We are subject to certain U.S. and foreign anti-corruption, anti-money laundering, export control, sanctions, and other trade laws and regulations (collectively, “Trade Laws”). We can face serious consequences for violations.
Among other matters, Trade Laws prohibit companies and their employees, agents, CROs, legal counsel, accountants, consultants, contractors, and other partners from authorizing, promising, offering, provide, soliciting, or receiving directly or indirectly, corrupt or improper payments or anything else or anything of value to or from recipients in the public or private sector. Violations of Trade laws can result in substantial criminal fines and civil penalties, imprisonment, the loss of trade privileges, debarment, tax assessments, breach of contract and fraud litigation, reputational harm, and other consequences. We have direct or indirect interactions with officials and employees of government agencies or government-affiliated hospitals, universities, and other organizations. We also expect ournon-U.S. activities to increase in time. We engage third parties for clinical trials and/or obtain necessary permits, licenses, registrations, and other regulatory approvals. We can be held liable for the corrupt or other illegal activities of our personnel, agents, or partners, even if we do not explicitly authorize or have prior knowledge of such activities.
If we fail to comply with applicable U.S. and foreign privacy and data protection laws and regulation, we may be subject to liabilities that adversely affect our business, operations and financial performance.
We are subject to or affected by numerous federal, state and foreign laws and regulations, as well as regulatory guidance, governing the collection, use, disclosure, retention, and security of personal data, such as information that we collect about patients and healthcare providers in connection with clinical trials in the U.S. and abroad. The global data protection landscape is rapidly evolving, and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. This evolution may create uncertainty in our business, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us to comply with federal, state, or foreign laws or self-regulatory standards could result in negative publicity, diversion of management time and effort and proceedings against us by governmental entities or others. In many jurisdictions, enforcement actions and consequences for noncompliance are rising.
For example, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”), imposes, among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information, upon health plans, healthcare clearinghouses and certain healthcare providers, and their respective business associates that perform services for them involving individually identifiable health information. In the event we are subject to HIPAA, and fail to properly maintain the privacy and security of certain individually identifiable health information, or we are responsible for an inadvertent disclosure or security breach of such individually identifiable health information, we could be subject to enforcement measures, including civil and criminal penalties and fines for violations of state and federal privacy or security standards, such as HIPAA and HITECH, and their respective implementing regulations. Additionally, certain states have adopted comparable privacy and security laws and regulations, some of which may be more stringent than HIPAA. HIPAA, HITECH and comparable state laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. Any liability from failure to comply with the requirements of these laws, to the extent such requirements are deemed to apply to our operations, could adversely affect our financial condition. The costs of complying with privacy and security related legal and regulatory requirements are burdensome and could have a material adverse effect on our results of operations.
S-36