Rocket Pharmaceuticals (RCKT) Risk Factors

The trading market for our common stock relies, in part, on the research and reports that industry or financial analysts publish about us or our business. Although we have obtained analyst coverage, if one or more of the analysts covering our business downgrade their evaluations of our stock, the price of our stock could decline. If one or more of these analysts cease to cover our stock or fail to regularly publish reports on us, we could lose visibility in the market for our stock, which in turn could cause our stock price to decline.

Our stock price is likely to be volatile. The stock market in general, and the market for biopharmaceutical companies in particular, has experienced extreme volatility that has often been unrelated to the operating performance of particular companies. As a result of this volatility, our stockholders may not be able to sell their shares of common stock at or above the price they paid for their shares. The market price for our common stock may be influenced by many factors, including: • results of clinical trials of our product candidates or those of our competitors; • the success of competitive products or technologies; • commencement or termination of collaborations; • regulatory or legal developments in the United States and other countries; • developments or disputes concerning patent applications, issued patents or other proprietary rights; • the recruitment or departure of key personnel; • the level of expenses related to any of our product candidates or clinical development programs; • the results of our efforts to discover, develop, acquire or in-license additional product candidates; • actual or anticipated changes in estimates as to financial results, development timelines or recommendations by securities analysts; • negative publicity around gene therapy in general, or our product candidates; • variations in our financial results or those of companies that are perceived to be similar to us; • changes in the structure of healthcare payment systems; • market conditions in the pharmaceutical and biotechnology sectors; and • general economic, industry and market conditions. If our quarterly operating results fall below the expectations of investors or securities analysts, the price of our common stock could decline substantially. Furthermore, any quarterly fluctuations in our operating results may, in turn, cause the price of our stock to fluctuate substantially. We believe that quarterly comparisons of our financial results are not necessarily meaningful and should not be relied upon as an indication of our future performance. In the past, following periods of volatility in the market price of a company’s securities, securities class-action litigation often has been instituted against that company. Such litigation, if instituted against us, could cause us to incur substantial costs to defend such claims and divert management’s attention and resources, which could seriously harm our business, financial condition, results of operations and prospects.

RTW Investments, LP (“RTW”), in the aggregate, beneficially owns approximately 25.2% of our outstanding shares of common stock. This concentration of voting power gives RTW the power to significantly influence all matters submitted to our stockholders for approval, as well as our management and affairs. For example, RTW could significantly influence the election of directors and approval of any merger, consolidation or sale of all or substantially all of our assets. In addition, this may prevent or discourage unsolicited acquisition proposals or offers for our capital stock that you may believe are in your best interest as one of our stockholders.

As a large accelerated filer, we are subject to certain disclosure and compliance requirements that apply to other public companies but did not historically apply to us due to our prior status as an emerging growth company. These requirements include, but are not limited to: • the requirement that our independent registered public accounting firm attest to the effectiveness of our internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act of 2002; • compliance with any requirement that may be adopted by the Public Company Accounting Oversight Board regarding mandatory audit firm rotation or a supplement to the auditor’s report providing additional information about the audit and the financial statements; • the requirement that we provide full and more detailed disclosures regarding executive compensation; and • the requirement that we hold a non-binding advisory vote on executive compensation and obtain stockholder approval of any golden parachute payments not previously approved. We expect that continued compliance with the requirements of being a large accelerated filer may increase our legal and financial compliance costs and cause management and other personnel to divert attention from operational and other business matters to devote substantial time to public company reporting requirements. In addition, if we are not able to comply with changing requirements in a timely manner, the market price of our stock could decline and we could be subject to sanctions or investigations by the stock exchange on which our common stock is listed, the SEC, or other regulatory authorities, which would require additional financial and management resources.

We have never declared or paid cash dividends on our capital stock. We currently intend to retain all future earnings, if any, to finance the growth and development of our business. In addition, the terms of any future debt agreements may preclude us from paying dividends. As a result, capital appreciation, if any, of our common stock will be stockholders’ sole source of gain for the foreseeable future.

