Pharmaceutical and medical device companies have faced lawsuits and investigations pertaining to violations of health care "fraud and abuse" laws, such as the federal False Claims Act, the federal Anti-Kickback Statute and other state and federal laws and regulations. Pharmaceutical and medical device companies have been prosecuted or faced civil liability under these laws for a variety of alleged promotional and marketing activities, including engaging in off-label promotion that caused claims to be submitted for non-covered off-label uses. See Item 1. "Business - Government Regulations" of this Form 10-K. If we are in violation of any of these requirements or any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, this could have a significant impact on our business, including the imposition of significant criminal and civil fines and penalties, exclusion from federal health care programs or other sanctions, including consent orders or corporate integrity agreements.
While we have developed corporate compliance programs based on what we believe to be current best practices, we cannot provide assurance that we or our employees or agents are or will be in compliance with all applicable federal, state or foreign regulations and laws. If we are in violation of any of these requirements or any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, including the imposition of significant criminal and civil fines and penalties, exclusion from federal health care programs or other sanctions, including consent orders or corporate integrity agreements.
Our policies mandate compliance with anti-bribery laws. We operate in many parts of the world that have experienced governmental corruption and in certain circumstances, strict compliance with anti-bribery laws may conflict with local customs and practices or may require us to interact with doctors and hospitals, some of which may be state controlled, in a manner that is different than in the U.S. and Canada. We cannot provide assurance that our internal control policies and procedures will protect us from reckless or criminal acts committed by our employees, consultants, distributors, third party contractors or agents. Violations of these laws, or allegations of such violations, could disrupt our business and result in criminal or civil penalties or remedial measures, any of which could have a material adverse effect on our business.
We are also subject to various state, federal and international laws and regulations governing the collection, transmission, dissemination, use, privacy, confidentiality, security, retention, availability, integrity and other processing of health-related and other sensitive and personal information, including HIPAA and CCPA. State laws are changing rapidly and there is discussion in Congress of a new federal data protection and privacy law to which we may be subject. For instance, the California Privacy Rights Act ("CPRA") which was passed in November 2020 and took effect on January 1, 2023, maintains the core framework of the CCPA, while also making a number of substantive changes. We are also subject to various state and federal rules and laws governing cybersecurity risks and incidents, including an SEC rule relating to disclosure of material cybersecurity incidents and risks and state laws regarding notification of data breaches. Since these data security regimes are evolving, uncertain and complex, especially for a global business such as ours, we will need to update or enhance our compliance measures from time to time and these updates or enhancements will require further implementation costs. Any failure, or perceived failure, by us to comply with current and future regulatory or customer-driven privacy, data protection, and information security requirements, or to prevent or mitigate security breaches, cyberattacks, or improper access to, use of, or disclosure of data, or any security issues or cyber-attacks affecting our business, could result in significant liability, costs (including the costs of mitigation and recovery), a material loss of revenue resulting from the adverse impact on its reputation and brand, loss of proprietary information and data, disruption to its business and relationships, and diminished ability to retain or attract customers and business partners. Such events may result in governmental enforcement actions and prosecutions, private litigation, fines and penalties or adverse publicity, and could cause customers and business partners to lose trust in us, which could have an adverse effect on our reputation and business.
Internationally, laws and regulations in many jurisdictions apply broadly to health-related and other sensitive and personal information, including the EU's GDPR, and the UK's General Data Protection Regulation ("UK GDPR"), which, together with national legislation, regulations and guidelines of the EU member states and the UK governing the processing of personal data, impose strict obligations and restrictions on the ability to collect, analyze, store, transfer and otherwise process personal data, including health data from clinical trials and adverse event reporting. These laws and regulations could limit our ability to collect, use and share data, and could cause our compliance costs to increase, and ultimately could have an adverse impact on our business and financial condition.
In the EU, we are also subject to the new European Union Artificial Intelligence Act (the "EU AI Act"), regulating development and deployment of AI systems. In the context of the European Strategy for Data, we may also be subject to the European Union's Data Act. In addition, in China, the Personal Information Protection Law (the "PIPL") provides for very specific administrative requirements and security controls when transferring personal data outside the Peoples Republic of China. We are also subject to Canada's federal Personal Information Protection and Electronic Documents Act and substantially similar equivalents at the provincial level with respect to the collection, use and disclosure of personal information in Canada.
The regulatory framework for data privacy, data security and data transfers worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. Complying with all of these laws and regulations involves costs to our business, and failure to comply with these laws and regulations can result in the imposition of significant civil and criminal penalties, as well as litigation, all of which could have a material adverse effect on our business. For more information regarding applicable data privacy and security laws and regulations, see Item 1. "Business - Government Regulations" of this Form 10-K.
We are also subject to U.S. federal laws regarding reporting and payment obligations with respect to our participation in federal health care programs, including Medicare and Medicaid. Because our processes for calculating applicable government prices and the judgments involved in making these calculations involve subjective decisions and complex methodologies, these calculations are subject to risk of errors and differing interpretations. In addition, they are subject to review and challenge by the applicable governmental agencies, and it is possible that such reviews could result in changes that could have material adverse legal, regulatory, or economic consequences.
The Trump administration has signed many executive orders on a range of issues, including with respect to diversity, equity, inclusion and accessibility programs, policies and related issues, tariffs and other trade protection measures, environmental and energy-related matters, regulation of artificial intelligence and review of existing legislation and regulations (such as the FCPA and IRA). Additional executive orders are anticipated. In addition, these executive orders may inform future legislative reform. We are in the process of monitoring and assessing these executive orders and what, if any, impact they will have on our business and operations, but such impact could have a material adverse effect on our business.