XSPA XpresSpa Group Inc

Item 8.01. Other Events.

In the prospectus supplement to the Registration Statement to be filed with the Commission, the Company intends to include the following disclosure under the heading “Risk Factors” regarding certain additional risk factors that could affect its business, financial condition, operating results and cash flows, which should be read in connection with the existing disclosure on risk factors made in the Company’s most recently filed Annual Report on Form 10-K, Quarterly Report on Form 10-Q and other filings made with the Commission:

We have no operating history in the diagnostic testing industry. 

Despite our management’s extensive experience in health and wellness services, we have no specific operating history in the diagnostic testing industry, including providing management services to a professional practice offering diagnostic testing services. We will face substantial risks and uncertainties to which our new diagnostic testing line of business will be subject. To address these risks and uncertainties, we must, among other things, successfully execute our business strategy, respond to competitive developments and attract and retain qualified personnel. We cannot assure you that we will operate profitably or that our business strategy will be successful. As a result, our diagnostic testing line of business may not succeed.

We have no formal contracts or relationships with any professional practice for the ordering of and collection of samples for, or with any laboratories for the performance of, COVID-19 testing.

Although we are exploring the possibility of offering COVID-19 testing in airport locations, there is currently no formal contractual relationship with any professional practice for the ordering of and collection of samples for, or with any clinical laboratory for the performance, of COVID-19 testing. We may never formalize any arrangement with a professional practice or clinical laboratory for these purposes and may never commence diagnostic testing operations. As a result, there can be no assurances that we will be able execute our current plans or generate any revenue associated with our current COVID-19 testing plans.

There can be no assurances that we will be able to successfully secure new locations or transition our existing spa facilities into locations at which COVID-19 testing will be ordered or performed.

There can be no assurances that we will be able to obtain new locations or make available or renovate our existing spa facilities for the purpose of operating a location at which COVID-19 testing will be ordered and/or performed by a professional practice. If we are unable to successfully transition such facilities to locations at which COVID-19 testing will be ordered and/or performed due to issues with lease agreements, permits, licenses or other delays, we will not be able to move forward with our planned short-term business transition.

We may rely on a limited number of professional practices and suppliers and, in some cases, a single professional practice or supplier, for the COVID-19 test and certain of the laboratory substances, equipment and other materials used for COVID-19 tests, and any delays or difficulties securing these materials could disrupt our operations and materially harm our business.

We plan to contract with a limited number of professional practices, and potentially only a single professional practice, for the ordering of and collection of samples for COVID-19 testing. If our professional practice partner begins performing point of care COVID-19 testing at our locations in the future, we may rely on a limited number of suppliers for the COVID-19 test kits, collection supplies, reagents, and various other equipment and materials we intend to use in performing COVID-19 testing. We currently do not have formal agreements with any potential professional practice or supplier, and, as a result, if such services or supplies are obtained, the professional practice or supplier could cease supplying these services or tests, materials and equipment to us at any time due to our inability to reach agreement on terms, disruptions in the professional practice’s or supplier’s operations, a determination to pursue other activities or lines of business, or for other reasons, or the professional practice or supplier could fail to provide us with sufficient quantities of services or materials that meet our specifications. Transitioning to a new professional practice or supplier or locating a temporary substitute, if any are available, would be time-consuming and expensive, could result in interruptions in or otherwise affect the performance specifications of our intended operations, or could require that we revalidate the tests we use. In addition, the use of services, equipment or materials provided by a replacement professional practice or supplier could require us to alter our future operations and procedures. Moreover, we believe there are currently only a limited number of manufacturers that are capable of supplying and servicing some of the equipment and other materials necessary for our intended operations. As a result, replacement equipment and materials that meet our quality control and performance requirements may not be available on reasonable terms, in a timely manner or at all. If we encounter delays or difficulties securing, reconfiguring or revalidating the equipment, reagents and other materials required for administering tests, our operations could be materially disrupted and our business, financial condition, results of operations, and reputation could be adversely affected. We also may experience services or supply issues as we increase test volume.

If our professional practice partner begins performing point of care COVID-19 testing at our locations in the future, the COVID-19 testing technology we ultimately choose may not perform as expected, as a result of human error or otherwise. No assurance can be given that the COVID-19 testing technology we use will aid in the testing of this virus.

