69
systems and those of our third-party service providers, contractors or consultants are
additionally vulnerable to security breaches from
inadvertent or intentional actions by our employees, third-party
vendors, contractors, consultants, business partners and/or other third
parties. These threats pose a risk to the security of our systems and networks, the
confidentiality and the availability,
security and
integrity of our data, and these risks apply both to us and to third parties on whose
systems we rely for the conduct of our business. If
the IT systems of our third-party vendors and other contractors and
consultants become subject to disruptions or security breaches, we
may have insufficient recourse against such third parties
and we may have to expend significant resources to mitigate the impact of
such an event, and to develop and implement protections to prevent future
events of a similar nature from occurring. Any cyberattack
or destruction or loss of, unauthorized access to, processing of, or exfiltration of data
could have a material adverse effect on our
business, financial condition, results of operations and prospects. For example,
if such an event were to occur and cause interruptions
in our operations, or those of our third-party vendors and other contractors
and consultants, it could result in a material disruption or
delay of the development of our product candidates. In addition, we may suffer
reputational harm or face litigation or adverse
regulatory action as a result of cyberattacks or other data security breaches, particularly
those involving personal information or
protected health information, and may incur significant additional expense
to implement further data protection measures. As cyber
threats continue to evolve, we may be required to incur material additional
expenses in order to enhance our protective measures or to
remediate any information security vulnerability.
We are subject to stringent privacy
laws, information security laws, regulations, policies and contractual obligations
related to data
privacy and security and changes in such laws, regulations, policies and contractual
obligations could adversely affect our
business, financial condition, results of operations and prospects.
We are subject to
data privacy and security laws and regulations that apply to the collection, transmission,
storage, use,
processing, destruction, retention and security of personal information,
which among other things, including additional laws or
regulations relating to health information. The legislative and regulatory
landscape for privacy and data protection continues to evolve
in jurisdictions worldwide, and these laws may at times be conflicting. It is possible that these
laws may be interpreted and applied in
a manner that is inconsistent with our practices and our efforts to comply
with the evolving data protection rules may be unsuccessful.
We must devote
significant resources to understanding and complying with this changing
landscape. Failure to comply with federal,
state and international laws regarding privacy and security of personal
information could expose us to penalties under such laws,
orders requiring that we change our practices, claims for damages or other
liabilities, regulatory investigations and enforcement action,
litigation and significant costs for remediation, any of which could
adversely affect our business. Even if we are not determined to
have violated these laws, government investigations into these issues typically require
the expenditure of significant resources and
generate negative publicity,
which have a material adverse effect on our business, financial condition, results
of operations and
prospects. Failure to comply with any of these laws and regulations could
result in enforcement action against us, including fines,
criminal prosecution of employees, claims for damages by affected
individuals and damage to our reputation and loss of goodwill, any
of which could have a material adverse effect on our business, financial
condition, results of operations and prospects. Additionally,
if
we are unable to properly protect the privacy and security of personal information,
including protected health information, we could
be found to have breached our contracts with certain third parties.
There are numerous U.S. federal and state laws and regulations related
to the privacy and security of personal information. In
particular, HIPAA,
as amended by the Health Information Technology
for Economic and Clinical Health Act of 2009 (“HITECH”)
and their respective implementing regulations, establish privacy and
security standards that limit the use and disclosure of individually
identifiable health information, or protected health information, and require
the implementation of administrative, physical and
technological safeguards to protect the privacy of protected health information
and ensure the confidentiality, integrity
and availability
of electronic protected health information. Determining whether protected
health information has been handled in compliance with
applicable privacy standards and our contractual obligations can be complex
and may be subject to changing interpretation. If we fail
to comply with applicable privacy laws, including applicable HIPAA
privacy and security standards, we could face civil and criminal
penalties. The HHS has the discretion to impose penalties without attempting
to first resolve violations. HHS enforcement activity can
result in financial liability and reputational harm, and responses to such enforcement
activity can consume significant internal
resources. Even when HIPAA
does not apply, failing
to take appropriate steps to keep consumers’ personal information secure can
constitute unfair acts or practices in or affecting commerce and
be construed as a violation of Section 5(a) of the Federal Trade
Commission Act (the “FTCA”), 15 U.S.C § 45(a). The FTC expects a company’s
data security measures to be reasonable and
appropriate in light of the sensitivity and volume of consumer information it holds,
the size and complexity of its business, and the
cost of available tools to improve security and reduce vulnerabilities. Individually
identifiable health information is considered
sensitive data that merits stronger safeguards and the FTC’s
guidance for appropriately securing consumers’ personal
information is
similar to what is required by the HIPAA
Security Rule. In addition, state attorneys general are authorized to bring civil
actions
seeking either injunctions or damages in response to violations that threaten
the privacy of state residents. We
cannot be sure how
these regulations will be interpreted, enforced or applied to our operations.
In addition to the risks associated with enforcement
activities and potential contractual liabilities, our ongoing efforts
to comply with evolving laws and regulations at the federal and state
level may be costly and require ongoing modifications to our policies, procedures
and systems.
Internationally, laws, regulations
and standards in many jurisdictions apply broadly to the collection, transmission,
storage,
use, processing, destruction, retention and security of personal information.
For example, in the European Union, the collection,
transmission, storage, use, processing, destruction, retention and security
of personal data is governed by the provisions of the General