Our ability to generate revenue and achieve profitability depends on our ability, alone or with strategic collaboration partners, to successfully complete the development of, and obtain the regulatory, pricing and reimbursement approvals necessary to commercialize our product candidates. We do not anticipate generating revenues from product sales for the foreseeable future, if ever. Our ability to generate future revenues from product sales depends heavily on our success in: • completing research and preclinical and clinical development of our product candidates; • seeking and obtaining regulatory and marketing approvals for product candidates for which we successfully complete clinical studies; • developing a sustainable, commercial-scale, reproducible, and transferable manufacturing process for our vectors and product candidates; • establishing and maintaining supply and manufacturing relationships with third parties that can provide adequate (in amount and quality) products and services to support preclinical and clinical development and the market demand for our product candidates, if approved; • launching and commercializing product candidates for which we obtain regulatory and marketing approval, either by collaborating with a partner or, if launched independently, by establishing a sales force, marketing and distribution infrastructure; • obtaining sufficient pricing and reimbursement for our product candidates from private and governmental payors; • obtaining market acceptance of our product candidates and gene therapy as a viable treatment option; • addressing any competing technological and market developments; • identifying and validating new gene therapy product candidates; • negotiating favorable terms in any collaboration, licensing or other arrangements into which we may enter; and • maintaining, protecting and expanding our portfolio of intellectual property rights, including patents, trade secrets and know-how. Even if one or more of the product candidates that we will develop is approved for commercial sale, we anticipate incurring significant costs associated with commercializing any approved product candidate. Our expenses could increase beyond expectations if we are required by the FDA, the EMA, or other regulatory agencies, domestic or foreign, to perform clinical and other studies in addition to those that we currently anticipate. Even if we generate revenues from the sale of any approved products, we may not become profitable and may need to obtain additional funding to continue operations.

We are an early-stage gene therapy company with a limited operating history on which to base your investment decision. Gene therapy product development is a highly speculative undertaking and involves a substantial degree of risk. Our operations to date have been limited primarily to organizing and staffing our company, business planning, raising capital, acquiring, and developing product and technology rights, building out our R&D and manufacturing capabilities, and conducting preclinical and clinical R&D activities for our product candidates. We have never generated any revenue from product sales. We have not obtained regulatory approvals for any of our product candidates and have funded our operations to date through proceeds from sales of our stock. We have incurred net losses since our inception. We incurred net losses of $169.1 million, $139.7 million and $77.3 million for the years ended December 31, 2021, 2020 and 2019, respectively. As of December 31, 2021, we had an accumulated deficit of $491.9 million. Substantially all our operating losses have resulted from costs incurred in connection with our R&D programs, buildout of our manufacturing capabilities and from general and administrative (“G&A”) costs associated with our operations. We expect to continue to incur significant expenses and operating losses over the next several years and for the foreseeable future as we intend to continue to conduct R&D, clinical trials, regulatory compliance activities, internal and external manufacturing activities, and, if any of our product candidates is approved, sales and marketing activities that, together with anticipated G&A expenses, will likely result in us continuing to incur significant losses for the foreseeable future.

Our operations to date have predominantly focused on organizing and staffing our company, business planning, raising capital, acquiring our technology, administering, and expanding our gene therapy platforms, identifying potential product candidates, undertaking research, preclinical studies and clinical trials of our product candidates, building out our R&D and manufacturing capabilities, and establishing licensing arrangements and collaborations. We have not yet completed clinical trials of our product candidates, obtained marketing approvals, manufactured a commercial-scale product, or conducted sales and marketing activities necessary for successful commercialization. Consequently, any predictions made about our future success or viability may not be as accurate as they could be if we had a longer operating history. We are currently a drug discovery and clinical stage company and at a later point we may need to transition to a commercial stage company. We cannot guarantee that we will be successful in this transition.

We may seek to establish strategic partnerships for developing and/or commercializing certain of our product candidates due to relatively high capital costs required to develop the product candidates, manufacturing constraints or other reasons. We may not be successful in our efforts to establish such strategic partnerships or other alternative arrangements for our product candidates for several reasons, including because our R&D pipeline may be insufficient, our product candidates may be deemed to be at too early of a stage of development for collaborative effort or third parties may not view our product candidates as having the requisite potential to demonstrate efficacy or market opportunity. In addition, we may be restricted under existing agreements from entering into future agreements with potential collaborators. If we are unable to reach agreements with suitable licensees or collaborators on a timely basis, on acceptable terms or at all, we may have to curtail the development of a product candidate, reduce or delay our development program, delay our potential commercialization, reduce the scope of any sales or marketing activities or increase our expenditures and undertake development or commercialization activities at our own expense. If we elect to independently fund development or commercialization activities, we may need to obtain additional expertise and additional capital, which may not be available on acceptable terms or at all. If we fail to enter into collaboration arrangements and do not have sufficient funds or expertise to undertake necessary development and commercialization activities, we may not be able to further develop our product candidates and our business, financial condition, results of operations and prospects may be materially harmed.

