may be impacted by financial institution failure or not survive an economic downturn or recession. As a result, our business, results of operations and price of our common shares may be adversely affected.