We collect and maintain information in digital form that is necessary to conduct our business, and we are dependent on our information technology systems and those of third parties to operate our business. In the ordinary course of our business, we collect, store and transmit large amounts of confidential information, including intellectual property, proprietary business information and personal information, and data to comply with cGMP and data integrity requirements. It is critical that we do so in a secure manner to maintain data security and data integrity of such information. We have established physical, electronic and organizational measures to safeguard and secure our systems to prevent a data compromise. We have also outsourced elements of our information technology infrastructure, and as a result a number of third-party vendors may or could have access to our confidential information. Our internal information technology systems and infrastructure, and those of our current and any future collaborators, contractors and consultants and other third parties on which we rely, are vulnerable to damage from computer viruses, malware, natural disasters, terrorism, war, telecommunication and electrical failures, cyber-attacks or cyber-intrusions, phishing, persons inside our organization or persons with access to systems inside our organization.
We, like other organizations in our industry, may experience cybersecurity incidents. The risk of cybersecurity incidents, data breaches or disruption or data loss, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. In addition, the prevalent use of mobile devices that access confidential information increases the risk of data security breaches, which could lead to the loss of confidential information or other intellectual property. The costs to us to mitigate network security problems, bugs, viruses, worms, malicious software programs and security vulnerabilities could be significant, and while we have implemented security measures to protect our data security and information technology systems, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service and other harm to our business and our competitive position. If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our product development programs. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Likewise, we rely on third parties to conduct clinical trials, and similar events relating to their computer systems could also have a material adverse effect on our business. Moreover, if a computer security breach affects our systems or results in the unauthorized release of personally identifiable information, our reputation could be materially damaged. In addition, such a breach may require notification to impacted stakeholders (including affected individuals, regulators and investors pursuant to various federal and state privacy and security laws, if applicable, including the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and its implementing rules and regulations, as well as regulations promulgated by the Federal Trade Commission and state breach notification laws. We would also be exposed to a risk of loss or litigation and potential liability, which could materially adversely affect our business, results of operations and financial condition. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and data security obligations.
We are or may become subject to other U.S. federal and state laws governing the privacy and security of health information, many of which differ from each other in significant ways and may not be preempted by HIPAA. For example, the California Consumer Privacy Act (CCPA) created individual privacy rights for California residents, including requiring covered businesses to provide notice regarding how personal information is collected and how individuals can limit the sharing of their personal information. The California Privacy Rights Act (CPRA) amended the CCPA and requires specific disclosures and safeguarding requirements around sensitive personal information. The CPRA also establishes a state agency vested with the authority to enforce the CCPA. The CCPA also applies to personal information collected about employees, applicants and retirees, as well as that which is collected in a business-to-business capacity. While there is currently an exception in the CCPA for protected health information that is subject to HIPAA, the CCPA may nevertheless impact our data use and sharing practices and require significant investment in our effort to comply with its obligations.
More than a dozen other U.S. states have enacted legislation similar to the CCPA, but contain key differences in their scope, application, and enforcement. Clear enforcement guidelines, as well as associated penalties for noncompliance, are likely to be unpredictable for the foreseeable future. Moreover, certain states have advanced privacy laws focused on protecting consumer health information, such as Washington's My Health My Data Act, which contains a private right of action and my increase the risk of litigation. and this remains a rapidly changing legislative and regulatory environment. Any actual or perceived noncompliance with privacy and data protection laws by us or our partners may damage to our reputation, lead to loss of existing or future business, require us to change our data practices and increase our expenses related to litigation and compliance ongoing compliance, any of which could adversely affect our business, results of operations and financial condition.
In December 2024, the U.S. Department of Justice issued regulations implementing Executive Order ("EO") 14117, "Preventing Access to Americans' Bulk Sensitive Personal Data and United Stated Government-Related Data by Countries of Concern," which are expected to become effective in April 2025. These regulations prohibit transactions involving access to bulk sensitive data by countries of concern, such as China (including Hong Kong). In the life sciences sector, the regulations prohibit investment agreements, employment agreements, vendor agreements, and other transactions involving human genomic data and biospecimens, except where necessary for specified exempt activities. Tracking and complying with these regulations may require significant time and expense.