Our internal computer systems, or those used by our third-party CROs or other contractors or consultants, may fail or suffer security breaches.
Despite the implementation of security measures, our internal computer, server, and other information technology systems as well as those of our third-party collaborators, consultants, contractors, suppliers, and service providers, may be vulnerable to damage from physical or electronic break-ins, computer viruses, “phishing” attacks, malware, ransomware, denial of service and other cyber-attacks or disruptive incidents that could result in unauthorized access to, use or disclosure of, corruption of, or loss of sensitive, and/ or proprietary data, including health-related information or other personal information, and could subject us to significant liabilities and regulatory and enforcement actions, and reputational damage. If we or any of our third-party collaborators were to experience any material failure or security breach, it could result in a material disruption of our development programs, reputation, and business operations. For example, the loss of clinical study data from completed or ongoing clinical studies could result in delays in any regulatory approval or clearance efforts and significantly increase our costs to recover or reproduce the data, and subsequently commercialize the product. If we or our third-party collaborators, consultants, contractors, suppliers, or service providers were to suffer an attack or breach, for example, that resulted in the unauthorized access to or use or disclosure of personal information, including health-related information, we may have to notify individuals, collaborators, government authorities, and the media, and may be subject to investigations, civil penalties, administrative and enforcement actions, and litigation, any of which could harm our business and reputation. Likewise, we rely on our third-party CROs and other third parties to conduct clinical studies, and similar events relating to their computer systems could also have a material adverse effect on our business. The COVID-19 pandemic is generally increasing the attack surface available to criminals, as more companies and individuals work online and work remotely, and as such, the risk of a cybersecurity incident potentially occurring, and our investment in risk mitigations against such an incident, is increasing. For example, there has been an increase in phishing and spam emails as well as social engineering attempts from “hackers” hoping to use the recent COVID-19 pandemic to their advantage. To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or systems, or inappropriate or unauthorized access to or disclosure or use of confidential, proprietary, or other sensitive, personal information, including health-related information, we could incur liability and suffer reputational harm, and the development and commercialization of our products could be delayed. Our insurance policies may not be adequate to compensate us for the potential losses arising from such disruptions, failure, or security breach. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly, divert management attention, and harm our reputation.
We are subject to governmental regulation and other legal obligations related to privacy, data protection and information security. Compliance with these requirements could result in additional costs and liabilities to us or inhibit our ability to collect and process data, and the failure to comply with such requirements could have a material adverse effect on our business, financial condition or results of operations.
Privacy and data security have become significant issues in the United States, E.U. and in many other jurisdictions where we may in the future conduct our operations. As we receive, collect, process, use and store personal and confidential data, we may be subject to diverse laws and regulations relating to data privacy and security, including, in the United States, HIPAA and the CCPA (defined below), and, in the E.U. and the EEA, Regulation 2016/679, known as the General Data Protection Regulation (“GDPR”). Compliance with these privacy and data security requirements is rigorous and time-intensive and may increase our cost of doing business, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation and reputational harm, which could materially and adversely affect our business, financial condition and results of operations.
In the United States, we and our partners may be subject to numerous federal and state laws and regulations, including state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws and regulations, that govern the collection, use, disclosure, and protection of health-related and other personal information could apply to our operations or the operations of our partners. In addition, we may obtain