As our business activities expand, we may expand our full-time employee base and hire more consultants and contractors. Our management may need to divert a disproportionate amount of its attention away from day-to-day activities and devote a substantial amount of time to managing these growth activities. We may not be able to effectively manage the expansion of our operations, which may result in weaknesses in our infrastructure, operational setbacks, loss of business opportunities, loss of employees and reduced productivity among remaining employees. Our expected growth could require significant capital expenditures and may divert financial resources from other projects, such as the development of additional product candidates. If our management is unable to effectively manage our growth, our expenses may increase more than expected our ability to generate and/or grow revenues could be reduced and we may not be able to implement our business strategy.

The U.S. and many foreign jurisdictions have enacted or proposed legislative and regulatory changes affecting the healthcare system that could prevent or delay marketing approval of our product candidates or any future product candidates, restrict or regulate post-approval activities and affect our ability to profitably sell any product for which we obtain marketing approval. Changes in regulations, statutes or the interpretation of existing regulations could impact our business in the future by requiring, for example: (i) changes to our manufacturing arrangements; (ii) additions or modifications to product labeling; (iii) the recall or discontinuation of our products; or (iv) additional record-keeping requirements. If any such changes were to be imposed, they could adversely affect the operation of our business. See the section entitled, “Business — Government Regulation — Healthcare Legislative Reform”. Moreover, increasing efforts by governmental and third-party payors in the United States and abroad to cap or reduce healthcare costs may cause such organizations to limit both coverage and the level of reimbursement for newly approved products and, as a result, they may not cover or provide adequate payment for our product candidates. There has been increasing legislative and enforcement interest in the United States with respect to specialty drug pricing practices. Specifically, there have been several recent U.S. Congressional inquiries and proposed and enacted federal and state legislation designed to, among other things, bring more transparency to drug pricing, reduce the cost of prescription drugs under Medicare, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for drugs. We expect that additional U.S. federal healthcare reform measures will be adopted in the future, any of which could limit the amounts that the U.S. Federal Government will pay for healthcare drugs and services, which could result in reduced demand for our drug candidates or additional pricing pressures. Individual states in the United States have also become increasingly active in passing legislation and implementing regulations designed to control pharmaceutical and biological product pricing, including price or patient reimbursement constraints, discounts, restrictions on certain drug access and marketing cost disclosure and transparency measures, and designed to encourage importation from other countries and bulk purchasing. Legally mandated price controls on payment amounts by third-party payors or other restrictions could harm our business, financial condition, results of operations and prospects. In addition, regional healthcare authorities and individual hospitals are increasingly using bidding procedures to determine what pharmaceutical products and which suppliers will be included in their prescription drug and other healthcare programs. This could reduce the ultimate demand for our drugs or put pressure on our drug pricing, which could negatively affect our business, financial condition, results of operations and prospects.

Healthcare providers, physicians and third-party payors will play a primary role in the recommendation and prescription of any products for which we obtain regulatory approval. Our arrangements with third-party payors, healthcare providers and physicians may expose us to broadly applicable fraud and abuse and other healthcare laws and regulations that may constrain the business or financial arrangements and relationships through which we conduct our operations, including how we research, market, sell and distribute any products for which we obtain regulatory approval. See the section entitled, “Business — Government Regulation — Anti-Kickback and False Claims Laws and Other Regulatory Matters”. The scope and enforcement of each of these laws is uncertain and subject to rapid change in the current environment of healthcare reform, especially in light of the lack of applicable precedent and regulations. Federal and state enforcement bodies have recently increased their scrutiny of interactions between healthcare companies and healthcare providers, which has led to a number of investigations, prosecutions, convictions and settlements in the healthcare industry. Efforts to ensure that our business arrangements with third parties, and our business generally, will comply with applicable healthcare laws and regulations will involve substantial costs. It is possible that governmental authorities will conclude that our business practices may not comply with current or future statutes, regulations, agency guidance or case law involving applicable fraud and abuse or other healthcare laws and regulations. If our operations are found to be in violation of any of these laws or any other governmental regulations that may apply to us, we may be subject to significant administrative, civil and criminal penalties, damages, fines, disgorgement, the exclusion from participation in federal and state healthcare programs, individual imprisonment, reputational harm, and the curtailment or restructuring of our operations, as well as additional reporting obligations and oversight if we become subject to a corporate integrity agreement or other agreement to resolve allegations of non-compliance with these laws, any of which could adversely affect our ability to operate our business and our results of operations. Defending against any such actions can be costly, time-consuming and may require significant financial and personnel resources. Therefore, even if we are successful in defending against any such actions that may be brought against us, our business may be impaired. If any of the physicians or other healthcare providers or entities with whom we expect to do business are found to be not in compliance with applicable laws, they may be subject to significant criminal, civil or administrative sanctions, including exclusions from government funded healthcare programs.

