EKSO BIONICS (EKSO) Risk Factors

Pursuant to HIPAA, final regulations have been implemented to improve the efficiency and effectiveness of the healthcare system by facilitating the electronic exchange of information in certain financial and administrative transactions while protecting the privacy and security of the information exchanged. The HIPAA transaction standards are complex, and subject to differences in interpretation by third-party payors. For instance, some third-party payors may interpret the standards to require us to provide certain types of information, including demographic information not usually provided to us by physicians. As a result of inconsistent application of transaction standards by third-party payors or our inability to obtain certain billing information not usually provided to us by physicians, we could face increased costs and complexity, a temporary disruption in accounts receivable and ongoing reductions in reimbursements and net revenue. Changes and updates to HIPAA transaction standards could prove technically difficult, time-consuming or expensive to implement, all of which could harm our business.

Numerous federal and state laws and regulations, including HIPAA and the HITECH Act, govern the collection, dissemination, security, use and confidentiality of patient-identifiable health information. HIPAA and the HITECH Act require us to comply with standards for the use and disclosure of such protected health information within our company and with third parties. The Privacy Standards and Security Standards under HIPAA establish a set of basic national privacy and security standards for the protection of individually identifiable health information by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates with whom such covered entities contract for services. Notably, whereas HIPAA previously directly regulated only these covered entities, the HITECH Act, which was signed into law in 2009, makes certain of HIPAA's privacy and security standards directly applicable to covered entities' business associates. Both covered entities and business associates are subject to significant civil and criminal penalties for failure to comply with the Privacy Standards and Security Standards under HIPAA. HIPAA requires healthcare providers like us to develop and maintain policies and procedures with respect to protected health information that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information from unauthorized disclosure. The HITECH Act expanded the notification requirement for breaches of patient-identifiable health information, restricts certain disclosures and sales of patient-identifiable health information and provides a tiered system for civil monetary penalties for HIPAA violations. The HITECH Act also increased the civil and criminal penalties that may be imposed against covered entities, business associates and possibly other persons and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorney fees and costs associated with pursuing federal civil actions. The 2013 final HITECH omnibus rule modified the breach reporting standard in a manner that made more data security incidents qualify as reportable breaches. Additionally, certain states have adopted comparable privacy and security laws and regulations, some of which may be more stringent than HIPAA. If we are determined to be out of compliance with existing or new laws and regulations related to patient health information, we could be subject to criminal or civil sanctions. New health information standards, whether implemented pursuant to HIPAA, the HITECH Act, congressional action or otherwise, could have a significant effect on the manner in which we handle healthcare related data and communicate with payors, and the cost of complying with these standards could be significant. Any liability from a failure to comply with the requirements of HIPAA or the HITECH Act could adversely affect our results of operations and financial condition. The costs of complying with privacy and security related legal and regulatory requirements are burdensome and could have a material adverse effect on our results of operations.

We are required to comply with the FDA's Quality System Regulation, or QSR, which is a complex regulatory scheme that covers the procedures and documentation of the design, testing, production, process controls, quality assurance, labeling, packaging, handling, storage, distribution, installation, servicing and shipping of our marketed products. These regulatory requirements may significantly increase our production costs and may even prevent us from making our products in amounts sufficient to meet market demand. If we change our approved manufacturing process, the FDA may need to review the process before it may be used. The FDA enforces the QSR through periodic announced and unannounced inspections of manufacturing facilities. Failure to comply with regulatory requirements such as QSR may result in changes to labeling, restrictions on such products or manufacturing processes, withdrawal of the products from the market, voluntary or mandatory recalls, a requirement to repair, replace or refund the cost of any medical device we manufacture or distribute, fines, suspension of regulatory approvals, product seizures, injunctions or the imposition of civil or criminal penalties which would adversely affect our business, operating results and prospects. Federal, state and non-U.S. regulations regarding the manufacture and sale of medical devices are subject to future changes. The complexity, timeframes and costs associated with obtaining marketing clearances are unknown. Although we cannot predict the impact, if any, these changes might have on our business, the impact could be material.We may be subject to fines, penalties or injunctions if we are determined to