destruction, loss, distribution, use, access, disablement, misappropriation or modification, or other compromise or misuse of any IT Systems or Personal Data used in connection with the business of the Company and its subsidiaries (“Breach”). There have been no Breaches, except for those that have been remedied without material cost or liability or the duty to notify any other person, nor any incidents under internal review or investigations relating to the same, and the Company and its subsidiaries have not been notified of and have no knowledge of any event or condition that would reasonably be expected to result in a Breach. Except as would not cause a Material Adverse Change, the Company and its subsidiaries are, and for the past three years have been, in compliance with all applicable laws or statutes and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, policies, applicable industry standards and contractual obligations relating to the privacy and security of IT Systems and Personal Data and to the protection of such IT Systems and Personal Data from unauthorized use, access, misappropriation or modification (“Data Protection Requirements”). Neither the Company nor any of its subsidiaries: (i) has received written notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Data Protection Requirements, and has no knowledge of any event or condition that would reasonably be expected to result in any such notice; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Data Protection Requirement; or (iii) is a party to any order, decree, or agreement that imposes any obligation or liability by any governmental or regulatory authority under any Data Protection Requirement.
(pp) [Reserved].
(qq) Compliance with Applicable Laws. The Company, its subsidiaries, and their respective directors, officers, employees and, to the knowledge of the Company, agents, are, and at all times have been, in compliance with all health care laws applicable to the Company, its subsidiaries or its respective product candidates or activities, including, without limitation, the Federal Food, Drug, and Cosmetic Act (the “FDCA”) (21 U.S.C. § 301 et seq.), the Public Health Service Act (42 U.S.C. § 201 et seq.), the federal Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)), the federal Physician Payments Sunshine Act (42 U.S.C. § 1320a-7h), the civil False Claims Act (31 U.S.C. §§3729 et seq.), all criminal laws relating to health care fraud and abuse, including but not limited to the criminal False Claims Law (42 U.S.C. § 1320a-7b(a)), 18 U.S.C. Sections 286, 287, 1035, 1347 and 1349 and the health care fraud criminal provisions under the U.S. Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) (42 U.S.C. Section 1320d et seq.), HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act (42 U.S.C. §§ 17921 et seq.), the exclusion laws (42 U.S.C. § 1320a-7), the civil monetary penalties law (42 U.S.C. § 1320a-7a), Medicare (Title XVIII of the Social Security Act), Medicaid (Title XIX of the Social Security Act), any similar local, state or federal laws, and the rules and regulations promulgated pursuant to such laws (collectively, the “Health Care Laws”), except where failure to be so in compliance have not, and would not reasonably be expected to result in a Material Adverse Change. The Company has not received any FDA Form-483, notice of adverse finding, warning letter, letter of admonition, untitled letter or other correspondence or notice from any regulatory authority or governmental authority alleging or asserting noncompliance with any Health Care Laws applicable to the Company or its subsidiaries. Neither the Company nor any of its subsidiaries, nor, to the Company’s knowledge, their officers, directors, employees, or agents, have engaged in activities which are, as applicable, cause for false claims liability, civil penalties, or mandatory or permissive exclusion from Medicare, Medicaid, or any other state or federal healthcare program. Neither the Company nor any of its subsidiaries has received notice of any claim, action, suit, proceeding, hearing, enforcement, investigation, arbitration or other action from any court or arbitrator or governmental or regulatory authority or third party alleging that any product operation or activity is in violation of any Health Care Laws nor, to the Company’s knowledge, is any such claim, action, suit, proceeding, hearing, enforcement, investigation, arbitration or other action threatened. The Company and its subsidiaries have filed, maintained or submitted all material reports, documents, forms, notices, applications, records, claims, submissions and
13