There are a number of federal and state laws, rules and regulations, as well as contractual obligations, relating to the protection, collection, storage, use, retention, security, disclosure, transfer and other processing of confidential, sensitive and personal information, including certain patient health information. Existing laws and regulations are constantly evolving, and new laws and regulations that apply to our business are being introduced at every level of government in the United States. In many cases, these laws and regulations apply not only to third-party transactions, but also to transfers of information between or among us, our tenants and operators, and other parties with whom we conduct business. These laws and regulations may be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible that they will be interpreted and applied in ways that may have a material adverse effect on our business. We monitor legal developments in data privacy and security regulations at the local, state and federal level, however, the regulatory framework for data privacy and security worldwide is continuously evolving and developing and, as a result, interpretation and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future.
The management of PHI is subject to several regulations at the federal level, including HIPAA and the HITECH Act. The HIPAA privacy and security regulations protect medical records and other personal health information by limiting their use and disclosure, giving individuals the right to access, amend and seek accounting of their own health information, and limiting most uses and disclosures of health information to the minimum amount reasonably necessary to accomplish the intended purpose. The HITECH Act strengthened HIPAA enforcement provisions and authorized State Attorneys General to bring civil actions for HIPAA violations. It permits the HHS to conduct audits of HIPAA compliance and imposes significant civil monetary penalties even if we did not know or reasonably could not have known about the violation. The Omnibus Rule extended certain privacy and security regulations to business associates and their subcontractors that handle protected health information and imposed new requirements on HIPAA business associate contracts. The Omnibus Rule also clarified a covered entity's (which is a healthcare provider, a health plan or healthcare clearinghouse) notification and reporting requirements in the event of a breach of unsecured protected health information. This reporting obligation supplements state laws that also may require notification in the event of a breach of personal information. If our tenants or operators are found to have violated the HIPAA privacy or security regulations or other federal or state laws protecting the confidentiality of patient health or personal information, including but not limited to the HITECH Act and the Omnibus Rule, our tenants or operators could be subject to sanctions, fines, damages and other additional civil or criminal penalties, including litigation with those affected, which could have a material adverse effect on us.
Numerous other federal and state laws protect the confidentiality, privacy, availability, integrity and security of PHI. For example, various states, such as California, Massachusetts and Washington, have implemented privacy laws and regulations, such as the California Confidentiality of Medical Information Act, the California Consumer Privacy Act, the California Privacy Rights Act and the Washington My Health My Data Act, that impose restrictive requirements regulating the use and disclosure of personally identifiable information, including PHI. These laws in many cases are more restrictive than, and may not be preempted by, the HIPAA rules and may be subject to varying interpretations by courts and government agencies, creating complex compliance issues and potentially exposing us and our tenants and operators to additional expense, adverse publicity and liability.
Complying with these various laws, rules, regulations and standards, and with any new laws or regulations changes to existing laws, could cause us to incur substantial costs that are likely to increase over time, require us to change our business practices, divert resources from other initiatives and projects, and restrict the way products and services involving data are offered, all of which may have a material adverse effect on us. Given the rapid development of cybersecurity and data privacy laws, we expect to encounter inconsistent interpretation and enforcement of these laws and regulations, as well as frequent changes to these laws and regulations which may expose us or our tenants or operators to significant penalties or liability for non-compliance, the possibility of fines, lawsuits (including class action privacy litigation), regulatory investigations, criminal or civil sanctions, audits, adverse media coverage, public censure, other claims, significant costs for remediation and damage to reputation or otherwise have a material adverse effect on us. Any inability to adequately address data privacy or security-related concerns, even if unfounded, or to comply with applicable laws, regulations, standards and other obligations relating to data privacy and security, could result in additional cost and liability to us, damage our relationships with our tenants and operators, and have a material adverse effect on us.