unavailable or limited in scope or amount, or if pricing is set at unsatisfactory levels, our business could be harmed, possibly materially.
We are subject to stringent and evolving U.S. and foreign laws, regulations, rules, industry standards, contractual obligations, policies and other obligations related to data security and privacy. Our actual or perceived failure to comply with such obligations could lead to government enforcement actions, which could include civil, criminal or administrative penalties, litigation (including class claims) and arbitration demands, fines and penalties, disruptions of our business operations, reputational harm, adverse publicity, and/or and other adverse business consequences and could negatively affect our operating results and business, financial condition, results of operations and prospects.
In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, processing) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, and financial information.
The global data protection landscape is rapidly evolving, and we are or may become subject to or be affected by evolving federal, state and foreign data protection laws and regulations, such as laws and regulations that address privacy and data security. In the United States, numerous federal and state laws and regulations, including federal and state health information privacy laws, state data breach notification laws, and federal and state consumer protection laws, such as Section 5 of the Federal Trade Commission Act, govern the collection, use, disclosure and protection of health information and other personal information and could apply to our operations. These laws and regulations are subject to differing interpretations and may be inconsistent among jurisdictions, and guidance on implementation and compliance practices are often updated or otherwise revised, which adds to the complexity of processing personal information. HIPAA, as amended by HITECH, imposes, among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information. We do not believe that we are currently acting as a covered entity or business associate under HIPAA and thus are not directly subject to its requirements or penalties. However, we may obtain health information from third parties, including research institutions from which we obtain clinical trial data, that are subject to privacy and security requirements under HIPAA. Depending on the facts and circumstances, we could face substantial criminal penalties if we knowingly receive individually identifiable health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA’s requirements for disclosure of individually identifiable health information.
In the past few years, numerous U.S. states—including California, Virginia, Colorado, Connecticut, and Utah—have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services.
Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CPRA”), (collectively, “CCPA”) applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines of up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA exempts some data processed in the context of clinical trials, the CCPA increases compliance costs and potential liability with respect to other personal data we maintain about California residents. Similar laws are being considered in several other