In the ordinary course of our business, we currently, and in the future will, collect, store, transfer, use or process sensitive data, including personally identifiable information of employees. The secure processing, storage, maintenance, and transmission of this critical information are vital to our operations and business strategy. We are, and may increasingly become, subject to various laws and regulations, as well as contractual obligations, relating to data privacy and security in the jurisdictions in which we operate. The regulatory environment related to data privacy and security is increasingly rigorous, with new and constantly changing requirements applicable to our business, and enforcement practices are likely to remain uncertain for the foreseeable future. These laws and regulations may be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible that they will be interpreted and applied in ways that may have a material adverse effect on our business, financial condition, results of operations and prospects.
In the United States, various federal and state regulators, including governmental agencies like the Consumer Financial Protection Bureau and the Federal Trade Commission, have adopted, or are considering adopting, laws and regulations concerning personal information and data security. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to personal information than federal, international or other state laws, and such laws may differ from each other, all of which complicates compliance efforts. For example, the California Consumer Privacy Act ("CCPA"), which increases privacy rights for California residents and imposes obligations on companies that process their personal information, came into effect on January 1, 2020. Among other things, the CCPA requires covered companies to provide disclosures regarding information practices to California consumers and provide such consumers new data protection and privacy rights, including the ability to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. Additionally, the California Privacy Rights Act ("CPRA"), was approved by California voters in the election of November 3, 2020 and went into effect in January of 2023 modifying the CCPA significantly, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply. In addition, similar laws and regulations in other U.S. states, such as Colorado, Connecticut, New Jersey, Delaware, Utah, Virginia, Oregon, Indiana, Iowa, Tennessee, Montana, Florida and Texas and other international jurisdictions have been applied to protect individuals' privacy (including laws regarding unfair and deceptive practices in the United States and GDPR in the European Union) and may be subject to evolving interpretations or applications. Furthermore, defending a suit for the wrongful use or disclosure of health or personal information, regardless of its merit, could be costly, divert management's attention and harm our reputation. Laws in all 50 U.S. states require businesses to provide notice to consumers whose personal information has been disclosed as a result of a data breach. State laws are changing rapidly and there is discussion in the U.S. Congress of a new comprehensive federal data privacy law to which we would become subject if it is enacted.
At the federal level, regulations promulgated pursuant to HIPAA as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH") establish privacy and security standards that limit the use and disclosure of individually identifiable health information (known as "protected health information" when protected under HIPAA) and require the implementation of administrative, physical and technological safeguards to protect the privacy and security of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information. Determining HIPAA applicability to our operations as our operations evolve, obligations under applicable privacy standards and our contractual obligations may require complex factual and regulatory analyses and may be subject to differing or changing interpretations. Although we take measures to protect sensitive data from unauthorized access, use or disclosure, our information technology and infrastructure may be vulnerable to attacks by hackers or viruses or accessed due to employee error, malfeasance or other malicious or inadvertent disruptions. Any such breach, incident or interruption could compromise our networks and the information stored there could be accessed by unauthorized parties, manipulated, acquired, publicly disclosed, lost or stolen. Any such access or other loss of information could result in legal claims or proceedings, and liability for us or our customers under international or U.S. federal or state laws that protect the privacy of health information, such as HIPAA, and regulatory penalties. Notice of certain incidents may be required to be provided to affected individuals, the Secretary of the Department of Health and Human Services, and for extensive breaches, notice may also need to be made to the media. Additionally, state law may require notice to the applicable state Attorney General. Such notices could result in financial, legal, operational or reputational harm to us, loss of competitive advantage or loss of consumer confidence.
We continue to evaluate our compliance obligations, but do not currently have in place formal policies and procedures related to the storage, collection and processing of information, and have not conducted any internal or external data privacy audits, to ensure our compliance with all applicable data protection laws and regulations. Additionally, we do not currently have policies and procedures in place for assessing our third-party vendors' compliance with applicable data protection laws and regulations. All of these evolving compliance and operational requirements impose significant costs, such as costs related to organizational changes, implementing additional protection technologies, training employees and engaging consultants, which are likely to increase over time. In addition, such requirements may require us to modify our data processing and cybersecurity practices and any policies that we have implemented, distract management or divert resources from other initiatives and projects, all of which could have a material adverse effect on our business, financial condition, results of operations and prospects. Any failure or perceived failure by us or our third-party vendors, collaborators, contractors and consultants to comply with any applicable federal, state or international laws and regulations relating to data privacy and security, could result in damage to our reputation, as well as proceedings or litigation by governmental agencies or other third parties, including class action litigation in certain jurisdictions, which would subject us to significant expense, as well as potential fines, sanctions, awards, penalties or judgments, all of which could have a material adverse effect on our business, financial condition, reputation, results of operations and prospects.