be promoting the use of our products for unapproved or "off-label" uses. Any cleared or approved product may be promoted only for its indicated uses and our promotional materials must comply with FDA and other applicable laws and regulations. We believe that the specific use for which our products are marketed fall within the scope of the indications for use that have been cleared by the FDA. However, if the FDA determines that our promotional materials or training constitutes promotion of an unapproved use, it could request that we modify our promotional materials or subject us to regulatory or enforcement actions, including the issuance of an untitled letter, a warning letter, injunction, seizure, civil fine and criminal penalties. It is also possible that other federal, state or foreign enforcement authorities might take action if they consider our promotional or training materials to constitute promotion of an unapproved use, which could result in significant fines or penalties under other statutory authorities, such as laws prohibiting false claims for reimbursement. In that event, our reputation could be damaged and adoption of the products would be impaired.We may be subject to adverse medical device reporting obligations, voluntary corrective actions or agency enforcement actions. Under the FDA's medical device reporting or MDR regulations, we are required to report to the FDA any incident in which our product may have caused or contributed to a death or serious injury or in which our product malfunctioned and, if the malfunction were to recur, would likely cause or contribute to death or serious injury. For example, we have been informed of a limited number of events with respect to our EksoNR or EksoGT devices that have been determined to be reportable pursuant to the MDR regulations. In each case, the required MDR report was filed with the FDA. In addition, all manufacturers bringing medical devices to market in the European Economic Area are legally bound to report any incident that led or might have led to the death or serious deterioration in the state of health of a patient, user or other person, and which the manufacturer's device is suspected to have caused, to the competent authority in whose jurisdiction the incident occurred. In such case, the manufacturer must file an initial report with the relevant competent authority, which would be followed by further evaluation or investigation of the incident and a final report indicating whether further action is required. The events described above that were reported to the FDA were also reported to the relevant EU regulatory authorities. We are also required to follow detailed recordkeeping requirements for all Company-initiated medical device corrections and removals, and to report such corrective and removal actions to the FDA if they are carried out in response to a risk to health and have not otherwise been reported under the MDR regulations. The FDA and similar foreign governmental authorities also have the authority to require the recall of commercialized products in the event of material deficiencies or defects in design, labeling or manufacture of a product or in the event that a product poses an unacceptable risk to health. Depending on the corrective action we take to redress a product's deficiencies or defects, the FDA may require, or we may decide, that we will need to obtain new approvals or clearances for the device before we may market or distribute the corrected device. Seeking such approvals or clearances may delay our ability to replace the recalled devices in a timely manner. Moreover, if we do not adequately address problems associated with our devices, we may face additional regulatory enforcement action, including adverse publicity, FDA warning letters, product seizure, injunctions, administrative penalties, or civil or criminal fines. We may also be required to bear other costs or take other actions that may have a negative impact on our sales as well as face significant adverse publicity or regulatory consequences, which could harm our business, including our ability to market our products in the future. Any adverse event involving our products could result in future voluntary corrective actions, such as recalls or customer notifications, or agency action, such as inspection or enforcement action. Recalls of our products, or agency actions relating to our failure to comply with our reporting or recordkeeping obligations, could harm our reputation and financial results.Failure to comply with anti-kickback and fraud regulations could result in substantial penalties and changes in our business operations. Although we do not provide healthcare services, submit claims for third-party reimbursement, or receive payments directly from Medicare, Medicaid or other third-party payers for our products, we are subject to healthcare fraud and abuse regulation and enforcement by federal, state and foreign governments, which could significantly impact our business. These laws may constrain the business and financial arrangements and relationships through which we conduct our operations, including how we research, market, sell and distribute any product for which we have obtained regulatory approval, or for which we obtain regulatory approval in the future. The principal U.S. federal laws implicated include, but are not limited to, those that prohibit, among other things, (i) filing, or causing to be filed, false or improper claims for federal payment, known as the false claims laws, (ii) payment, solicitation or receipt of unlawful inducements, directly or indirectly, for the referral of business reimbursable under federally-funded health care programs, known as the anti-kickback laws, and (iii) health care service providers from seeking reimbursement for providing certain services to a