We may seek approval of our product candidates using the FDA’s accelerated approval and the EMA’s conditional approval pathways. While we may utilize trial designs to support accelerated approval, such product candidates may not be subject to faster development or regulatory review timelines. A product may be eligible for accelerated approval by the FDA if it treats a serious or life-threatening condition, generally provides a meaningful advantage over available therapies, and demonstrates an effect on a surrogate endpoint that is reasonably likely to predict clinical benefit. As a condition of accelerated approval, the FDA may impose specific obligations with defined timelines, including to perform adequate and well-controlled post-marketing clinical trials. These confirmatory trials must be completed with due diligence. In addition, the FDA currently requires, unless otherwise informed by the agency, pre-approval of promotional materials for products receiving accelerated approval, which could adversely impact the timing of the commercial launch of a product. If the FDA or the EMA do not approve our product candidates for which we seek accelerated approval or conditional approval, but instead require the completion of a full Phase 3 clinical trial or trials prior to the filing of marketing applications, the development and commercialization timeline of such product candidates will be delayed. Even if we do receive accelerated approval or conditional approval, we may not ultimately receive full approval from the regulatory agencies. The additional data generated through post-marketing clinical trials may not confirm that the benefit-risk balance of any of our product candidates that receive accelerated approval is positive or the burden to further complete the obligations may become too high. In the European Union, the conditional marketing authorization is subject to an annual renewal procedure that assesses the marketing authorization holder’s compliance with the specific obligations of the authorization. If conditions are not complied with, the EMA may decide to extend the timeline for the existing obligations, change the scope of such obligations or add new obligations, which may require additional financial resources and time. We may not be able to comply with such changes or additional obligations and may need to withdraw the marketing authorization. The EMA may also decide not to renew the conditional marketing authorization, although such measure is rarely applied in practice. An analysis of reimbursement decisions for conditionally authorized medicines in the European Union has shown some delays in the timeline for reaching a positive health technology recommendation. If this happens for any product candidate for which we seek conditional approval, it may delay the timing and success of the commercialization of such product. Finally, if new data obtained from fulfilment of the conditions of the conditional authorization or otherwise show that our product’s benefits no longer outweigh its risks, the EMA can take regulatory action, such as suspending or revoking the conditional marketing authorization.

Even if we obtain regulatory approval in a jurisdiction, we will remain subject to ongoing regulatory obligations and continued regulatory scrutiny. The applicable regulatory authority may still impose significant restrictions on the indicated uses or marketing of our product candidates or impose ongoing requirements for potentially costly post-approval studies, post-market surveillance or patient or drug restrictions once a product candidate is approved. Additionally, the holder of an approved BLA is obligated to monitor and report adverse events and any failure of a product to meet the specifications in the BLA. The holder of an approved BLA must also submit new or supplemental applications and obtain FDA approval for certain changes to the approved product, product labeling or manufacturing process. FDA guidance advises that patients treated with some types of gene therapy undergo follow-up observations for potential adverse events for as long as 15 years. Advertising and promotional materials must comply with FDA rules and are subject to FDA review, in addition to other potentially applicable federal and state laws. In addition, product manufacturers and their facilities are subject to payment of user fees and continual review and periodic inspections by the FDA and other regulatory authorities for compliance with GMP, and current good tissue practice, as well as adherence to commitments made in the BLA. For certain commercial prescription biological products, manufacturers and other parties involved in the supply chain must also meet chain of distribution requirements and build electronic, interoperable systems for product tracking and tracing and for notifying the FDA of counterfeit, diverted, stolen and intentionally adulterated products or other products that are otherwise unfit for distribution in the United States. If we or a regulatory agency discover previously unknown problems with a product such as adverse events of unanticipated severity or frequency, or problems with the facility where the product is manufactured, a regulatory agency may impose restrictions on that product or the manufacturing facility, including requiring recall or withdrawal of the product from the market or suspension of manufacturing. If we fail to comply with applicable regulatory requirements following approval of any of our product candidates, a regulatory agency may take a variety of actions, including: • issue a warning letter asserting that we are in violation of the law; • seek an injunction or impose civil or criminal penalties or monetary fines; • suspend any ongoing clinical studies; • refuse to approve a pending marketing application, such as a BLA or supplements to a BLA submitted by us; • seize products; or • refuse to allow us to enter into supply contracts, including government contracts. Any government investigation of alleged violations of law could require us to expend significant time and resources in response and could generate negative publicity. The occurrence of any event or penalty described above may inhibit our ability to commercialize our product candidates and generate revenues and could harm our business, financial condition, results of operations and prospects. In addition, the FDA’s policies, and those of comparable foreign regulatory authorities, may change and additional government regulations may be enacted that could prevent, limit or delay regulatory approval of our product candidates. We cannot predict the likelihood, nature or extent of government regulation that may arise from future legislation or administrative actions, either in the U.S. or abroad. If we are slow or unable to adapt to changes in existing requirements or the adoption of new requirements or policies, or if we are not able to maintain regulatory compliance, we may lose any marketing approval which we may have obtained and we may not achieve or sustain profitability, which would materially harm our business, financial condition, results of operations and prospects.