If our professional practice partner begins performing point of care COVID-19 testing at our locations in the future, our success will depend on the COVID-19 testing technology we choose to use to provide a reliable, high-quality diagnostic result. There is no guarantee that the COVID-19 test technology we ultimately choose will be accurate. We believe that customers will be particularly sensitive to test defects and errors. As a result, the failure of the chosen tests to perform as expected could significantly impair our reputation and the public image of the tests we use. There can be no assurance that the COVID-19 test technology will be broadly adopted for use.  Many companies are developing tests for COVID-19 and the COVID-19 test technology we plan to use may not be effective. As a result, the failure or perceived failure of the chosen tests to perform as expected could have a material adverse effect on our business, financial condition, results of operation and cash flows.

If there is little or no demand for the COVID-19 test, our business could be materially harmed.

There can be no assurance that demand for our planned COVID-19 testing services will exist in the future because of the success of containment efforts, the emergence of a vaccine or due to other events. If there is no demand for our planned COVID-19 testing services, our business will be materially harmed.

The intended COVID-19 testing capabilities may never achieve significant market acceptance.

We may expend substantial funds and management effort on the development and marketing of our professional practice partner’s COVID-19 testing capabilities with no assurance that we will be successful in implementing our planned diagnostic testing business. Our ability to successfully offer COVID-19 tests will depend significantly on the perception that the tests used by our professional practice partner can reduce transmission risk and are reliable.

We will use potentially hazardous materials, chemicals and patient samples in our business and any disputes relating to improper handling, storage or disposal of these materials could be time consuming and costly.

Our professional practice partner’s diagnostic testing activities will involve the controlled use of hazardous laboratory materials and chemicals, including small quantities of acid and alcohol, and patient samples. They will be subject to U.S. laws and regulations related to the protection of the environment, the health and safety of employees and the handling, transportation and disposal of medical specimens, infectious and hazardous waste. They could be liable for accidental contamination or discharge or any resultant injury from hazardous materials, and conveyance, processing, and storage of and data on patient samples. If they fail to comply with applicable laws or regulations, they could be required to pay penalties or be held liable for any damages that result and this liability could exceed their financial resources. Further, future changes to environmental health and safety laws could cause them to incur additional expense or restrict operations.

In the event of a lawsuit or investigation concerning such hazardous materials, we could be held responsible for any injury caused to persons or property by exposure to, or release of, these hazardous materials or patient samples that may contain infectious materials. The cost of this liability could exceed our resources. While we expect to maintain broad form liability insurance coverage for these risks, and we expect our professional practice partner to maintain appropriate malpractice insurance, the level or breadth of our coverage may not be adequate to fully cover potential liability claims.

Our diagnostic testing business could be harmed from the loss or suspension of a license or imposition of a fine or penalties under, or future changes in, or interpretations of, the law or regulations of the Clinical Laboratory Improvement Act of 1967, and the Clinical Laboratory Improvement Amendments of 1988 (CLIA), or those of Medicare, Medicaid or other national, state or local agencies in the U.S. and other countries where we operate laboratories.

The performance of laboratory testing is subject to extensive U.S. regulation, and many of these statutes and regulations have not been interpreted by the courts. CLIA extends federal oversight to virtually all physician practices performing clinical laboratory testing and to clinical laboratories operating in the U.S. by requiring that they be certified by the federal government or, in the case of clinical laboratories, by a federally approved accreditation agency. The sanction for failure to comply with CLIA requirements may be suspension, revocation or limitation of a laboratory’s CLIA certificate, which is necessary to conduct business, as well as significant fines and/or criminal penalties. In addition, we expect to be subject to regulation under state law. State laws may require that laboratories and/or laboratory personnel meet certain qualifications, specify certain quality controls or require maintenance of certain records. Applicable statutes and regulations could be interpreted or applied by a prosecutorial, regulatory or judicial authority in a manner that would adversely affect our business. Potential sanctions for violation of these statutes and regulations include significant fines and the suspension or loss of various licenses, certificates and authorizations, which could have a material adverse effect on our business. In addition, compliance with future legislation could impose additional requirements on us, which may be costly.