patient who was referred by a physician who has certain types of direct or indirect financial relationships with the service provider, known as the Stark law. Many states have similar laws that apply to reimbursement by state Medicaid and other government funded programs as well as in some cases to all payers. Efforts to ensure that our business arrangements will comply with applicable healthcare laws and regulations will involve substantial costs. We are subject to the risk that a person or government could allege we have engaged in fraud or other misconduct, even if none occurred. It is possible that governmental and enforcement authorities will conclude that our business practices do not comply with current or future statutes, regulations or case law interpreting applicable fraud and abuse or other healthcare laws and regulations. If our operations are found to be in violation of any of the laws described above or any other governmental regulations that apply to us now or in the future, we may be subject to penalties, including civil and criminal penalties, damages, fines, disgorgement, exclusion from governmental health care programs, additional integrity oversight and reporting obligations, contractual damages, reputational harm and the curtailment or restructuring of our operations, any of which could adversely affect our ability to operate our business and our financial results.Changes in law or regulation could make it more difficult and costly for us to manufacture, market and distribute our products or obtain or maintain regulatory approval of new or modified products. From time to time, legislation is drafted and introduced in Congress that could significantly change the statutory provisions governing the regulatory approval, manufacture and marketing of regulated devices. In addition, FDA regulations and guidance are often revised or reinterpreted by the FDA in ways that may significantly affect our business and our products. Any new regulations or revisions or reinterpretations of existing regulations may impose additional costs or lengthen review times of future products. In addition, FDA regulations and guidance are often revised or reinterpreted by the agency in ways that may significantly affect our business and our products. Elections could result in significant changes in, and uncertainty with respect to, legislation, regulation and government policy that could significantly impact our business and the health care industry. It is impossible to predict whether legislative changes will be enacted or FDA regulations, guidance or interpretations changed, and what the impact of such changes, if any, may be. Any change in the laws or regulations that govern the clearance and approval processes relating to our current and future products could make it more difficult and costly to obtain clearance or approval for new products, or to produce, market, and distribute existing products. Significant delays in receiving clearance or approval, or the failure to receive clearance or approval, for any new products would have an adverse effect on our ability to expand our business.Healthcare changes in the United States and other countries, including recently enacted legislation reforming the U.S. healthcare system, could have a negative impact on our future operating results. In the United States and some foreign jurisdictions, there have been a number of legislative and regulatory proposals to change the health care system in ways that could affect our ability to sell our products profitably. For example, in 2010, the Patient Protection and Affordable Care Act, or ACA, was enacted into law. The legislation seeks to reform the United States healthcare system. It is far-reaching and is intended to expand access to health insurance coverage, improve quality and reduce costs over time. We expect the law will have a significant impact upon various aspects of our business operations. The ACA reduces Medicare and Medicaid payments to hospitals, clinical laboratories and pharmaceutical companies, and could otherwise reduce the volume of medical procedures. These factors, in turn, could result in reduced demand for our products and increased downward pricing pressure. It is also possible that the ACA will result in lower reimbursements. While the ACA is intended to expand health insurance coverage to uninsured persons in the United States, the impact of any overall increase in access to healthcare on sales of our products remains uncertain. Since its enactment, there have been numerous judicial, administrative, executive, and legislative challenges to certain aspects of the ACA, and we expect there will be additional challenges in the future. As a result, there have been delays in the implementation of, and action taken to repeal or replace, certain aspects of the ACA. Most recently, under President Biden, the Department of Justice dropped support of two Supreme Court cases challenging the ACA in addition to a case before the U.S. Court of Appeals for the Fifth Circuit. We cannot predict the impact that such actions against the ACA or other health care reform under the Biden administration will have on our business, and there is uncertainty as to what healthcare programs and regulations may be implemented or changed at the federal and/or state level in the United States, or the effect of any future legislation or regulation. However, it is possible that such initiatives could have an adverse effect on our ability to obtain approval and/or successfully commercialize products in the United States in the future. For example, any changes that reduce, or impede the ability to obtain, reimbursement for the type of products we intend to commercialize in the United States (or our products more specifically, if approved) could adversely affect our business plan to introduce our