Corcept Therapeutics (CORT) Risk Factors

New laws and regulations, as well as changes to existing laws and regulations, including statutes and regulations concerning taxes and the development, approval, marketing and pricing of medications, the provisions of the ACA requiring the reporting of aggregate spending related to health care professionals, the provisions of the Sarbanes-Oxley Act of 2002, the Dodd Frank Act of 2010 and rules adopted by the SEC and by The Nasdaq Stock Market have and will likely continue to increase our cost of doing business and divert management's attention from revenue-generating activities. We and our partners are subject to federal, state and foreign laws and regulations concerning data privacy and security, including HIPAA and the EU General Data Protection Regulation ("GDPR"). These and other regulatory frameworks are evolving rapidly as new rules are enacted and existing ones updated and made more stringent. In the United States, numerous federal and state laws and regulations, including state data breach notification laws, state health information privacy, laws, and federal and state consumer protection laws and regulations (e.g., Section 5 of the Federal Trade Commission Act), that govern the collection, use, disclosure, and protection of health-related and other personal information could apply to our operations or the operations of our partners. In addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA. Depending on the facts and circumstances, we could be subject to criminal penalties if we knowingly obtain, use, or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA. Even when HIPAA does not apply, according to the Federal Trade Commission (the "FTC"), violating consumers' privacy or failing to take appropriate steps to keep consumers' personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. In 2022, the FTC also began a rulemaking proceeding to develop additional data privacy rules and requirements, which may add additional complexity to compliance obligations going forward. In addition, certain state laws govern the privacy and security of health information in certain circumstances, some of which are more stringent than HIPAA and many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Failure to comply with these laws, where applicable, can result in the imposition of significant civil and/or criminal penalties and private litigation. For example, the California Confidentiality of Medical Information Act imposes restrictive requirements regulating the use and disclosure of health information and other personally identifiable information. Further, the California Consumer Privacy Act, or the CCPA, which took effect on January 1, 2020, created individual privacy rights for California consumers and increased the privacy and security obligations of entities handling certain personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability. Further, the California Privacy Rights Act, or CPRA, revised and expanded the CCPA, adding additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The CPRA is in full effect as of January 1, 2023, and similar laws passed in Virginia, Colorado, Connecticut and Utah have taken effect and other states, including Texas, Florida, Oregon and Montana, have passed similar laws that will take effect in or after 2024. As a result, additional compliance investment and potential business process changes may be required. In the event that we are subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition. Additional legislation proposed at the federal level and in other states, along with increased regulatory action, reflect a trend toward more stringent privacy legislation in the United States. Outside the United States, many jurisdictions have or are in the process of enacting sweeping data privacy regulatory regimes. In Europe, the GDPR took effect in 2018, and is imposing stringent requirements for controllers and processors of personal data of individuals within the EEA, particularly with respect to clinical trials. The GDPR provides that EEA member states may make their own further laws and regulations limiting the processing of health data, which could limit our ability to use and share personal data or could cause our costs to increase and harm our business and financial condition. In addition, the GDPR increases the scrutiny that clinical trial sites located in the EEA should apply to transfers of personal data from such sites to countries that are considered to lack an adequate level of data protection, such as the United States. Recent legal developments have added complexity and compliance uncertainty regarding certain transfers of information from the EEA to the United States. Following EU court decisions, updated standard contractual clauses ("SCCs") were adopted to account for these judicial decisions, imposing new requirements on data transfers. The revised SCCs must be used for relevant new data transfers from September 27, 2021, and existing SCC arrangements were required to be migrated by December 27, 2022. There is some uncertainty around whether the revised clauses can be used for all types of data transfers, particularly whether they can be relied on for data transfers to non-EEA entities subject to the GDPR. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the SCCs cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. The GDPR imposes substantial fines for breaches of data protection requirements, which can be up to four percent of global revenue for the preceding financial year or €20 million, whichever is greater, and it also confers a private right of action on data subjects for breaches of data protection requirements. Compliance with European data protection laws is a rigorous and time intensive process that may increase our cost of doing business, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation and reputational harm in connection with our European activities. From January 1, 2021, we have had to comply with the GDPR and separately the United Kingdom GDPR, which, together with the amended United Kingdom Data Protection Act 2018, retains the GDPR in United Kingdom national law, each regime having the ability to fine up to the greater of €20 million/ £17.5 million or 4 percent of global turnover. It is unclear how United Kingdom data protection laws and regulations will develop in the medium to longer term and these changes may lead to additional costs and increase our overall risk exposure. On June 28, 2021, the EC adopted an adequacy decision in favor of the United Kingdom, enabling data transfers from EU member states to the United Kingdom without additional safeguards. However, the United Kingdom adequacy decision will automatically expire in June 2025 unless the EC renews or extends that decision and remains under review by the Commission during this period. Complying with U.S. and foreign privacy and security laws and regulations is complex and costly. Failure to comply by us or our vendors could subject us to litigation, government enforcement actions and substantial penalties and fines, which could harm our business.

