Our relationships with healthcare providers, other customers, and third-party payers will be subject to applicable anti-kickback, fraud and abuse, and other healthcare laws and regulations, which could expose us to criminal sanctions, civil penalties, exclusion from government healthcare programs, contractual damages, reputational harm, and diminished profits and future earnings.
Once we begin commercializing VYKAT XR, we will be subject to additional healthcare statutory and regulatory requirements and enforcement by the federal government and the states and foreign governments in which we conduct our business. Healthcare providers, physicians, and third-party payers will play a primary role in the recommendation and prescription of VYKAT XR. Our future arrangements with third-party payors and customers may expose us to broadly applicable fraud and abuse and other healthcare laws and regulations that may constrain the business or financial arrangements and relationships through which we market, sell, and distribute VYKAT XR. Restrictions under applicable federal and state healthcare laws and regulations include, but are not limited to, the Anti-Kickback Statute, the False Claims Act, HIPAA and the HITECH Act.
Efforts to ensure that our future business arrangements with third parties comply with applicable healthcare laws and regulations could involve substantial costs and may require us to undertake or implement additional policies or measures. We may face claims and proceedings by private parties, and claims, investigations and other proceedings by governmental authorities, relating to allegations that our business practices do not comply with statutes, regulations or case law involving applicable fraud and abuse, privacy or data protection, or other healthcare laws and regulations, and it is possible that courts or governmental authorities may conclude that we have not complied with them, or that we may find it necessary or appropriate to settle any such claims or other proceedings. In connection with any such claims, proceedings, or settlements, we may be subject to significant civil, criminal, and administrative penalties, damages, fines, other damages, imprisonment, exclusion from government funded healthcare programs, such as Medicare and Medicaid, and the curtailment or restructuring of our operations. If any of the physicians or other providers or entities with whom we expect to do business is found not to be in compliance with applicable laws, they may be subject to criminal, civil or administrative sanctions, including exclusions from government funded healthcare programs.
We are subject to U.S. and foreign laws regarding privacy, data protection, and data security that could entail substantial compliance costs, while the failure to comply could subject us to significant liability.
Privacy, data protection, and data security have become significant issues in the U.S., Europe, and other jurisdictions where we conduct or may in the future conduct our operations. The regulatory framework for the collection, use, safeguarding, sharing, and transfer of health and other personal information is rapidly evolving worldwide and is likely to remain in flux for the foreseeable future. The scope and interpretation of the laws that are or may be applicable to us are often uncertain, subject to differing interpretations, and may be inconsistent among different jurisdictions.
In the U.S., HIPAA, as amended by the HITECH Act, imposes on covered entities certain requirements relating to the privacy, security, and transmission of individually identifiable health information. The legislation also increased the civil and criminal penalties that may be assessed for violations and gave state attorneys general the authority to file civil actions in federal courts to enforce the HIPAA rules. In addition, for clinical trials conducted in the U.S., any personal information that is collected is further regulated by the Federal Policy for the Protection of Human Subjects. Privacy laws are also being enacted or considered at the state level, including significant new legislation in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act. While there is currently an exception for protected health information subject to HIPAA and clinical trial regulations, these and other state privacy laws may impact our business activities, and there continues to be uncertainty about how these laws will be interpreted and enforced. Other states have passed privacy legislation, including general privacy legislation similar to the CCPA, and legislation such as Washington’s My Health, My Data Act, that also may impact our business activities, in the future and additional states are evaluating similar legislation. In the event we enroll subjects in clinical trials in the E.U. or other jurisdictions, or otherwise acquire or process personal data of individuals in those jurisdictions, we may be subject to additional restrictions and obligations relating to the collection, use, storage, transfer, and other processing of this data. Clinical trial activities in the European Economic Area (EEA), for example, are governed by the E.U. General Data Protection Regulation (GDPR).
We may need to take additional steps, such as new contractual negotiations or modifications to our policies or practices relating to cross-border transfers of personal data, to comply with these restrictions and obligations. More generally, laws and regulations governing privacy and data protection exist in many other countries around the world, and these laws (which are evolving and expanding) create complicated and potentially inconsistent obligations that may impact our business.
The increasing number, complexity, and potential inconsistency of current and future laws and regulations relating to privacy, data protection, and data security in the U.S. and other countries make our compliance obligations more difficult and costly. If we fail to comply with applicable laws and regulations or experience a breach of security that results in unauthorized disclosure of personal information - or if a third party with whom we share personal information or who processes such information for us fails to comply with applicable requirements or experiences a security breach or incident- or if any of these is reported or perceived to have occurred, it could lead to government investigations, enforcement actions, and other proceedings, as well as civil claims and litigation against us. We could incur substantial costs to defend against any such claims or proceedings and may also be held liable for significant fines, penalties, and monetary judgments. Any of the foregoing could have a material adverse effect on our business, results of operations, reputation, and prospects.