products in the United States. Other legislative changes have been proposed and adopted in the United States since the ACA was enacted. For example, in August 2011, the Budget Control Act of 2011, among other things, created measures for spending reductions by Congress. A Joint Select Committee on Deficit Reduction, tasked with recommending a targeted deficit reduction of at least $1.2 trillion for the years 2012 through 2021, was unable to reach required goals, thereby triggering the legislation's automatic reduction to several government programs. This includes aggregate reductions of Medicare payments to providers of up to 2% per fiscal year, which went into effect in April 2013 and will remain in effect through 2030 unless additional Congressional action is taken. Further, there has been heightened governmental scrutiny in recent years over the manner in which manufacturers set prices for their marketed products and the cost of prescription drugs to consumers and government healthcare programs, which have resulted in several recent Congressional inquiries and proposed and enacted bills designed to, among other things, reduce the cost of prescription drugs, bring more transparency to product pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for products. In addition, the United States government, state legislatures, and foreign governments have shown significant interest in implementing cost containment programs, including price-controls, restrictions on reimbursement and requirements for substitution of generic products for branded prescription drugs to limit the growth of government paid health care costs. For example, the United States government has passed legislation requiring pharmaceutical manufacturers to provide rebates and discounts to certain entities and governmental payors to participate in federal healthcare programs. Further, Congress and the current administration have each indicated that it will continue to seek new legislative and/or administrative measures to control drug costs, and the current administration recently released a "Blueprint", or plan, to reduce the cost of drugs. The current administration's Blueprint contains certain measures that the U.S. Department of Health and Human Services is already working to implement. Individual states in the United States have also been increasingly passing legislation and implementing regulations designed to control pharmaceutical product pricing, including price or patient reimbursement constraints, discounts, restrictions on certain product access and marketing cost disclosure and transparency measures, and, in some cases, designed to encourage importation from other countries and bulk purchasing. Additional changes may affect our business, including those governing enrollment in federal healthcare programs, reimbursement changes, fraud and abuse enforcement, and expansion of new programs, such as Medicare payment for performance initiatives. These initiatives, as well as other healthcare reform measures that may be adopted in the future, may result in more rigorous coverage criteria and in additional downward pressure on the price that we receive for any approved product. Any reduction in reimbursement from Medicare or other government programs may result in a similar reduction in payments from private payors. The implementation of cost containment measures or other healthcare reforms could result in reduced demand for our product candidates or additional pricing pressures and may prevent us from being able to generate revenue, attain profitability, or commercialize our products. Finally, future elections in the United States could result in significant changes in, and uncertainty with respect to, legislation, regulation, implementation of Medicare and/or Medicaid, and government policy that could significantly impact our business and the healthcare industry. The President and the executive branch of the federal government have a significant impact on the implementation of the provisions of the ACA, and the current or future administrations could make changes impacting the implementation and enforcement of the ACA, which could harm our business, operating results and financial condition. If we are slow or unable to adapt to any such changes, our business, operating results and financial condition could be adversely affected.

In the EU, we are required to comply with the EU MDR and obtain CE Certificates of Conformity in order to affix the CE Mark and market medical devices. As of December 31, 2022, none of our products had yet been approved under the EU MDR. We are currently in the process of obtaining Parker's CE Certificates of Conformity in order to affix the CE Mark to the products we acquired in the HMC Acquisition, including Ekso Indego Personal and Ekso Indego Personal. Any delay in, or failure to receive or maintain the CE Mark as required under the EU MDR for the products acquired in the HMC Acquisition may prevent us from selling those products within the EU. In addition, changes in regulatory policy for the approval or CE marking of a medical device during the period of product development and regulatory agency review or notified body review of each submitted new application may cause delays or rejections. In January 2023, the European Commission endorsed a proposal to extend the original compliance dates for the EU MDR, subject to approval by the European Parliament and European Council. The proposal would extend the current MDR transitional period deadline of May 2024 to 2027 or 2028, based upon the risk class of the device. Failure to comply with the EU MDR requirements by the MDR transitional period deadline would prevent us from generating revenue from sales of our products in the EU, which could adversely affect our business, results of operations and financial condition.