The protection of customer, employee, and our data is critical to our businesses. Cybersecurity and other information technology security risks, such as a breach of customer, employee, or company data, could create significant workflow disruption, attract substantial media attention, damage our customer relationships, reputation and brand, and result in lost sales, claims, demands or lawsuits from private parties, investigations and other proceedings by governmental authorities, and fines, penalties, and other liabilities. Throughout our operations, we receive, retain and transmit certain personal information that our customers and others provide to purchase products or services, fill prescriptions, enroll in promotional programs, participate in our customer loyalty programs, register on our websites, or otherwise communicate and interact with us. In addition, aspects of our operations depend upon the secure transmission of confidential information over public networks. Like other global companies, we and businesses we interact with have experienced threats to data and systems, including by perpetrators of random or targeted malicious cyber-attacks, computer viruses, ransomware, worms, bot attacks or other destructive or disruptive software and attempts to access, use, misappropriate, or otherwise process, customer information, including credit card information, and other information of ours or our service providers processor maintain, and cause system failures and disruptions. Our security measures and those of our third-party service providers may be undermined due to the actions of outside parties, employee error, malfeasance, or otherwise. Any security breach or incident or other compromise of our data security systems or measures or of those of our service providers or other businesses with whom we interact, which results in disruption to our business or operations or personal information, intellectual property, or other confidential or sensitive information being accessed, obtained, damaged, rendered unavailable, lost, used, or otherwise processed by unauthorized or improper persons, or any perception that any of the foregoing have occurred, could harm our reputation and expose us to regulatory investigations, proceedings, and other actions, customer attrition, harm to our market position, expenses to remediate and otherwise respond to the incident, and claims from customers, financial institutions, payment card associations and other persons, any of which could materially and adversely affect our business operations, financial condition and results of operations. Because the techniques used to obtain unauthorized access to, disrupt, disable or degrade service, or sabotage systems change frequently and may not immediately produce signs of having occurred, we may be unable to anticipate these techniques or to implement adequate preventative measures, and we may face difficulties or delays in identifying or responding to security breaches and incidents. In addition, a security breach or incident could require that we expend substantial additional resources related to the security of information systems and disrupt our businesses. These risks may be increased as a result of an increase in personnel working remotely.
We depend on and interact with the information technology networks and systems of third-parties for many aspects of our business operations, including payors, strategic partners and cloud service providers. These third parties may have access to information it maintains about us or our operations, customers, employees and vendors, or operating systems that are critical to or can significantly impact our business operations. Like us, these third-parties are subject to risks imposed by security breaches and incidents and cyber-attacks and other events or actions that could damage, disrupt, or close down their networks or systems or result in unauthorized access to or processing of information stored on or otherwise processed by such networks or systems. Any expansion of information technology outsourcing, including through arrangements with our strategic partners, may increase vulnerabilities and weaknesses relating to cybersecurity and data management. Security processes, protocols and standards that we have implemented and contractual provisions requiring security measures that we may have sought to impose on such third-parties may not be sufficient or effective at preventing such events, which could result in unauthorized access to, or disruptions or denials of access to, or misuse , unauthorized acquisition, use, disclosure or other unauthorized processing of, information or systems that are important to our business, including proprietary information, sensitive or confidential data, and other information about our operations, customers, employees and suppliers, including personal information.
The regulatory environment surrounding data security and privacy is increasingly demanding, with the frequent imposition of new and changing requirements across businesses and geographic areas. We are required to comply with increasingly complex and changing data security and privacy regulations in the United States and in other jurisdictions in which we operate that regulate the collection, use, transfer and other processing of personal data, including the transfer of personal data between or among countries. In the United States, for example, HIPAA imposes extensive privacy and security requirements governing the transmission, use and disclosure of health information by covered entities in the health care industry, including health care providers such as pharmacies, and their business associates. In addition, the California Consumer Privacy Act, which went into effect on January 1, 2020, imposes stringent requirements on the use and treatment of "personal information" of California residents, which term is broadly defined to include, among other things, information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked to a consumer or household. In addition, it is anticipated that the California Consumer Privacy Act will be expanded on January 1, 2023, when the California Privacy Rights Act of 2020 becomes operative. Other U.S. states have enacted, or are proposing similar laws related to the protection of personal data. In addition, the U.S. federal government is considering federal privacy legislation. Outside the United States, many of our business units operate in countries with stringent data protection regulations, and these laws continue to change. For example, the European Union's General Data Protection Regulation, which became effective in May 2018, greatly increased the jurisdictional reach of European Union data protection laws and added a broad array of requirements for handling personal data, including the public disclosure of significant data breaches, and provides for greater penalties for noncompliance. Other countries have enacted or are considering enacting data localization laws that require certain data to stay within their borders.
New and evolving legal and regulatory requirements associated with privacy, data protection, and information security, and our efforts to comply with them, require us to incur substantial costs and may require changes to our business practices in certain jurisdictions, any of which could materially and adversely affect our business operations and operating results. We may also face audits, investigations or other proceedings by one or more domestic or foreign government agencies relating to our compliance with these laws and regulations, and may face claims, demands, and litigation from private parties relating to any actual or asserted failure by us to comply with these laws and regulations. Compliance with new and evolving privacy, data protection, and information security laws, standards, and other actual or asserted obligations may result in significant expense due to factors such as requirements for increased investment in technology and the development of new operational processes. If we or those with whom we share or permit to process information fail to comply with these laws and regulations or experience a data security breach or incident, or any of these events is perceived to have occurred, our reputation could be damaged and we could be subject to additional litigation and regulatory risks, particularly to the extent the breach relates to sensitive data.
With laws, regulations and other obligations relating to privacy, data protection, and data security imposing new and relatively burdensome obligations, and with substantial uncertainty over the interpretation and application of these and other obligations, we may face challenges in addressing their requirements and making necessary changes to our policies and practices, and may incur significant costs and expenses in an effort to do so. Any failure or perceived failure by us or our service providers to comply with applicable policies or notices relating to privacy or data protection, contractual or other obligations to third parties, or any other actual or asserted legal obligations relating to privacy or data protection, may result in governmental investigations or enforcement actions, litigation, claims and other proceedings, harm our reputation and market position, and could result in significant liability.
We cannot provide assurance that any insurance we maintain will be adequate or otherwise protect us from or adequately mitigate liabilities or damages with respect to claims, costs, expenses, litigation, fines, penalties, business loss, data loss, regulatory actions or material adverse effects arising out of our privacy, data protection, or data security practices, or that such coverage will be available on acceptable terms or at all. The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), could have an adverse effect on our business. In addition, we cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or that our insurers will not deny coverage as to any future claim.