In the ordinary course of our business, we collect, store and transmit large amounts of confidential information, including intellectual property, proprietary business information and personal information. Our information systems and infrastructure, and those of our current or future third-party collaborators, service providers, contractors and consultants are vulnerable to damage from cybersecurity incidents, including computer viruses, denial-of-service attacks, hacking, phishing and other social engineering attacks, unauthorized access or use resulting from malware, as well as disruptions due to natural disasters, terrorism, war, mistakes or technical errors, including due to software updates and telecommunication and electrical failures. We may also experience cybersecurity incidents stemming from persons inside our organizations (including employees or contractors), or other persons with access to information systems inside our organization. Attacks on information systems are increasing in their frequency, levels of persistence, sophistication and intensity, and they are being conducted by increasingly sophisticated and organized foreign governments, groups and individuals with a wide range of motives and expertise. In addition to extracting or accessing sensitive information, such attacks could include the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering and other means to affect service reliability and threaten the security, confidentiality, integrity and availability of information. The prevalent use of mobile devices that access sensitive information also increases the risk of data security incidents which could lead to the loss of confidential information or other intellectual property. Information system disruptions, even if inadvertent, may limit or disable our access or important third parties' access to our systems. While to our knowledge we have not experienced any material information system failure, accident or security breach to date, if such an event were to occur and cause interruptions in our operations or the operations of third-party collaborators, service providers, contractors or consultants, it could result in a material disruption of our development programs and significant reputational, financial, legal, regulatory, business or operational harm. The costs to us to mitigate, investigate and respond to potential security incidents, breaches, disruptions, network security problems, bugs, viruses, worms, malicious software programs and security vulnerabilities could be significant, and while we have implemented security measures to protect our data security and information systems, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service and other harm to our business and our competitive position.
For example, the loss of clinical trial data from completed, ongoing or planned clinical trials for our product candidates could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. To the extent that any real or perceived security breach affects our information systems (or those of our third-party collaborators, service providers, contractors or consultants), or results in the loss of or accidental, unlawful or unauthorized access to, use of, release of, or other processing of personally identifiable information or damage to our data or applications or other data or applications relating to our technology or product candidates, or inappropriate disclosure of confidential or proprietary information, we could be found to have violated applicable U.S. and international privacy, data protection and other laws, which could subject us to litigation and governmental investigations and proceedings by federal, state and local regulatory entities in the U.S. and by international regulatory entities, resulting in exposure to material civil and/or criminal liability. and the further development of our product candidates could be delayed. Such a breach may require notification to governmental agencies, the media or individuals pursuant to various foreign, domestic (federal and state) privacy and security laws, if applicable, including HIPAA, as amended by HITECH, and its implementing rules and regulations, as well as regulations promulgated by the Federal Trade Commission and state breach notification laws. In addition, our liability insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity incidents.
Any failure or perceived failure by us or any third-party collaborators, service providers, contractors or consultants to comply with our privacy, confidentiality, data security or similar obligations, or any data security incidents or other security breaches that result in the accidental, unlawful or unauthorized access to, use of, release of, processing of, or transfer of sensitive information, including personally identifiable information, may result in negative publicity, harm to our reputation, governmental investigations, enforcement actions, regulatory fines, litigation or public statements against us, could cause third parties to lose trust in us or could result in claims by third parties, including those that assert that we have breached our privacy, confidentiality, data security or similar obligations, any of which could have a material adverse effect on our reputation, business, financial condition or results of operations. To the extent we maintain individually identifiable health information, we could be subject to fines and penalties (including civil and criminal) under HIPAA for any failure by us or our business associates to comply with HIPAA's requirements. Moreover, data security incidents and other security breaches can be difficult to detect, and any delay in identifying them may lead to increased harm. While we have implemented data security measures intended to protect our information, data, information systems, applications and infrastructure, there can be no assurance that such measures will successfully prevent service interruptions or cybersecurity incidents.