In the ordinary course of our business, we collect and store sensitive data, including personally identifiable information, intellectual property and proprietary business information owned or controlled by ourselves and other parties. We manage and maintain our applications and data utilizing a combination of on-site systems, managed data centers and cloud-based data centers. We utilize external security and infrastructure vendors to manage our information technology systems and data centers. These applications and data encompass a wide variety of business-critical information, including research and development information, commercial information, and business and financial information. We face a number of risks relative to protecting this critical information, including loss of access or disruptions to our IT systems, inappropriate use or disclosure of protected information, inappropriate modification, and the risk of our being unable to adequately monitor, audit and modify our controls over our critical information. This risk extends to the third-party vendors and subcontractors we use to manage this sensitive data.
The secure processing, storage, maintenance and transmission of this critical information are vital to our operations and business strategy. Although we take measures to protect sensitive data from unauthorized access, use or disclosure, including the development of policies and procedures to protect our information technology systems and confidential and proprietary information, there is no guarantee we can protect our data from data security incidents, and our information technology and infrastructure may be vulnerable to attacks by hackers or viruses or breached due to employee or vendor error, malfeasance or other malicious or inadvertent disruptions from internal or external threats. Any such breach or interruption could compromise our networks and the information stored there could be accessed by unauthorized parties, manipulated, publicly disclosed, lost or stolen. Any such access, breach or other loss of information could result in legal claims or proceedings, and liability under federal or state laws that protect the privacy of personal information, such as HIPAA, HITECH, and regulatory penalties. Notice of breaches must be made to affected individuals, the Secretary of the Department of Health and Human Services, and notice may need to be made to the media or other data protection regulators. Such incidents, and the publicity they may generate, could harm our reputation and our ability to compete. Unauthorized access, loss or dissemination could also damage our reputation or disrupt our operations, including our ability to conduct our analyses, process claims and appeals, conduct research and development activities, collect, process and prepare company financial information, provide information about our tests and other patient and physician education and outreach efforts through our website, and manage the administrative aspects of our business.
Penalties for violations of these laws vary. For instance, penalties for failure to comply with a requirement of HIPAA and HITECH vary significantly and include civil monetary penalties of up to (as recently adjusted for inflation) $55,910 per violation, not to exceed approximately $1.68 million per calendar year for each provision of HIPAA that is violated and, in certain circumstances, criminal penalties with fines up to $250,000 per violation and/or imprisonment. However, a single breach incident can result in multiple violations, which can lead to significant financial penalties. In addition, numerous breach incidents could lead to possible penalties in excess of $1.68 million. A person who knowingly obtains or discloses individually identifiable health information in violation of HIPAA may face a criminal penalty of up to $50,000 and up to one-year imprisonment. The criminal penalties increase if the wrongful conduct involves false pretenses or the intent to sell, transfer or use identifiable health information for commercial advantage, personal gain or malicious harm.
Further, various states, such as California and Massachusetts, have implemented similar privacy laws and regulations, such as the California Confidentiality of Medical Information Act, that impose restrictive requirements regulating the use and disclosure of health information and other personally identifiable information. These laws and regulations are not necessarily preempted by HIPAA, particularly if a state affords greater protection to individuals than HIPAA. Where state laws are more protective, we have to comply with the stricter provisions. In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. California's patient privacy laws, for example, provide for penalties of up to $250,000 and permit injured parties to sue for damages. The interplay of federal and state laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and data we receive, use and share, potentially exposing us to additional expense, adverse publicity and liability.
Further, as regulatory focus on privacy issues continues to increase and laws and regulations concerning the protection of personal information expand and become more complex, these potential risks to our business could intensify. Moreover, privacy and cybersecurity laws and regulations are evolving, and may continue to add additional compliance costs and legal risks. For example, the California legislature passed the CCPA, which came into effect January 1, 2020. The CCPA requires companies doing business in California to disclose information regarding the collection, use and sharing of a consumer's personal data, and comply with certain qualified privacy rights requests, including rights to request deletion of or to stop the sale of their personal information. While the CCPA includes certain exemptions for data protected by HIPAA or in certain research contexts, the law covers a wide range of data we may process in other contexts. The CCPA also permits the imposition of civil penalties and expands existing state security laws by providing a private right of action for consumers in certain circumstances where consumer data is subject to a breach. Interpretations of the CCPA may continue to evolve with regulatory guidance and enforcement actions from the California Attorney General. The CPRA, which expands the CCPA, passed in November 2020. The CPRA will, among other things, impose additional data protection obligations on companies doing business in California, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It has also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. That rulemaking process is ongoing. Following the CPRA, Virginia, Colorado, Utah and Connecticut have enacted similar, but not completely consistent, comprehensive privacy legislation that will also go into effect in January and July 2023, respectively. Many other states are considering similar legislation in addition to the consideration of comprehensive privacy legislation at the federal level. If passed, such laws will require additional resources to ensure compliance, and may have potentially conflicting requirements that would make compliance challenging.
Compliance with U.S. and international data protection laws and regulations could cause us to incur substantial costs or require us to change our business practices and compliance procedures in a manner adverse to our business. Moreover, complying with these various laws could require us to take on more onerous obligations in our contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability to operate in certain jurisdictions. We have policies and procedures in place, and have conducted an independent third-party audit, to support our compliance with all applicable data protection laws and regulations, and are continually improving our data protection program to address compliance risks and evolving requirements. Nevertheless, our efforts to comply with data protection laws and evaluate as well as oversee our third party vendors' compliance with data protection laws and our contractual requirements may be insufficient to mitigate all data protection risks or compliance obligations, which could result in regulatory scrutiny, legal liability, reputational risk or operational disruption. Failure by us or by our third-party vendors to comply with U.S. and international data protection laws and regulations could result in government enforcement actions (which could include civil or criminal penalties), private litigation and/or adverse publicity and could negatively affect our operating results and business. Claims that we or our third-party vendors have violated individuals' privacy rights, failed to comply with data protection laws, or breached our contractual obligations, even if we or our third-party vendor, as applicable, are not found liable, could be expensive and time consuming to defend and could result in adverse publicity that could harm our business.