Harmony Biosciences Holdings (HRMY) Risk Factors

The global data protection landscape is rapidly evolving, and we are or may become subject to numerous state, federal and foreign laws, requirements and regulations governing the collection, use, disclosure, retention, and security of personal data, such as information that we may collect in connection with clinical trials in the U.S. and abroad. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business. This evolution may create uncertainty in our business, affect our ability to operate in certain jurisdictions or to collect, store, transfer use and share personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us to comply with federal, state or foreign laws or regulation, our internal policies and procedures or our contracts governing our processing of personal information could result in negative publicity, government investigations and enforcement actions, claims by third parties and damage to our reputation, any of which could have a material adverse effect on our operations, financial performance and business. Certain states have also adopted comparable privacy and security laws and regulations, some of which may be more stringent than HIPAA. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. In addition, the California Consumer Privacy Act of 2018 (the "CCPA") went into effect on January 1, 2020. The CCPA creates individual privacy rights for California consumers and increases the privacy and security obligations of entities handling certain personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability, and many similar laws have been proposed at the federal level and in other states. Further, the California Privacy Rights Act (the "CPRA") recently passed in California. The CPRA will impose additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It will also create a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The majority of the provisions went into effect on January 1, 2023, and additional compliance investment and potential business process changes may be required. In the event that we are subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition. As our operations and business grow, we may become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention from regulatory authorities. In the U.S., HIPAA imposes, among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information. Most healthcare providers, including research institutions from which we obtain patient health information, are subject to privacy and security regulations promulgated under HIPAA, as amended by HITECH. While we do not believe that we are currently acting as a covered entity or business associate under HIPAA and thus are not directly subject to its requirements or penalties. However, any person may be prosecuted under HIPAA's criminal provisions either directly or under aiding-and-abetting or conspiracy principles. Consequently, depending on the facts and circumstances, we could face substantial criminal penalties if we knowingly receive individually identifiable health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA's requirements for disclosure of individually identifiable health information. In addition, we may maintain sensitive personally identifiable information, including health information, that we receive throughout the clinical trial process, in the course of our research collaborations, and directly from individuals (or their healthcare providers) who enroll in our patient assistance programs. As such, we may be subject to state laws requiring notification of affected individuals and state regulators in the event of a breach of personal information, which is a broader class of information than the health information protected by HIPAA. Furthermore, certain health privacy laws, data breach notification laws, consumer protection laws and genetic testing laws may apply directly to our operations and/or those of our collaborators and may impose restrictions on our collection, use and dissemination of individuals' health information. Patients about whom we or our collaborators obtain health information, as well as the providers who share this information with us, may have statutory or contractual rights that limit our ability to use and disclose the information. We may be required to expend significant capital and other resources to ensure ongoing compliance with applicable privacy and data security laws. Claims that we have violated individuals' privacy rights or breached our contractual obligations, even if we are not found liable, could be expensive and time consuming to defend and could result in adverse publicity that could harm our business. In Europe, the GDPR went into effect in May 2018 and imposes strict requirements for processing the personal data of individuals within the EEA. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenue of the noncompliant company, whichever is greater. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EU and the United States remains uncertain. For example, in 2016, the EU and United States agreed to a transfer framework for data transferred from the EU to the United States, called the Privacy Shield. In July 2020, the Court of Justice of the European Union ("CJEU") invalidated the Privacy Shield for purposes of international transfers and imposed further restrictions on the use of standard contractual clauses ("SCCs"). The European Commission issued revised SCCs in June 2021 to account for the decision of the CJEU and recommendations made by the European Data Protection Board. The revised SCCs must be used for relevant new data transfers from September 27, 2021; existing standard contractual clauses arrangements must be migrated to the revised clauses by December 27, 2022. The new SCCs apply only to the transfer of personal data outside of the EEA and not the UK; the UK's Information Commissioner's Office launched a public consultation on its draft revised data transfers mechanisms in August 2021. There is some uncertainty around whether the revised clauses can be used for all types of data transfers, particularly whether they can be relied on for data transfers to non-EEA entities subject to the GDPR. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the SCCs cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. Further, from January 2021, companies have to comply with the GDPR and also the UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, i.e., fines up to the greater of €20 million (£17.5 million) or 4% of global turnover. The relationship between the United Kingdom and the European Union in relation to certain aspects of data protection law remains unclear, and it is unclear how United Kingdom data protection laws and regulations will develop in the medium to longer term, and how data transfers to and from the United Kingdom will be regulated in the long term. The European Commission has adopted an adequacy decision in favor of the United Kingdom, enabling data transfers from EU member states to the United Kingdom without additional safeguards. However, the UK adequacy decision will automatically expire in June 2025 unless the European Commission re-assesses and renews or extends that decision. Although we work to comply with applicable laws, regulations and standards, our contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. If we or third-party CMOs, CROs or other contractors or consultants fail to comply with applicable federal, state or local regulatory requirements, we could be subject to a range of regulatory actions that could affect our or our contractors' ability to develop and commercialize our product candidates and could harm or prevent sales of any affected products that we are able to commercialize, or could substantially increase the costs and expenses of developing, commercializing and marketing our products. Any threatened or actual government enforcement action could also generate adverse publicity and require that we devote substantial resources that could otherwise be used in other aspects of our business. Increasing use of social media could give rise to liability, breaches of data security or reputational damage.

