We are, and may in the future be, subject to stringent and changing obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse business consequences.
In the ordinary course of business, we collect, receive, store, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share and otherwise process (which we refer to as process or processing) certain personal information and other sensitive information, including our proprietary and confidential business data, trade secrets, employee data, intellectual property, data we or our CROs collect about trial participants in connection with clinical trials, and other sensitive data. The global data protection landscape is rapidly evolving and we are and may increasingly become subject to numerous data privacy and security obligations, such as various state, federal and foreign laws, regulations, guidance, directives, industry standards, external and internal privacy and security policies, contractual requirements and other obligations that govern the processing of sensitive or confidential information by us and on our behalf, and we may be subject to new or additional data protection laws and regulations and face increased scrutiny from regulators as our business grows. The legislative and regulatory landscape for data privacy and security continues to evolve in jurisdictions worldwide, and there has been an increasing focus on these issues with the potential to affect our business, financial condition, results of operations and prospects.
Various federal, state, local and foreign legislative and regulatory bodies, or self-regulatory organizations, may expand current laws, rules or regulations, enact new laws, rules or regulations or issue revised rules or guidance regarding data privacy and security that could result in regulatory investigations, fines or injunctions, as well as civil claims including class actions, and reputational damage. Implementation standards, interpretation, and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business. This evolution may create uncertainty in our business, affect our ability to operate in certain jurisdictions or to process personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, our internal or external policies and procedures or our contracts governing our processing of personal information could result in negative publicity, government investigations and enforcement actions, claims by third parties and damage to our reputation, any of which could have a material adverse effect on our business, financial condition, results of operations and prospects.
In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, data privacy laws, and other similar laws. For example, all 50 states and the District of Columbia have enacted breach notification laws that may require us to notify patients, customers, employees or regulators in the event of unauthorized access to or disclosure of personal or confidential information experienced by us or our service providers. These laws are not consistent, and compliance in the event of a widespread data breach is difficult and may be costly. Moreover, HIPAA, as amended by HITECH, imposes among other things, certain requirements relating to the privacy, security, transmission, and breach of individually identifiable health information. We may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA. Depending on the facts and circumstances, we could be subject to significant penalties if we violate HIPAA.
Certain states have also adopted comparable privacy and security laws and regulations, which govern the processing of health-related and other personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020), or CCPA, imposes obligations on businesses that meet certain thresholds that process the personal information of California residents (including employees based in California). These obligations include, but are not limited to, providing specific disclosures in privacy notices and affording California residents certain rights related to their personal information, which includes a private right of action for certain data breaches. Although the CCPA exempts some data processed in the context of clinical trials, the CCPA could increase compliance costs and potential liability. The 2020 amendments to the CCPA also created the California Privacy Protection Agency, a new enforcement agency whose sole responsibility is to enforce the CCPA and is empowered to create new CCPA regulations. Other states, such as Virginia, Indiana, Oregon, Texas, Tennessee, Montana, Iowa, Delaware, Connecticut, Utah, Washington and Colorado, have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels. In addition to government activity and private rights of actions provided by some of the state privacy laws, privacy advocacy groups and technology and other industries are considering various new, additional or different self-regulatory standards that may place additional burdens on us.