We are subject to data privacy and security laws and regulations by both the federal government and the states in which we conduct our business. HIPAA and their respective implementing regulations, including the Final Omnibus Rule published on January 25, 2013, govern our processing of personal data, including the collection, access, use, analysis, modification, storage, transfer, security breach notification, destruction and disposal of personal data. There are foreign and state law versions of these laws and regulations to which we are currently and/or may in the future, be subject. For example, the collection and use of personal health data in the European Union is governed by the GDPR. The GDPR, which is wide-ranging in scope, imposes several requirements relating to the consent of the individuals to whom the personal data relates, the information provided to the individuals, the security and confidentiality of the personal data, data breach notification and the use of third-party processors in connection with the processing of personal data. The GDPR also imposes strict rules on the transfer of personal data out of the European Union to the United States, provides an enforcement authority and imposes large monetary penalties for noncompliance. The GDPR requirements apply not only to third-party transactions, but also to transfers of information within our company, including employee information.
In the United States, there are numerous privacy laws that may be applicable to our activities, and a range of enforcement agencies at both the state and federal levels that can review companies for privacy and data security concerns based on general consumer protection laws. New laws also are being considered or have been implemented at both the state and federal levels. For example, the California Consumer Privacy Act of 2018 (effective on January 1, 2020), as amended by the California Privacy Rights and Enforcement Act of 2020 (effective on January 1, 2023) ("CCPA"), requires companies that process information of California residents ("consumers," as defined under the CCPA) to make specific disclosures about their data collection, use and disclosure practices, provides consumers with individual data privacy rights, including enabling consumers to limit the use of their sensitive personal information, imposes new operational requirements for covered businesses, imposes data retention limitations, provides a private right of action for data breaches, creates a statutory damages framework and creates a new state agency, the California Privacy Protection Agency, that is vested with the authority to implement and enforce the CCPA. Although there are limited exemptions for clinical trial data under the CCPA, the CCPA and other similar laws could impact our business activities in the future depending on our revenue growth, how much consumer data we process, and how such laws are interpreted. Additionally, four additional states have enacted privacy laws, which could increase our potential liability and adversely affect our business in the future. In particular, the Virginia Consumer Data Protection Act ("VCDPA") became effective on January 1, 2023; the Colorado Privacy Act ("CPA") and the Connecticut Data Privacy Act ("CTDPA") will become effective on July 1, 2023; and the Utah Consumer Privacy Act ("UCPA") will become effective on December 31, 2023. While these regulations incorporate many similar concepts to the CCPA, there are also several key differences in their scope, application, and enforcement that will, among other things, impact how regulated businesses collect and process personal sensitive data, conduct data protection assessments, transfer personal data to affiliates, and respond to consumer rights requests. Other states are considering similar legislation and a broad range of legislative measures also have been introduced at the federal level. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. The existence of comprehensive privacy laws in different states in the country makes our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance.
Further, regulations promulgated pursuant to HIPAA imposes privacy, security and breach notification obligations on certain healthcare providers, health plans, and healthcare clearinghouses, known as covered entities, as well as their business associates that perform certain services that involve creating, receiving, maintaining or transmitting individually identifiable health information for or on behalf of such covered entities, and their covered subcontractors. HIPAA establishes privacy and security standards that limit the use and disclosure of individually identifiable health information and protected health information, or PHI, and requires the implementation of administrative, physical, and technological safeguards to protect the privacy of PHI and ensure the confidentiality, integrity, and availability of electronic PHI. Most healthcare providers, including research institutions from which we obtain patient health information, are subject to privacy and security regulations promulgated under HIPAA. We do not believe that we are currently acting as a covered entity or business associate under HIPAA and thus are not directly subject to its requirements or penalties. However, any person may be prosecuted under HIPAA's criminal provisions either directly or under aiding-and-abetting or conspiracy principles. Consequently, depending on the facts and circumstances, we could face substantial criminal penalties if we knowingly receive individually identifiable health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA's requirements for disclosure of individually identifiable health information.
The global legislative and regulatory landscape for privacy and data protection continues to evolve, and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. This evolution may create uncertainty in our business, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to continue to increase in the future.
It is possible that privacy laws may be interpreted and applied in a manner that is inconsistent with our practices. Any failure or perceived failure by us to comply with federal, state, or foreign laws or self-regulatory standards could result in negative publicity, diversion of management time and effort and proceedings against us by governmental entities or others. In many jurisdictions, enforcement actions and consequences for noncompliance are rising. As we continue to expand into other foreign countries and jurisdictions, we may be subject to additional laws and regulations that may affect how we conduct business.
In addition to the risks associated with enforcement activities and potential contractual liabilities, our ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to our policies, procedures and systems. Further, any failure by our third-party collaborators, service providers, contractors or consultants to comply with applicable law, regulations or contractual obligations related to data privacy or security could result in proceedings against us by governmental entities or others.
We may also publish privacy policies and other documentation regarding our collection, processing, use and disclosure of personal information and/or other confidential information. Although we endeavor to comply with applicable regulations, our published policies and other documentation, we may at times fail to do so or may be perceived to have failed to do so. Despite our efforts, we may not be successful in achieving compliance if our employees or vendors fail to comply with our published policies and documentation. Such failures can subject us to potential international, local, state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices. Claims that we have violated individuals' privacy rights or failed to comply with data protection laws or applicable privacy notices, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business. We also face a threat of consumer class actions related to these laws and the overall protection of personal information. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our reputation and our business, financial condition, results of operations or prospects.