Successful sales of WAKIX and any other product candidates that may receive regulatory approval depend on the availability of coverage and adequate reimbursement from third-party payors. Patients who are prescribed medications for the treatment of their conditions generally rely on third- party payors to reimburse all or part of the costs associated with their prescription drugs. There is significant uncertainty related to third-party payor coverage and reimbursement of newly approved drugs. Regulatory approvals, pricing and reimbursement for new drug products vary widely from country to country. In the United States, the principal decisions about reimbursement for new medicines are typically made by CMS, an agency within HHS. CMS decides whether and to what extent a new medicine will be covered and reimbursed under Medicare. Private payors tend to follow CMS to a substantial degree. Commercial third-party payors, such as private health insurers and health maintenance organizations, also decide which medications they will pay for and establish reimbursement levels, though commercial third-party payors often follow CMS' reimbursement determinations. The availability of coverage and the extent of reimbursement by governmental and private payors is essential for most patients to be able to afford treatments. Sales of WAKIX or other product candidates that we may identify will depend substantially, both domestically and abroad, on the extent to which the costs of our product candidates will be paid by health maintenance, managed care, pharmacy benefit and similar healthcare management organizations, or reimbursed by government health administration authorities, private health coverage insurers and other third-party payors. Coverage and reimbursement by a third-party payor may depend upon a number of factors, including the third-party payor's determination that use of a product is: - a covered benefit under its health plan;- safe, effective and medically necessary;- appropriate for the specific patient;- cost-effective; and - neither experimental nor investigational. We cannot be sure that reimbursement will be available for WAKIX and, if coverage and reimbursement are available, what the level of reimbursement will be. Our inability to promptly obtain coverage and adequate reimbursement rates from both government-funded and private payors for any approved products that we develop could have a material adverse effect on our operating results, our ability to raise capital needed to commercialize products and our overall financial condition. If coverage and adequate reimbursement is not available, or is available only to limited levels, we may not be able to successfully commercialize our product candidates. Even if coverage is provided, the approved reimbursement amount may not be high enough to allow us to establish or maintain pricing sufficient to realize a sufficient return on our investment. Obtaining coverage and reimbursement approval for a product from a government or other third- party payor can be an expensive and time-consuming process that could require us to provide supporting scientific, clinical and cost effectiveness data for the use of our products to the payor. The industry competition to be included in third-party payors' drug formularies, or lists of medications for which third- party payors provide coverage and reimbursement, often leads to downward pricing pressures on pharmaceutical products. In addition, third-party payors may refuse to include a particular branded drug in their formularies or otherwise restrict patient access through formulary controls or otherwise to a branded drug when a less costly generic equivalent or other alternative is available. Net prices for drugs may be reduced by mandatory discounts or rebates required by government healthcare programs or private payors, and by any future relaxation of laws that presently restrict imports of drugs from countries where they may be sold at lower prices than in the United States. Increasingly, third-party payors are requiring that drug companies provide them with predetermined discounts from list prices and are challenging the prices charged for medical products. In addition, many pharmaceutical manufacturers must calculate and report certain price reporting metrics to the government, such as average manufacture price and best price. Penalties may apply in some cases when such metrics are not submitted accurately and timely. We cannot be sure that reimbursement will be available for any product candidate that we commercialize and, if reimbursement is available, the level of reimbursement. In addition, there may be significant delays in obtaining such coverage and reimbursement for newly approved products, and coverage may be more limited than the purposes for which the product is approved by the FDA or comparable foreign regulatory