Patients in clinical trials report changes in their health, including new illnesses, injuries and discomforts, to their study doctor. Often, it is not possible to determine whether or not these conditions were caused by the drug candidate being studied or something else. As we test our product candidates in larger, longer and more extensive clinical trials, or as use of them becomes more widespread if we receive regulatory approval, patients may report serious adverse events that did not occur or went undetected in previous trials. Many times, serious side effects are only detected in large-scale, Phase 3 clinical trials or following commercial approval. Adverse events reported in clinical trials can slow or stop patient recruitment, prevent enrolled patients from completing a trial and could give rise to liability claims. Regulatory authorities could respond to reported adverse events by interrupting or halting our clinical trials or limiting the scope of, delaying or denying marketing approval. If we elect, or are required by authorities, to delay, suspend or terminate a clinical trial or commercialization efforts, the commercial prospects of the affected product candidates or products may be harmed and our ability to generate product revenues from them may be delayed or eliminated. If one of our product candidates receives marketing approval, and we or others later identify undesirable side effects or adverse events, potentially significant negative consequences could result, including but not limited to: - regulatory authorities may suspend, limit or withdraw approvals of such product;- regulatory authorities may require additional warnings on the label, including "boxed" warnings, or issue safety alerts and other safety information about the product;- we may be required to change the way the product is administered or conduct additional studies or clinical trials;- we may be required to create a Risk Evaluation and Mitigation Strategy, which could include a medication guide outlining the risks of such side effects for distribution to patients, a communication plan for healthcare providers and/or other elements to assure safe use;- the product may become less competitive;- we may be subject to fines, injunctions or the imposition of criminal penalties; and - we could be sued and held liable for harm caused to patients. Any of these events could seriously harm our business.

Third-party clinical investigators and clinical sites enroll patients and CROs manage many of our trials and perform data collection and analysis. Although we control only certain aspects of these third parties' activities, we are responsible for ensuring that every study adheres to its protocol and meets regulatory and scientific standards. If any of our vendors does not perform its duties or meet expected deadlines or fails to adhere to applicable GCPs, or if the quality or accuracy of the data it produces is compromised, affected clinical trials may be extended, delayed or terminated and we may be unable to obtain approval for our product candidates. Outside parties may have staffing difficulties, may undergo changes in priorities or may become financially distressed, adversely affecting their willingness or ability to conduct our clinical trials. Problems with the timeliness or quality of the work of a CRO may lead us to seek to terminate the relationship and use an alternative service provider. However, making this change may be costly and may delay our trials, and it may be challenging to find a replacement organization that can conduct our trials in an acceptable manner and at an acceptable cost. Failure of our manufacturing vendors to perform their duties or comply with cGMPs may require us to recall drug product or repeat clinical trials, which would delay regulatory approval. If our agreements with any of these vendors terminate, we may not be able to enter into alternative arrangements in a timely manner or on reasonable terms.