candidate in a particular country, but then be subject to price regulations that delay commercial launch of the product candidate, possibly for lengthy time periods, and negatively impact the revenue that is generated from the sale of the product in that country. If reimbursement of such product candidates is unavailable or limited in scope or amount, if pricing is set at unsatisfactory levels, or if there is competition from lower priced cross-border sales, our profitability will be negatively affected.
Security breaches and incidents, loss of data and other disruptions could compromise sensitive information related to our business or protected health information or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation.
In the ordinary course of our business, we and our CROs and other service providers collect, store and otherwise process petabytes of sensitive data, including legally protected health information, personal information, intellectual property and proprietary business information owned or controlled by ourselves or our strategic partners. We manage and maintain our applications and data by utilizing a combination of on-site systems, managed data center systems and cloud-based data center systems. These applications and data encompass a wide variety of business-critical information, including research and development information, commercial information and business and financial information. We face four primary risks relative to protecting this critical information: loss of access risk, inappropriate disclosure risk, inappropriate modification risk and the risk of being unable to adequately monitor our controls over the first three risks.
Although we take measures designed to protect sensitive information from unauthorized access or disclosure, our information technology and infrastructure and those of our CROs and our other third-party service providers may utilize may be vulnerable to attacks by hackers or viruses or breached, interrupted or compromised due to inadvertent or intentional actions by our employees, contractors, business partners, and/or other third parties, or from cyber-attacks by malicious third parties (including supply chain cyber-attacks or the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering and other means to affect service reliability and threaten the confidentiality, integrity and availability of information). Any such breach, incident, or interruption could compromise systems and networks used in our business and lead to the loss, destruction, alteration, prevention of access to, disclosure, or dissemination of, or damage or unauthorized access to, our data (including trade secrets or other confidential information, intellectual property, proprietary business information, and personal information) or data that is processed or maintained on our behalf, or other assets, which could result in financial, legal, business and reputational harm to us. Any such event could result in legal claims, demands and litigation or governmental investigations or other proceedings, liability under laws that protect the privacy of personal information, such as the Health Insurance Portability and Accountability Act of 1996, or HIPAA, and regulatory penalties and other liabilities. Although we have implemented security measures and a formal enterprise security program designed to prevent unauthorized access to sensitive data, there is no guarantee that we or our third-party service providers can protect our systems or networks or other systems or networks used in our business from security breaches, incidents, or compromises. Any loss, destruction, alteration, prevention of access to, disclosure, or dissemination of, or damage or unauthorized access to, our data or other data that is processed or maintained on our behalf could also disrupt our operations (including our ability to conduct our analyses, pay providers, conduct research and development activities, collect, process and prepare company financial information, provide information about any future products, and manage the administrative aspects of our business) and damage our reputation, any of which could adversely affect our business.
HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, and its implementing regulations, impose certain requirements relating to the privacy, security, transmission and breach reporting of individually identifiable health information upon entities subject to the law, such as health plans, healthcare clearinghouses and healthcare providers and their respective business associates and subcontractors that perform services for them that involve individually identifiable health information. Mandatory penalties for HIPAA violations can be significant, and criminal and monetary penalties, as well as injunctive relief, may be imposed for HIPAA violations. Although most drug manufacturers are not directly subject to HIPAA, prosecutors are increasingly using HIPAA-related theories of liability against drug
S-29