U.S. Food and Drug Administration (FDA) regulation of diagnostic products could result in increased costs and the imposition of fines or penalties, and could have a material adverse effect upon our business.

The FDA has regulatory responsibility for instruments, test kits, reagents and other devices used by clinical laboratories. The FDA enforces laws and regulations that govern the development, testing, manufacturing, performance, labeling, advertising, marketing, distribution and surveillance of diagnostic products, and it regularly inspects and reviews the manufacturing processes and product performance of diagnostic products.

FDA regulation of the diagnostic products we use could result in increased costs and administrative and legal actions for noncompliance, including warning letters, fines, penalties, product suspensions, product recalls, injunctions and other civil and criminal sanctions, which could have a material adverse effect on our business, financial condition, results of operation and cash flows.

If we fail to comply with the complex federal, state, local and foreign laws and regulations that apply to our business, we could suffer severe consequences that could materially and adversely affect our operating results and financial condition.

We expect our planned operations to be subject to extensive federal, state, local and foreign laws and regulations, all of which are subject to change. These laws and regulations currently include, among other things:

These laws and regulations are complex and are subject to interpretation by the courts and by government agencies. Our failure to comply could lead to civil or criminal penalties, exclusion from participation in state and federal health care programs, or prohibitions or restrictions on our laboratory’s ability to provide or receive payment for our services. We believe that we are in material compliance with all statutory and regulatory requirements, but there is a risk that one or more government agencies could take a contrary position, or that a private party could file suit under the qui tam provisions of the federal False Claims Act or a similar state law. Such occurrences, regardless of their outcome, could damage our reputation and adversely affect important business relationships with third parties, including managed care organizations, and other private third-party payors.

Changes in the way that the FDA regulates COVID-19 tests could result in the delay or additional expense in offering tests.

Historically, the U.S. Food and Drug Administration (“FDA”) has exercised enforcement discretion with respect to most laboratory-developed tests (“LDTs”) and has not required laboratories that furnish LDTs to comply with the agency’s requirements for medical devices (e.g., establishment registration, device listing, quality systems regulations, premarket clearance or premarket approval, and post-market controls). In recent years, however, the FDA publicly announced its intention to regulate certain LDTs and issued two draft guidance documents that set forth a proposed phased-in risk-based regulatory framework that would apply varying levels of FDA oversight to LDTs. However, these guidance documents were withdrawn at the end of the Obama administration and replaced by an informal discussion paper reflecting some of the feedback that FDA had received on LDT regulation. The FDA acknowledged that the discussion paper in January 2017 does not represent the formal position of the FDA and is not enforceable. Nevertheless, the FDA wanted to share its synthesis of the feedback that it had received in the hope that it might advance public discussion on future LDT oversight. Notwithstanding the discussion paper, the FDA continues to exercise enforcement discretion and may decide to regulate certain LDTs on a case-by-case basis at any time, which could result in delay or additional expense in offering tests. Until the FDA finalizes its regulatory position regarding LDTs, or other legislation is passed reforming the federal government’s regulation of LDTs, it is unknown how the FDA may regulate tests we use in the future and what testing and data may be required to support any required clearance or approval.

If our professional practice partner begins performing point of care COVID-19 testing at our locations in the future, failure to accurately bill for testing services, or to comply with applicable laws relating to government health care programs, could have a material adverse effect on our business.

Billing for diagnostic testing services is complex and subject to extensive and non-uniform rules and administrative requirements. Depending on the billing arrangement and applicable law, we expect to bill various payers, such as patients, insurance companies, Medicare, Medicaid, clinicians, hospitals and employer groups if we begin performing point of care COVID-19 testing at our locations in the future. We expect that the majority of our billing and related operations will be provided by a third party. Failure to accurately bill for our services could have a material adverse effect on our business. In addition, failure to comply with applicable laws relating to billing government health care programs may result in various consequences, including the return of overpayments, civil and criminal fines and penalties, exclusion from participation in government health care programs and the loss of various licenses, certificates and authorizations necessary to operate our business, as well as incur additional liabilities from third-party claims, all of which could have a material adverse effect on our business. Certain violations of these laws may also provide the basis for a civil remedy under the federal False Claims Act, including fines and damages of up to three times the amount claimed. The qui tam provisions of the federal False Claims Act and similar provisions in certain state false claims acts allow private individuals to bring lawsuits against health care companies on behalf of the government.

