17
In the United States, the CCPA, which increases the privacy protections afforded California residents, became
effective January 1, 2020.
The CCPA generally requires companies, such as us, to institute additional protections
regarding the collection, use and disclosure of certain personal information
of California residents.
Compliance
with the new obligations imposed by the CCPA depends in part on how particular regulators interpret and apply
them, and because the CCPA is relatively new,
and its implementing regulations were released in August of
2020,
there remains some uncertainty about how the CCPA will be interpreted by the courts and enforced by the
regulators. If we fail to comply with the CCPA or if regulators assert that we have failed to comply with the CCPA,
we may be subject to certain fines or other penalties and litigation,
any of which may negatively impact our
reputation, require us to expend significant resources, and harm our business.
Furthermore, California voters
approved the CPRA on November 3, 2020, which will amend and
expand the CCPA, including by providing
consumers with additional rights with respect to their personal information,
and creating a new state agency to
enforce the CCPA and the CPRA.
The CPRA will come into effect on January 1, 2023, applying to information
collected by businesses on or after January 1, 2022.
Other states, as well as the federal government, have increasingly
considered the adoption of similarly expansive
personal privacy laws, backed by significant civil penalties for non-compliance.
While we believe we have
substantially compliant programs and controls in place to comply with
the GDPR, CCPA and CPRA requirements,
our compliance with these measures is likely to impose additional costs on us,
and we cannot predict whether the
interpretations of the requirements, or changes in our practices in response
to new requirements or interpretations of
the requirements,
could have a material adverse effect on our business.
We also sell products and services that health care providers, such as physicians and dentists, use to store and
manage patient medical or dental records.
These customers, and we, are subject to laws, regulations and industry
standards, such as HIPAA and the Payment Card Industry Data Security Standards, which require the protection of
the privacy and security of those records, and our products may
also be used as part of these customers’
comprehensive data security programs, including in connection with their efforts to comply with
applicable privacy
and security laws.
Perceived or actual security vulnerabilities in our products or services,
or the perceived or actual
failure by us or our customers who use our products or services to comply
with applicable legal or contractual data
privacy and security requirements, may not only cause us significant reputational
harm, but may also lead to claims
against us by our customers and/or governmental agencies
and involve substantial fines, penalties and other
liabilities and expenses and costs for remediation.
Various
federal initiatives involve the adoption and use by health care
providers of certain electronic health care
records systems and processes.
The
initiatives include, among others, programs that incentivize physicians
and
dentists, through MIPS, to use EHR technology in accordance with certain
evolving requirements, including
regarding quality, promoting interoperability, cost and improvement activities.
Qualification for the MIPS
incentive payments requires the use of EHRs that are certified as having certain
capabilities designated in evolving
standards adopted by CMS and by the Office of the National Coordinator for Health
Information Technology
of
HHS (“ONC”).
Certain of our businesses involve the manufacture and sale
of such certified EHR systems and
other products linked to government supported incentive programs.
In order to maintain certification of our EHR
products, we must satisfy these changing governmental standards.
If any of our EHR systems do not meet these
standards, yet have been relied upon by health care providers to receive
federal incentive payments, we may be
exposed to risk, such as under federal health care fraud and abuse laws,
including the False Claims Act.
For
example, on May 31, 2017, the U.S. Department of Justice announced a $155
million settlement and 5-year
corporate integrity agreement involving a vendor of certified EHR systems, based
on allegations that the vendor, by
misrepresenting capabilities to the certifying body, caused its health care provider customers to submit false
Medicare and Medicaid claims for meaningful use incentive payments
in violation of the False Claims Act.
Moreover, in order to satisfy our customers, our products may need to incorporate increasingly complex
functionality, such as reporting functionality.
Although we believe we are positioned to accomplish this, the
effort
may involve increased costs, and our failure to implement product
modifications, or otherwise satisfy applicable
standards, could have a material adverse effect on our business.
Other health information standards, such as regulations under HIPAA, establish standards regarding electronic
health data transmissions and transaction code set rules for specific electronic
transactions, such as transactions
involving claims submissions to third party payers.
Failure to abide by these and other electronic health data