authorities. Moreover, eligibility for coverage and reimbursement does not imply that a product will be paid for in all cases or at a rate that covers our costs, including research, development, intellectual property, manufacture, sale and distribution expenses. Interim reimbursement levels for new products, if applicable, may also not be sufficient to cover our costs and may not be made permanent. Reimbursement rates may vary according to the use of the product and the clinical setting in which it is used, may be based on reimbursement levels already set for lower cost products and may be incorporated into existing payments for other services. Net prices for products may be reduced by mandatory discounts or rebates required by government healthcare programs or private payors, by any future laws limiting drug prices and by any future relaxation of laws that presently restrict imports of product from countries where they may be sold at lower prices than in the United States. While we have obtained coverage for WAKIX from certain third-party payors, the resulting reimbursement payment rates might not be adequate or may require co-payments that patients find unacceptably high. Patients are unlikely to use WAKIX unless coverage is provided and reimbursement is adequate to cover a significant portion of the cost of WAKIX. Therefore, coverage and adequate reimbursement is critical to new product acceptance. Coverage decisions may depend upon clinical and economic standards that disfavor new products when more established or lower cost therapeutic alternatives are already available or subsequently become available. We may suffer loss of corporate reputation due to industry-wide legislative or public scrutiny of our pricing decisions and practices within an increasingly price-sensitive environment. Despite obtaining formulary approval from certain third-party payors, sometimes with prior authorization or other formulary restrictions and requirements, including documented failure or inadequate response to alternative treatments, we expect to experience pricing pressures in connection with the sale of WAKIX due to the trend toward cost containment, managed healthcare, the increasing influence of health maintenance organizations and additional legislative changes. Large public and private payors, managed care organizations, group purchasing organizations and similar organizations are exerting increasing influence on decisions regarding the use of, and reimbursement levels for, particular treatments. Such third-party payors, including Medicare, are questioning the coverage of, and challenging the prices charged for medical products and services, and many third-party payors limit coverage of, or reimbursement for, newly approved health care products. The downward pressure on healthcare costs in general, particularly prescription medicines, medical devices and surgical procedures and other treatments, has become very intense. As a result, increasingly high barriers are being erected to the successful commercialization of new products. Further, the adoption and implementation of any future governmental cost containment or other health reform initiative may result in additional downward pressure on the price that we may receive for WAKIX. These cost-control initiatives could decrease the price we have established for WAKIX, which could result in product revenue being lower than anticipated. The pricing, coverage and reimbursement of WAKIX must be adequate to support a commercial infrastructure. If the price for WAKIX decreases or if governmental and other third-party payors do not provide adequate coverage and reimbursement levels, our revenue, gross margins and prospects for profitability will suffer. While we have not taken any steps to attain regulatory or patent approvals in any specific markets outside of the United States, we plan to explore obtaining additional licensing rights from Bioprojet to expand into international markets with WAKIX. Outside the United States, international operations are generally subject to extensive governmental price controls and other market regulations, and we believe the increasing emphasis on cost-containment initiatives in Europe and other countries will likely put pressure on the pricing and usage of medical products. In many countries, the prices of medical products are subject to varying price control mechanisms as part of national health systems. Other countries allow companies to fix their own prices for medical products, but monitor and control company profits. Additional foreign price controls or other changes in pricing regulation could restrict the amount that we are able to charge for WAKIX. Accordingly, in markets outside the United States, the reimbursement for WAKIX may be reduced compared with the United States and may be insufficient to generate commercially reasonable revenue and profits.