Although we expect to be in compliance, in all material respects, with applicable laws and regulations, there can be no assurance that a regulatory agency or tribunal would not reach a different conclusion. The federal and state governments have substantial leverage in negotiating settlements since the amount of potential damages and fines far exceeds the rates at which services will be reimbursed, and the government has the remedy of excluding a non-compliant provider from participation in the Medicare and Medicaid programs. We expect that federal and state governments continue aggressive enforcement efforts against perceived health care fraud. Legislative provisions relating to health care fraud and abuse provide government enforcement personnel with substantial funding, powers, penalties and remedies to pursue suspected cases of fraud and abuse.

We will depend on third parties to provide services critical to our diagnostic testing business, and we will depend on them to comply with applicable laws and regulations. Additionally, any breaches of the information technology systems of third parties could have a material adverse effect on our operations.

We will depend on third parties to provide services critical to our diagnostic testing business, including supplies, ground and air transport of clinical and diagnostic testing supplies and specimens, research products, and people, among other services. Third parties that will provide services to us will be subject to similar risks related to security of customer-related information and compliance with U.S., state, local, or international environmental, health and safety, and privacy and security laws and regulations as we will be. Any failure by third parties to comply with applicable laws, or any failure of third parties to provide services more generally, could have a material impact on us, whether because of the loss of the ability to receive services from the third parties, our legal liability for the actions or inactions of third parties, or otherwise. In addition, third parties to whom we outsource certain services or functions may process personal data, or other confidential information belonging to us. A breach or attack affecting these third parties could also harm our business, results of operations and reputation.

Our business operations and reputation may be materially impaired if we do not comply with privacy laws or information security policies.

We will collect, generate, process or maintain sensitive information, such as patient data and other personal information. If we do not use or adequately safeguard that information in compliance with applicable requirements under federal, state and international laws, or if it were disclosed to persons or entities that should not have access to it, our business could be materially impaired, our reputation could suffer and we could be subject to fines, penalties and litigation. In the event of a data security breach, we may be subject to notification obligations, litigation and governmental investigation or sanctions, and may suffer reputational damage, which could have an adverse impact on our business.

We will be subject to laws and regulations regarding protecting the security and privacy of certain healthcare and personal information, including: (a) the federal Health Insurance Portability and Accountability Act and the regulations thereunder, which establish (i) a complex regulatory framework including requirements for safeguarding protected health information and (ii) comprehensive federal standards regarding the uses and disclosures of protected health information; and (b) state laws, including the California Consumer Privacy Act.

Hardware and software failures or delays in our information technology systems, including failures resulting from our systems conversions or otherwise, could disrupt our operations and cause the loss of confidential information, customers and business opportunities or otherwise adversely impact our business.

IT systems will be used extensively in virtually all aspects of our business, including clinical testing, test reporting, billing, customer service, logistics and management of medical data. Our success depends, in part, on the continued and uninterrupted performance of our IT systems. A failure or delay in our IT systems could impede our ability to serve our customers and patients and protect their confidential personal data. Despite redundancy and backup measures and precautions that we have implemented, our IT systems may be vulnerable to damage, disruptions and shutdown from a variety of sources, including telecommunications or network failures, system conversion or standardization initiatives, human acts and natural disasters. These issues can also arise as a result from failures by third parties with whom we do business and for which we have limited control. Any disruption or failure of our IT systems could have a material impact on our ability to serve our customers and patients, including negatively affecting our reputation in the marketplace.

We must comply with complex and overlapping laws protecting the privacy and security of health information and personal data.

There are a number of state, federal and international laws protecting the privacy and security of health information and personal data.  Under the administrative simplification provisions of HIPAA, HHS has issued regulations which establish uniform standards governing the conduct of certain electronic health care transactions and protecting the privacy and security of PHI used or disclosed by health care providers and other covered entities.