We may also be subject to or affected by foreign laws and regulation, including regulatory guidance, governing the collection, use, disclosure, security, transfer and storage of personal data, such as information that we collect about patients and healthcare providers in connection with clinical trials and our other operations in the U.S. and abroad. For example, the E.U.’s General Data Protection Regulation (“GDPR”), which introduces strict requirements for processing all personal data and imposes even more stringent requirements for certain categories of sensitive information, including health related information. The GDPR increases the compliance burden on us, including by mandating potentially burdensome documentation requirements and granting certain rights to individuals to control how we collect, use, disclose, retain and leverage information about them. The processing of sensitive personal data, such as health information, imposes heightened compliance burdens under the GDPR and is a topic of active interest among foreign regulators. In addition, the GDPR provides for breach reporting requirements, more robust regulatory enforcement and fines of up to 20 million euros or up to 4% of annual global revenue. While the GDPR affords some flexibility in determining how to comply with the various requirements, significant effort and expense has been, and will continue to be, invested to ensure continuing compliance. Moreover, the requirements under the GDPR may change periodically or may be modified by EU national law and could affect our business operations if compliance becomes substantially more costly than under current requirements. In addition, further to the U.K.’s exit from the EU on January 31, 2020, the GDPR ceased to apply in the U.K. at the end of the transition period on December 31, 2020. However, as of January 1, 2021, the U.K.’s European Union (Withdrawal) Act 2018 incorporated the U.K. GDPR into U.K. law. The U.K. GDPR and the U.K. Data Protection Act 2018 set out the U.K.’s data protection regime, which is independent from but aligned to the EU’s data protection regime. Non-compliance with the U.K. GDPR may result in monetary penalties of up to £17.5 million or 4% of worldwide revenue, whichever is higher. Although the UK is regarded as a third country under the EU’s GDPR, the European Commission (“EC”) has now issued a decision recognizing the UK as providing adequate protection under the EU GDPR and, therefore, transfers of personal data originating in the EU to the UK remain unrestricted. Like the EU GDPR, the UK GDPR restricts personal data transfers outside the UK to countries not regarded by the UK as providing adequate protection. The UK government has confirmed that personal data transfers from the UK to the EEA remain free flowing. To enable the transfer of personal data outside of the EEA or the UK, adequate safeguards must be implemented in compliance with European and UK data protection laws. On June 4, 2021, the EC issued new forms of standard contractual clauses for data transfers from controllers or processors in the EU/EEA (or otherwise subject to the GDPR) to controllers or processors established outside the EU/EEA (and not subject to the GDPR). The new standard contractual clauses replace the standard contractual clauses that were adopted previously under the EU Data Protection Directive. The UK is not subject to the EC’s new standard contractual clauses but has published a draft version of a UK-specific transfer mechanism, which, once finalized, will enable transfers from the UK. We will be required to implement these new safeguards when conducting restricted data transfers under the EU and UK GDPR and doing so will require significant effort and cost. In the United States, there are numerous privacy laws that may be applicable to our activities, and a range of enforcement agencies at both the state and federal levels that can review companies for privacy and data security concerns based on general consumer protection laws. New laws also are being considered or have been implemented at both the state and federal levels. For example, the California Consumer Privacy Act of 2018, or the CCPA, which became effective on January 1, 2020, requires companies that process information of California residents to make new disclosures to consumers about their data collection, use and sharing practices, provides Californian consumers (as defined under the CCPA) with new individual data privacy rights, imposes new operational requirements for covered businesses, provides a private right of action for data breaches and creates a statutory damages framework. Although there are limited exemptions for clinical trial data under the CCPA, the CCPA and other similar laws could impact our business activities depending on how such laws are interpreted. Additionally, effective starting on January 1, 2023, the California Privacy Rights Act, or the CPRA, will significantly modify the CCPA, including by expanding consumers’ rights with respect to certain sensitive personal information. The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA. Certain states, including Colorado and Virginia, have enacted laws similar to the CCPA and many other states are considering similar legislation, and a broad range of legislative measures also have been introduced at the federal level. Additionally, some observers have noted that the CCPA and CPRA could mark the beginning of a trend