In the ordinary course of business, we collect and store sensitive data, including intellectual property, our proprietary business information and that of our business partners, PHI, and personally identifiable information of patients and employees. We manage and maintain our applications and data utilizing a combination of on-site systems, managed data center systems and cloud-based systems. We also communicate PHI and other sensitive data through our various tools and platforms. In addition to storing and transmitting sensitive data that is subject to legal protections, these applications and data encompass a wide variety of business-critical information, including research and development information, commercial information, and business and financial information. The secure processing, maintenance, and transmission of this information is critical to our operations and business strategy.
We face a number of risks relative to protecting our information, including loss of access, inappropriate disclosure, inappropriate modification, and the risk of our being unable to adequately monitor and modify our controls over our critical information. Despite our security measures, our information technology and infrastructure are also vulnerable to attacks by hackers, viruses, ransomware or breaches due to employee error, technical error, malfeasance, or other disruptions.
These types of problems may be caused by a variety of factors, including infrastructure changes, intentional or accidental human actions or omissions, software errors, malware, security attacks, fraud, spikes in customer usage and denial of service issues. From time to time, large third-party web hosting providers have also experienced outages or other problems that have resulted in their systems being offline and inaccessible. In addition to data security risks, we also face privacy risks. Should we actually violate, or be perceived to have violated, any privacy promises we make to patients or consumers, we could be subject to a complaint from an affected individual or interested privacy regulator, such as the FTC or a state Attorney General. This risk is heightened given the sensitivity of the data we collect.
Any problems that may arise in connection with our data and systems, including those that are hosted by third-party providers, could result in interruptions to our business and operations or exposure to security vulnerabilities. Any such breach or interruption, whether of our systems or that of our third-party service providers or their subcontractors, could also compromise our networks, and the information stored there could be accessed, publicly disclosed, lost, or stolen. Any such access, disclosure, theft, or other loss of information or privacy or security compromise could result in legal claims or proceedings or liability under federal or state laws that protect the privacy or security of personal information, including HIPAA, HITECH, and state data security and data breach notification laws. Any data privacy or security event could also disrupt our operations and damage our reputation, any of which could adversely affect our business.
If a privacy or security event occurs, we may be required to comply with state breach notification laws and become subject to mandatory corrective action. Penalties for failure to comply with a requirement of HIPAA or HITECH vary significantly, and, depending on the knowledge and culpability of the HIPAA-regulated entity, may include civil monetary penalties of up to $1.5 million per calendar year for each provision of HIPAA that is violated. A person who knowingly obtains or discloses individually identifiable health information in violation of HIPAA may face a criminal penalty of up to $50,000 and up to one-year imprisonment. The criminal penalties increase if the wrongful conduct involves false pretenses or the intent to sell, transfer or use identifiable health information for commercial advantage, personal gain or malicious harm. Penalties for unfair or deceptive acts or practices under the FTC Act or state Unfair and Deceptive Acts and Practices statutes may also vary significantly.
Also, even if we do not incur an interruption of or our operations, fines, penalties, or financial liability to third parties from a security breach, we could suffer a loss of confidence in our services, which could adversely affect our business and competitive position. A security event could also result in the compromise of our trade secrets and other proprietary information, which could adversely affect our competitive position.