Competition from other biotechnology and pharmaceutical companies is intense and is expected to increase. There may be a number of companies pursuing the development of pharmaceuticals in rare neurological disorders, our area of focus. These companies may be very large, and may have financial, technical, sales and distribution and other resources substantially greater than ours. The greater resources of these competitors may enable them to develop, obtain regulatory approval for or market competing products more quickly or effectively, making it extremely difficult for us to capture a share of the market for our product. We also face competition, and may in the future face additional competition, from manufacturers of generic drugs. Certain U.S. state laws allow for, and in some instances in the absence of specific instructions from the prescribing physician mandate, the dispensing of generic products rather than branded products when a generic version is available. Generic competition often results in decreases in the prices at which branded products can be sold. The commercial potential of our current products and any future products may be reduced or eliminated if our competitors develop or acquire and commercialize generic or branded products that are safer or more effective, have fewer side effects, are easier to administer or are less expensive than our products. We also face competition from off-label uses of approved drugs. Additionally, the biotechnology and pharmaceutical industries are subject to rapid changes in science, and our competitors may develop and market products with improved therapeutic profiles relative to pitolisant or any future product candidates that would render pitolisant or any future product candidates noncompetitive.

In recent years, the pharmaceutical industry has been the subject of public complaints and significant publicity regarding the pricing of pharmaceutical products, including publicity and pressure resulting from prices charged by competitors and peer companies for new products as well as price increases by competitors and peer companies on older products that the public has deemed excessive. We may experience downward pricing pressure on the price of WAKIX and any other future approved products due to social or political pressure to lower the cost of drugs, which could reduce our revenue and future profitability. Orphan drugs in particular have received recent negative publicity for the perceived high prices charged for them by their manufacturers, and as a result orphan drug developers such as us may be negatively impacted by such publicity and any U.S. or other government regulatory response. Due to these factors, we may suffer public criticism and negative publicity in media coverage, by industry trade associations and legislators. Any of the events or developments described above could result in reputational harm and reduced market acceptance and demand for our products, could harm our ability to market our products in the future, could cause us to incur significant expense, could cause our senior management to be distracted from execution of our business strategy, and could have a material adverse effect on our business, reputation, financial condition, results of operations, liquidity, cash flows and/or share price.

We have conducted clinical studies in the Czech Republic, Romania, and Poland in the past, and currently conduct studies in Ireland, Australia, and the United Kingdom. We may conduct future clinical studies in other countries as well. Doing business internationally involves a number of risks, including but not limited to: - multiple, conflicting and changing laws and regulations, such as privacy regulations, tax laws, export and import restrictions, employment laws, regulatory requirements and other governmental approvals, permits and licenses;- failure by us to obtain and maintain regulatory approvals for the use of our products in various countries;- additional potentially relevant third-party patent rights;- complexities and difficulties in obtaining protection and enforcing our intellectual property;- difficulties in staffing and managing foreign operations;- complexities associated with managing multiple payor reimbursement regimes, government payors or patient self-pay systems;- limits in our ability to penetrate international markets;- global macroeconomic conditions, including an increase in inflation rates or interest rates, labor shortages, supply chain shortages, disruptions and instability in the banking industry and other parts of the financial services sector, or other economic, political, or legal uncertainties or adverse developments;- financial risks, such as longer payment cycles, difficulty collecting accounts receivable, the impact of local and regional financial crises on demand and payment for our products and exposure to foreign currency exchange rate fluctuations;- terrorism and/or political instability, unrest and wars, such as the conflicts involving Ukraine and Russia or Israel and its surrounding regions, which could delay or disrupt our business, and if such political unrest escalates or spills over to or otherwise impacts additional regions it could heighten many of the other risk factors included in this Item 1A;- natural disasters (including as a result of climate change), which could cause significant damage to the infrastructure upon which our business operations rely, and the timing, nature or severity of which we may be unable to prepare for;- economic instability, outbreak of disease or epidemics such as the COVID-19 pandemic, boycotts, curtailment of trade and other business restrictions;- certain expenses including, among others, expenses for travel, translation and insurance; and - regulatory and compliance risks that relate to maintaining accurate information and control over sales and activities that may fall within the purview of the U.S. Foreign Corrupt Practices Act, its books and records provisions, or its anti-bribery provisions. Any of these factors could significantly harm our future international expansion and operations and, consequently, our results of operations.