The privacy regulations regulate the use and disclosure of PHI by health care providers engaging in certain electronic transactions or “standard transactions.” They also set forth certain rights that an individual has with respect to his or her PHI maintained by a covered health care provider, including the right to access or amend certain records containing PHI or to request restrictions on the use or disclosure of PHI. The HIPAA security regulations establish administrative, physical, and technical standards for maintaining the integrity and availability of PHI in electronic form. These standards apply to covered health care providers and also to “business associates” or third parties providing services involving the use or disclosure of PHI. The HIPAA privacy and security regulations establish a uniform federal “floor” and do not supersede state laws that are more stringent or provide individuals with greater rights with respect to the privacy or security of, and access to, their records containing PHI. As a result, we may be required to comply with both HIPAA privacy regulations and varying state privacy and security laws.

Moreover, HITECH, among other things, established certain health information security breach notification requirements. In the event of a breach of unsecured PHI, a covered entity must notify each individual whose PHI is breached, federal regulators and in some cases, must publicize the breach in local or national media. Breaches affecting 500 individuals or more are publicized by federal regulators who publicly identify the breaching entity, the circumstances of the breach and the number of individuals affected.

These laws contain significant fines and other penalties for wrongful use or disclosure of PHI. Given the complexity of HIPAA and HITECH and their overlap with state privacy and security laws, and the fact that these laws are rapidly evolving and are subject to changing and potentially conflicting interpretation, our ability to comply with the HIPAA, HITECH and state privacy requirements is uncertain and the costs of compliance are significant. Adding to the complexity is that our planned operations are currently evolving and the requirements of these laws will apply differently depending on such things as whether or not we bill electronically for our services, or provide services involving the use or disclosure of PHI and incur compliance obligations as a business associate. The costs of complying with any changes to the HIPAA, HITECH and state privacy restrictions may have a negative impact on our operations. Noncompliance could subject us to criminal penalties, civil sanctions and significant monetary penalties as well as reputational damage.

We also will be required to collect and maintain personal information about our employees as well as receive and transfer certain payment information, to accept payments from our customers, including credit card information. Most states have adopted laws requiring notification of affected individuals and state regulators in the event of a breach of personal information, which is a broader class of information than the health information protected by HIPAA. Many state laws impose significant data security requirements, such as encryption or mandatory contractual terms to ensure ongoing protection of personal information. Activities outside of the United States implicate local and national data protection standards, impose additional compliance requirements, and generate additional risks of enforcement for non-compliance. The collection and use of such information may be subject to contractual obligations as well. If the security and information systems that we or our outsourced third-party providers use to store or process such information are compromised or if we, or such third parties, otherwise fail to comply with these laws, regulations, and contractual obligations, we could face litigation and the imposition of penalties that could adversely affect our financial performance.

We must comply with all applicable privacy and data security laws in order to operate our business and may be required to expend significant capital and other resources to ensure ongoing compliance, to protect against security breaches and hackers or to alleviate problems caused by such breaches. Breaches of health information and/or personal data may be extremely expensive to remediate, may prompt federal or state investigation, fines, civil and/or criminal sanctions and significant reputational damage.

Our capital expenditures may not generate a positive return and we will incur significant additional costs.

Our capital expenditures may not generate a positive return.  Significant capital expenditures will be required to construct new locations or renovate our existing spa facilities to accommodate our proposed new business model. No assurance can be given that our future capital expenditures will generate a positive return or that we will have adequate capital available to finance such construction or renovations. If we are unable to, or elect not to, pay for costs associated with such construction or renovations, the ability of our professional practice partner to order or perform COVID-19 testing could be limited, and our competitive position could be harmed.

Additionally, we expect to incur significant additional costs as we implement the ability of our professional practice partner to perform on-site COVID-19 testing. The COVID-19 outbreak could disrupt our future supply chain, including by impacting our ability to secure COVID-19 testing supplies and to provide personal protective equipment for our employees in our testing locations. For similar reasons, the COVID-19 pandemic has also adversely impacted, and may continue to adversely impact, third parties that will be critical to our business, including vendors, suppliers, and business partners. These developments, and others that are difficult or impossible to predict, could materially impact our business, financial results, cash flows, and financial position.