penalties, imprisonment, damages, fines, disgorgement, exclusion from government funded healthcare programs, such as Medicare and Medicaid, contractual damages, diminished profits and future earnings, and the curtailment or restructuring of our operations, any of which could substantially disrupt our operations or financial results. Although compliance programs can mitigate the risk of investigation and prosecution for violations of these laws, the risks cannot be entirely eliminated. Any action against us for violation of these laws or regulations, even if we successfully defend against it, could cause us to incur significant legal expenses and generate negative publicity, which could harm our financial condition and divert our management’s attention from the operation of our business.
Our employees may engage in misconduct or other improper activities, including violating applicable regulatory standards and requirements or engaging in insider trading, which could significantly harm our business.
We are exposed to the risk of employee fraud or other misconduct. Misconduct by employees could include intentional failures to comply with the regulations of the FDA and applicable non-U.S. regulators, provide accurate information to the FDA and applicable non-U.S. regulators, comply with healthcare fraud and abuse laws and regulations in the United States and abroad, report financial information or data accurately or disclose unauthorized activities to us. In particular, sales, marketing and business arrangements in the healthcare industry are subject to extensive laws and regulations intended to prevent fraud, misconduct, kickbacks, self-dealing and other abusive practices. These laws and regulations restrict or prohibit a wide range of pricing, discounting, marketing and promotion, sales commission, customer incentive programs and other business arrangements. Employee misconduct could also involve the improper use of, including trading on, information obtained in the course of clinical trials, which could result in regulatory sanctions and serious harm to our reputation. It is not always possible to identify and deter employee misconduct, and any precautions we take to detect and prevent this activity may be ineffective in controlling unknown or unmanaged risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations. If any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, including the imposition of significant fines or other sanctions. Some of these laws and related risks are described under the risk factor “We may be subject to federal and state healthcare laws and regulations. If we are unable to comply or have not fully complied with such laws and regulations, we could face criminal sanctions, damages, substantial civil penalties, reputational harm and diminished profits and future earnings” of this Quarterly Report on Form 10-Q.
Our failure to comply with data protection laws and regulations could lead to government enforcement actions and significant penalties against us, and adversely impact our operating results.
We are subject to U.S. data protection laws and regulations, for example, laws and regulations that address privacy and data security, at both the federal and state levels. The legislative and regulatory landscape for data protection continues to evolve, and in recent years there has been an increasing focus on privacy and data security issues. Numerous federal and state laws, including state data breach notification laws, state health information privacy laws, state genetic privacy laws, and federal and state consumer protection laws, including, for example, Section 5 of the Federal Trade Commission Act of 1914, as amended, and the CCPA, govern the collection, use, and disclosure and protection of certain health-related and other personal information. Failure to comply with data protection laws and regulations could result in government enforcement actions and create liability for us, which could include civil and/or criminal penalties, private litigation and/or adverse publicity that could negatively affect our operating results and business. In addition, we may obtain health information from third parties, such as research institutions with which we collaborate, that are subject to privacy and security requirements under HIPAA. Although we are not directly subject to HIPAA, other than potentially with respect to providing certain employee benefits, we could be subject to criminal penalties if we knowingly obtain or disclose individually identifiable health information maintained by a HIPAA covered entity in a manner that is not authorized or permitted by HIPAA. In addition, state laws govern the privacy and security of health, research and genetic information in specified circumstances, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Some of our research activities involve minors, which may be subject to additional laws and can require specialized consent processes, privacy protections, and compliance procedures.
EU member states, Switzerland and other countries have also adopted data protection laws and regulations, which impose significant compliance obligations. In the EU, the collection and use of personal data, including health and genetic data, is governed by the provisions of the General Data Protection Regulation, or GDPR. The GDPR became effective on