privacy and security requirements under HIPAA, as amended by HITECH. Depending on the facts and circumstances, we could be subject to civil, criminal, and administrative penalties if we violate HIPAA.
Compliance with U.S. and international data protection laws and regulations could require us to take on more onerous obligations in our contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability to operate in certain jurisdictions. Failure to comply with these laws and regulations could result in government enforcement actions (which could include civil, criminal, and administrative penalties), private litigation, and/or adverse publicity and could negatively affect our operating results and business. Moreover, clinical trial subjects, employees, and other individuals about whom we or our current or future collaborators obtain personal information, as well as the providers who share this information with us, may limit our ability to collect, use and disclose the information. Claims that we have violated individuals’ privacy rights, failed to comply with data protection laws, or breached our contractual obligations, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business.
Our employees, principal investigators, consultants, and commercial partners may engage in misconduct or other improper activities, including non-compliance with regulatory standards and requirements and insider trading.
We are exposed to the risk of fraud or other misconduct by our employees, principal investigators, consultants, and commercial partners. Misconduct by these parties could include intentional failures to comply with FDA regulations or the regulations applicable in other jurisdictions, provide accurate information to the FDA and other regulatory authorities, comply with healthcare fraud and abuse laws and regulations in the United States and abroad, report financial information or data accurately or disclose unauthorized activities to us. In particular, sales, marketing and business arrangements in the healthcare industry are subject to extensive laws and regulations intended to prevent fraud, misconduct, kickbacks, self-dealing and other abusive practices. These laws and regulations restrict or prohibit a wide range of pricing, discounting, marketing and promotion, sales commission, customer incentive programs and other business arrangements. Such misconduct also could involve the improper use of information obtained in the course of clinical trials or interactions with the FDA or other regulatory authorities, which could result in regulatory sanctions and cause serious harm to our reputation. It is not always possible to identify and deter employee misconduct, and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from government investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations. If any such actions are instituted against us and we are not successful in defending ourselves or asserting our rights, those actions could result in significant civil, criminal and administrative penalties, damages, fines, disgorgement, imprisonment, exclusion from participating in government funded healthcare programs, such as Medicare and Medicaid, additional reporting requirements and oversight if we become subject to a corporate integrity agreement or similar agreement to resolve allegations of non-compliance with these laws, contractual damages, reputational harm and the curtailment or restructuring of our operations, any of which could have a negative impact on our business, financial condition, results of operations and prospects.
If our information technology systems, or the information technology systems of our CROs, our CDMOs, service providers, our current and potential future partners or other third parties with whom we work fail or suffer security breaches, we could experience adverse consequences, including but not limited to material disruptions to our business operations and product development programs, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, or other adverse consequences.
We collect, store, receive, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, share, and transmit (collectively, process) proprietary, confidential and sensitive information, including personal information (such as health-related data of clinical trial participants and employee information), in the course of our business. Similarly, third-parties with whom we work process certain of that information on our behalf.
Our internal computer systems and those of our current and any future collaborators and other contractors or consultants are vulnerable to damage from cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities that threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties upon which we rely. Such threats are constantly evolving and growing in frequency, sophistication, and intensity. For example, these threats may include (without limitation) malware, viruses, software vulnerabilities and bugs, software or hardware failure, hacking, denial of service attacks, social engineering (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing), ransomware, insider threats (such as theft of misuse by personnel), credential stuffing, telecommunications failures, loss or theft of devices, data or other information technology assets, attacks enhanced or facilitated by AI, earthquakes, fires, floods and similar threats. Threats such as ransomware attacks, for example, are becoming increasingly prevalent and severe, and attackers are increasingly leveraging multiple attack methods to extort payment from victims, such as data theft and disabling systems and can lead to significant interruptions in our operations, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.