toward more stringent privacy legislation in the U.S., which could increase our potential liability and adversely affect our business. Already, in the United States, we have witnessed significant developments at the state level. For example, on March 2, 2021, Virginia enacted the Consumer Data Protection Act (the “CDPA”), and, on July 8, 2021, Colorado’s governor signed the Colorado Privacy Act (“CPA”), into law. The CDPA and the CPA will both become effective January 1, 2023. While the CDPA and CPA incorporate many similar concepts of the CCPA and CPRA, there are also several key differences in the scope, application, and enforcement of the law that will change the operational practices of regulated businesses. The new laws will, among other things, impact how regulated businesses collect and process personal sensitive data, conduct data protection assessments, transfer personal data to affiliates, and respond to consumer rights requests. A number of other states have proposed new privacy laws, some of which are similar to the above discussed recently passed laws. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. The existence of comprehensive privacy laws in different states in the country would make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance. Further, regulations promulgated pursuant to HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations, or collectively HIPAA, imposes privacy, security and breach notification obligations on certain healthcare providers, health plans, and healthcare clearinghouses, known as covered entities, as well as their business associates that perform certain services that involve creating, receiving, maintaining or transmitting individually identifiable health information for or on behalf of such covered entities, and their covered subcontractors. HIPAA establishes privacy and security standards that limit the use and disclosure of individually identifiable health information and protected health information, or PHI, and requires the implementation of administrative, physical and technological safeguards to protect the privacy of PHI and ensure the confidentiality, integrity and availability of electronic PHI. Most healthcare providers, including research institutions from which we obtain patient health information, are privacy and security regulations promulgated under HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act. We do not believe that we are currently acting as a covered entity or business associate under HIPAA and thus are not directly subject to its requirements or penalties. However, any person may be prosecuted under HIPAA’s criminal provisions either directly or under aiding-and-abetting or conspiracy principles. Consequently, depending on the facts and circumstances, we could face substantial criminal penalties if we knowingly receive individually identifiable health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA’s requirements for disclosure of individually identifiable health information. The global legislative and regulatory landscape for privacy and data protection continues to evolve, and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. This evolution may create uncertainty in our business, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. It is possible that privacy laws may be interpreted and applied in a manner that is inconsistent with our practices. Any failure or perceived failure by us to comply with federal, state, or foreign laws or self-regulatory standards could result in negative publicity, diversion of management time and effort and proceedings against us by governmental entities or others. In many jurisdictions, enforcement actions and consequences for noncompliance are rising. As we continue to expand into other foreign countries and jurisdictions, we may be subject to additional laws and regulations that may affect how we conduct business. In addition to the risks associated with enforcement activities and potential contractual liabilities, our ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to our policies, procedures and systems. Further, any failure by our third-party collaborators, service providers, contractors or consultants to comply with applicable law, regulations or contractual obligations related to data privacy or security could result in proceedings against us by governmental entities or others. We may also publish privacy policies and other documentation regarding our collection, processing, use and disclosure of personal information and/or other confidential information. Although we endeavor to comply with our published policies and other documentation, we may at times fail to do so or may be perceived to have failed to do so. Despite our efforts, we may not be successful in achieving compliance if our employees or vendors fail to comply with our published policies and documentation. Such failures can subject us to potential international, local, state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices. Claims that we have violated individuals’ privacy rights or failed to comply with data protection laws or applicable privacy notices, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business. We also face a threat of consumer class actions related to these laws and the overall protection of personal information. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our reputation and our business, financial condition, results of operations or prospects