In providing solutions to our customers, we transmit, use, store and otherwise process, confidential and personally identifiable information ("PII") including health, financial, and other personal information. Our treatment of such information is subject to contractual restrictions and federal, state, and foreign data privacy laws and regulations, which continue to evolve resulting in greater scrutiny and regulation over the protection of PII.
In response to these evolving restrictions and regulations (which include, without limitation, the Health Insurance Portability and Accountability Act ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), the California Consumer Privacy Act ("CCPA"), the Gramm-Leach-Bliley Act ("GLBA"), and other U.S. federal and state privacy laws and regulations, the European Union's General Data Protection Regulation ("EU GDPR"), the United Kingdom's GDPR ("UK GDPR"), the South Africa Protection of Personal Information Act ("POPIA") and the Brazilian General Data Protection Low ("LGPD")), we have implemented and maintain administrative, technical, and physical security measures and it is our standard practice to contractually require our service providers to whom we disclose data (including PII) to implement and maintain reasonable privacy, data protection, and information security measures, in each case to protect against loss, theft, misuse, or unauthorized access to or disclosure of such information, and otherwise comply with these laws and regulations. These measures include standard industry practices (e.g., payment card industry ("PCI") requirements, ISO/IEC 27001), periodic security reviews of our systems by independent parties, secure development practices, network firewalls, policy directives, procedural controls, training of our personnel, intrusion detection systems, and antivirus applications. However, due to the inherent risks and complexities of defending against cybercrime and other information security incidents, these measures may fail to adequately protect this information. Any failure on our part to protect the security and privacy of PII and other confidential information, or otherwise comply with data privacy laws and regulations may subject us to contractual liability and damages, loss of business, damages from individual claimants (including class action litigation), substantial fines/penalties, criminal prosecution, and unfavorable publicity.
Even the mere perception of a security breach or inadvertent disclosure of PII could damage our reputation and inhibit market acceptance of our solutions. In addition, third-party vendors that we engage to perform services for us may unintentionally release PII or otherwise fail to comply with applicable laws and regulations. Under our terms of service and our contracts with customers, if there is a breach of PII that we process, we could be liable to the customer for their losses and related expenses. As new laws and regulations emerge and evolve and as our business continues to expand to include new products and technologies, these risks will likely continue to increase, and our compliance costs are likely to increase as well. Bad actors, individual and State sponsored, will increasingly attempt to compromise our security controls or gain unauthorized access to our, and our customers', sensitive information and PII. Further, because a significant number of our employees work remotely, these security risks may increase. We have implemented heightened monitoring of our Networks and Systems, but cannot guarantee that our efforts, or those of third parties on whom we rely on or with whom we partner, will be successful in preventing any such information security incidents or attacks.