data monitoring practices, and certain security protocols regarding our information technology (“IT”) systems. Our investigation and remediation remain ongoing, and we may be required to notify interested parties, which may include regulators, vendors, and employees. We may be required to pay governmental fines or other expenses on account of this incident, and this incident could affect our relationships with our vendors and other counterparties, including on the basis of compromised information or if our reputation is negatively affected.
We are increasingly dependent on information technology systems and infrastructure, including mobile technologies, to operate our business. In the ordinary course of our business, we collect, process, store, and transmit large amounts of confidential information, including intellectual property, proprietary business information, and personal information. It is critical that we do so in a secure manner to maintain the confidentiality and integrity of such information. The size and complexity of our information technology systems, and those of third-party vendors with whom we contract, and the volume of data we retain, make such systems potentially vulnerable to breakdown, malicious intrusion, security breaches, ransomware, phishing, and other cyber-attacks. Our information security systems and those of our third-party vendors are subject to laws and regulations, or may become subject to new laws and regulations, requiring that we enact certain measures to protect the privacy and security of certain information that we collect or use in our business. A security breach or privacy violation, such as the example discussed above, that leads to unauthorized access to, disclosure of, or modification of, or that prevents access to, personal information or other protected or confidential information, whether caused by internal or external parties, could harm our reputation, compel us to comply with federal and/or state breach notification laws and foreign law equivalents, subject us to notification requirements under certain agreements with third parties, subject us to mandatory corrective action, require us to verify the correctness of database contents, and otherwise subject us to liability under laws and regulations that protect personal information, resulting in increased costs or loss of revenue. Similarly, the loss or unauthorized disclosure of clinical trial data from completed, ongoing, or planned clinical trials could prevent us from obtaining regulatory approval, or could delay our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Likewise, the loss or unauthorized disclosure of trade secrets or other sensitive business information, such as pricing and sales information; medical, regulatory, or safety data; vendor information; manufacturing processes; information about information technology systems and other internal systems; bank account information; or employee information, could impair our business.
If we are unable to prevent such security breaches or privacy violations, or implement satisfactory remedial measures, our operations could be disrupted, and we may suffer negative impact to our reputation and financial loss, and be subject to regulatory fines and penalties. In addition, breaches and other unauthorized data access can be difficult to detect, and any delay in identifying them may lead to increased harm of the type described above. Moreover, increased reliance in recent years on remote working technologies by our employees and third-party partners, and the prevalent use of mobile devices that access confidential and personal information, increase the risk of data security breaches, which could lead to the loss of confidential information, personal information, trade secrets, or other intellectual property. As cyber threats continue to evolve, and we identify vulnerabilities, we may be required to expend significant time, management attention, and other resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. While we have implemented security measures to protect our data security and information technology systems, such measures have failed in the past, and may not prevent future events. Significant disruptions of our information technology systems, or breaches of data security, could have a material adverse effect on our business, financial condition, and results of operations.
We are subject to various data protection laws, and our business and operations would suffer in the event of violations of these laws.
In the United States, numerous federal and state laws, including, without limitation, HIPAA, state security breach notification laws, state health information privacy laws, and federal and state consumer protection laws, govern the collection, use, disclosure, and storage of personal information, as well as consumer rights with regard to such information. For example, California’s California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act), gives California consumers further privacy rights, largely aligned with EU privacy rights. Other states, including Virginia, Colorado, Connecticut, and Utah have enacted similar privacy laws. Various foreign countries where we may process personal information also have, or are developing, privacy and data protection laws governing the collection, use, disclosure, and storage of personal information.