Numerous state and federal laws and regulations govern the collection, dissemination, use, privacy, confidentiality, security, availability, integrity, and other processing of PHI and PII. These laws and regulations include HIPAA. HIPAA establishes a set of national privacy and security standards for the protection of PHI (as defined in HIPAA) by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates with whom such covered entities contract to provide specified services or perform a function for or on behalf of such covered entities. We are a business associate under HIPAA, and it is our policy to execute business associate agreements with our clients and our sub-business associates.
HIPAA requires covered entities and business associates, such as us, to develop and maintain policies with respect to the protection, use and disclosure of electronic PHI, including the adoption of administrative, physical and technical safeguards to protect such information, and imposes certain notification and reporting requirements in the event of a data breach.
Violations of HIPAA may result in significant civil and criminal penalties. HIPAA also authorizes state attorneys general to file suits on behalf of their residents. Courts may award damages, costs and attorneys' fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. OCR has recently increased its enforcement efforts on compliance with HIPAA, including the security regulations (Security Rule), bringing actions against entities which have failed to implement security measures sufficient to reduce risks to electronic protected health information or to conduct an accurate and thorough risk analysis, among other violations. HIPAA enforcement actions may lead to monetary penalties and costly and burdensome corrective action plans. We are also required to report known breaches of PHI consistent with applicable breach reporting requirements set forth in applicable laws and regulations.
In addition, HIPAA mandates that the Secretary of HHS conduct periodic compliance audits of HIPAA covered entities and business associates. With regard to business associates, those audits assess the business associate's compliance with the HIPAA Privacy and Security Rules. Such audits are conducted randomly and after an entity experiences a breach affecting more than 500 individuals' data. Undergoing an audit can be costly, can result in fines or onerous obligations, and can damage a business associate's reputation.
Finally, on December 10, 2020, OCR issued a proposed rule aimed at reducing regulatory burdens that may exist in discouraging coordination of care, including creating an exception to the minimum necessary standard for healthcare coordination, among other changes. While a final rule has not yet been issued, if adopted, these proposed changes may require us to update our HIPAA policies and procedures to comply with the new requirements.
In addition to HIPAA, numerous other federal and state laws and regulations protect the confidentiality, privacy, availability, integrity and security of PHI and other types of PII. Some of these laws and regulations may be preempted by HIPAA with respect to PHI, or may exclude PHI from their scope but impose obligations with regard to PII that is not PHI, and in some cases, can impose additional obligations with regard to PHI. These laws and regulations are often uncertain, contradictory, and subject to changed or differing interpretations, and we expect new laws, rules and regulations regarding privacy, data protection, and information security to be proposed and enacted in the future. Although these other laws include limited exceptions, including for PHI maintained by a covered entity or business associate, they may regulate or impact our processing of personal information depending on the context and increase our compliance costs and potential liability. Additionally, our machine learning and data analytics offerings may be subject to laws and evolving regulations regarding the use of artificial intelligence, controlling for data bias, and antidiscrimination.
Additionally, the FTC and many state attorneys general are interpreting existing federal and state consumer protection laws to impose evolving standards for the online collection, use, dissemination and security of health-related and other personal information. Courts may also adopt the standards for fair information practices promulgated by the FTC, which concern consumer notice, choice, security and access. Consumer protection laws require us to publish statements that describe how we handle personal information and choices individuals may have about the way we handle their personal information. If such information that we publish is considered untrue, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Furthermore, according to the FTC, violating consumers' privacy rights or failing to take appropriate steps to keep consumers' personal information secure may constitute unfair or deceptive acts or practices in violation of Section 5 of the FTC Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. The FTC's guidance for appropriately securing consumers' personal information is similar to what is required by the HIPAA Security Rule. Enforcement by the FTC under the FTC Act can result in civil penalties or enforcement actions.
This complex, dynamic legal landscape regarding privacy, data protection, data analytics and information security creates significant compliance issues for us and our clients and potentially exposes us to additional expense, adverse publicity and liability. While we have implemented data privacy and security measures in an effort to comply with applicable laws and regulations relating to privacy and data protection, some PHI and other PII or confidential information is transmitted to us by third parties, who may not implement adequate security and privacy measures, and it is possible that laws, rules and regulations relating to privacy, data protection, or information security may be interpreted and applied in a manner that is inconsistent with our practices or those of third parties who transmit PHI and other PII or confidential information to us. If we or these third parties are found to have violated such laws, rules or regulations, it could result in government-imposed fines, orders requiring that we or these third parties change our or their practices, or criminal charges, which could adversely affect our business. Complying with these various laws and regulations could cause us to incur substantial costs or require us to change our business practices, systems and compliance procedures in a manner adverse to our business.