Any failure or perceived failure by us to comply with federal or state laws or regulations, our internal policies and procedures or our contracts governing our use and disclosures of personal information could result in negative publicity, government investigations and enforcement actions including significant penalties, claims by third parties, and damage to our reputation, any of which could have a material adverse effect on our operations, financial performance and business.
Failure to comply with HIPAA, the HITECH Act, their implementing regulations and similar comparable state laws and regulations affecting the transmission, security and privacy of health information could result in significant penalties.
Numerous federal, state and foreign laws and regulations, including HIPAA and the HITECH Act in the United States, govern the collection, dissemination, disclosure, security, use and confidentiality of individually identifiable health information and, in many cases, other personal information. HIPAA and the HITECH Act require us to comply with standards for the use and disclosure of PHI within our company and with respect to third parties. The privacy, security and breach notification rules promulgated under HIPAA, as amended by the HITECH Act, Standards for Privacy of Individually Identifiable Health Information (Privacy Standards) and the Security Standards for the Protection of Electronic Protected Health Information (Security Standards) under HIPAA establish a set of basic national privacy and security standards for the protection of individually identifiable health information by Covered Entities and their Business Associates. HIPAA requires Covered Entities to develop and maintain policies and procedures with respect to individually identifiable health information that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect the privacy and security of such information. HIPAA also requires us to provide individuals with certain rights with respect to their PHI. Business Associates must have a written Business Associate contracts or other arrangements with a Covered Entity that establishes specifically what the Business Associate has been engaged to do and obligates the Business Associate to comply with HIPAA requirements. Further, in the event of a breach of unsecured PHI we must notify each individual whose PHI is breached as well as federal regulators and, in some cases, must publicize the breach in local or national media.
HIPAA also includes standards for common healthcare electronic transactions and code sets, such as claims information, plan eligibility, payment information and the use of electronic signatures, and privacy and electronic security of individually identifiable health information. Covered Entities, such as certain healthcare providers, are required to conform to such transaction set standards, known as the Standards for Electronic Transactions, pursuant to HIPAA. Submission of electronic healthcare claims and payment transactions that do not comply with the HIPAA electronic data transmission standards could result in delayed or denied payments.
In the conduct of our business, we process, maintain, and transmit sensitive data, including PHI. There can be no assurance that a breach of privacy or security will not occur. If there is a breach, we could be subject to various lawsuits, penalties and damages and may be required to incur costs to mitigate the impact of the breach on affected individuals.
Penalties for failure to comply with HIPAA requirements are substantial and could include corrective action plans and/or the imposition of civil or criminal penalties. HIPAA also authorizes state attorneys general to file suit under HIPAA on behalf of state residents. Courts can award damages, costs and attorneys' fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for HIPAA violations, its standards have been used as the basis for a duty of care claim in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI.
Additionally, certain states have adopted comparable privacy and security laws and regulations, some of which may apply more broadly or be more stringent than HIPAA. For example, the CCPA, which went into effect on January 1, 2020, gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. Further, the CPRA went into effect in California amending the CCPA and may increase our compliance costs and potential liability, imposes additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data and adds opt outs for certain uses of sensitive data. It also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. Washington state recently passed the "My Health My Data" Act, which broadly regulates "consumer health data" and creates a private right of action allowing individuals to sue directly for alleged violations and is expected to increase related litigation. In the event that we are subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws (for example, the My Health, My Data Act, the Colorado Privacy Act and other similar laws that recently went into effect in other states, such as Utah, Virginia, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, and Texas), any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.
In Europe, the GDPR went into effect in May 2018 and imposes strict requirements for processing the personal data of individuals within the EEA. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to countries outside of the EEA that have not been found to provide adequate protection to such personal data. In 2016, the EU and United States agreed to a transfer framework for data transferred from the EU to the United States, called the Privacy Shield, but the Privacy Shield was invalidated in July 2020 by the Court of Justice of the EU. In July 2023, however, the European Commission adopted an adequacy decision for a new mechanism for transferring data from the EU to the United States – the EU-US Data Privacy Framework, which provides EU individuals with several new rights, including the right to obtain access to their data, or obtain correction or deletion of incorrect or unlawfully handled data. The adequacy decision followed the signing of an executive order introducing new binding safeguards addressing the reasons behind the Court of Justice of the EU's invalidation of the original Privacy Shield. The European Commission will continually review developments in the United States along with its adequacy decision. However, future actions of EU data protection authorities are difficult to predict.
Relatedly, following the United Kingdom's withdrawal from the EU, the GDPR was implemented in the United Kingdom as the U.K. GDPR. which sits alongside the amended U.K. Data Protection Act 2018, which implements certain derogations in the EU GDPR into United Kingdom law. The U.K. GDPR mirrors the fines under the GDPR, i.e., fines up to the greater of €20 million (£17.5 million) or 4% of annual global turnover. In June of 2021, the European Commission issued a decision, which will sunset on June 27, 2025 without further action, that the United Kingdom ensures an adequate level of protection for personal data transferred under the EU GDPR from the EU to the United Kingdom. The U.K. Parliament is currently considering the Data Protection and Digital Information Bill to harmonize the 2018 Data Protection Act, U.K. GDPR, and the Privacy and Electronic Communications Regulations under one legislative framework.
The regulatory framework governing the collection, storage, use and sharing of certain information, particularly financial and other personal information, is rapidly evolving and is likely to continue to be subject to uncertainty and varying interpretations. Additionally, increasing concerns about health information privacy have recently prompted the federal government to issue guidance taking a newly expansive view of the scope of the laws and regulations that they enforce. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our existing practices. Any failure or perceived failure by us, or any third parties with which we do business, to comply with our privacy policies, changing expectations, evolving laws, rules and regulations, industry standards or contractual obligations to which we or such third parties are or may become subject, may result in actions or other claims against us by governmental entities or private actors, the expenditure of substantial costs, time and other resources or the incurrence of significant fines, penalties or other liabilities. In addition, any such action, particularly to the extent we were found to be guilty of violations or otherwise liable for damages, would damage our reputation and adversely affect our business, financial condition and results of operations.
Although we work to comply with applicable laws, regulations and standards, our contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another and may conflict with one another or other legal obligations with which we must comply. Any failure or perceived failure by us or our employees, representatives, contractors, consultants, collaborators, or other third parties to comply with such requirements or adequately address privacy and security concerns, even if unfounded, could result in additional cost and liability to us, damage our reputation and adversely affect our business and results of operations.