by a court or negotiated in a settlement that exceed our coverage limitations or that are not covered by our insurance, and we may not have, or be able to obtain, sufficient capital to pay such amounts.
We may be unable to adequately protect our or our vendors’ information systems from cyberattacks or other incidents, which could result in the disclosure of confidential or proprietary information, including personal data, damage our reputation, and subject us to significant financial and legal exposure.
We rely on information technology systems that we or our third-party providers operate to process, transmit, and store electronic information in our day-to-day operations. In connection with our product discovery efforts, we may collect and use a variety of personal data, such as names, mailing addresses, email addresses, phone numbers, and clinical trial information. Despite our implementation of security measures, our internal computer systems, and those of our CROs, CMOs, information technology suppliers, and other contractors and consultants are vulnerable to damage from computer viruses, cyberattacks, and other unauthorized access, natural disasters, terrorism, war, and telecommunication and electrical failures. Additionally, our security measures or those of our vendors could be breached as a result of employee theft, exfiltration, misuse, malfeasance, or unintentional events. A successful cyberattack or other data security incident could result in the theft or destruction of intellectual property, data, or other misappropriation of assets, or otherwise compromise our confidential or proprietary information and disrupt our operations. Cyberattacks could include wrongful conduct by hostile foreign governments, industrial espionage, wire fraud, and other forms of cyber fraud, the deployment of harmful malware, ransomware, denial-of-service, social engineering fraud, or other means to threaten data security, confidentiality, integrity and availability. A successful cyberattack could cause serious negative consequences for us, including, without limitation, the disruption of operations, the misappropriation of confidential business information, including financial information, trade secrets, financial loss, and the disclosure of corporate strategic plans. Although we devote resources to protect our information systems, we realize that cyberattacks are a threat, and there can be no assurance that our efforts will prevent information security breaches that would result in business, legal, financial, or reputational harm to us, or would have a material adverse effect on our results of operations and financial condition. Any failure to prevent or mitigate security breaches or improper access to, use of, or disclosure of our clinical data or patients’ personal data could result in significant liability under state (e.g., state breach notification laws), federal (e.g., HIPAA, as amended by HITECH), and international law (e.g., the GDPR) and may cause a material adverse impact to our reputation, affect our ability to conduct new studies and potentially disrupt our business.
We rely on our third-party providers to implement effective security measures and identify and correct for any such failures, deficiencies or breaches. If we or our third-party providers fail to maintain or protect our information technology systems and data integrity effectively or fail to anticipate, plan for, or manage significant disruptions to our information technology systems, we or our third-party providers could have difficulty preventing, detecting, and controlling such cyberattacks and any such attacks could result in the losses described above as well as disputes with physicians, patients and our partners, regulatory sanctions, or penalties, increases in operating expenses, expenses or lost revenues or other adverse consequences, any of which could have a material adverse effect on our business, results of operations, financial condition, prospects, and cash flows. Any failure by such third parties to prevent or mitigate security breaches or improper access to or disclosure of such information could have similarly adverse consequences for us. If we are unable to prevent or mitigate the impact of such security or data privacy breaches, we could be exposed to litigation and governmental investigations, which could lead to a potential disruption to our business.
We also cannot be certain that our existing insurance coverage will cover any claims against us relating to any security incident or breach, will be available in sufficient amounts to cover the potentially significant losses that may result from a security incident or breach, will continue to be available on acceptable terms or at all or that the insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could adversely affect our reputation, business, financial condition, and results of operations.