We increasingly rely on information technology systems, including cloud-based computing, to process, transmit and store electronic information for our day-to-day operations and for our customers, including sensitive personal information and proprietary or confidential information. Additionally, certain of our products collect data regarding patients and donors and connect to our systems for maintenance and other purposes or are actively managed by Haemonetics on behalf of specific customers. Similar to other large multi-national companies, the size and complexity of our information technology systems makes them vulnerable to a cyber-attack, malicious intrusion, breakdown, destruction, loss of data privacy, or other significant disruption. We also outsource certain elements of our information technology systems to third parties that, as a result of this outsourcing, could have access to certain confidential information and whose systems may also be vulnerable to these types of attacks or disruptions. While we conduct security risk assessments prior to engaging third party suppliers and other vendors and business partners to validate that they maintain appropriate safeguards to protect our and their information systems in connection with the services they provide, it is possible that they suffer a cyber-attack that impacts us. Security threats, including cyber and other attacks are becoming increasingly sophisticated, frequent, and adaptive and, like other large multi-national companies, we have experienced cyber incidents in the past and may experience them in the future. Accordingly, our information systems require an ongoing commitment of significant resources to maintain, protect and enhance existing systems and develop new systems to keep pace with continuing changes in information processing technology, evolving systems and regulatory standards, the increasing need to protect patient and customer information and changing customer patterns. Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operation or financial condition. While we have invested and continue to invest in the protection of personal information and proprietary or confidential information, there can be no assurance that our efforts will prevent cyber-attacks, intrusions, breakdowns or other incidents or ensure compliance with all applicable securities and privacy laws, regulations, standard standards. In addition, third parties may attempt to hack into our products to obtain data relating to patients with our products or our proprietary information. Emerging technologies such as generative AI may be used by malicious actors to create more targeted phishing narratives or otherwise strengthen social engineering capabilities, which may increase our threat landscape. Any failure by us or third parties we work with to maintain or protect our respective information technology systems and data integrity, including from cyber-attacks, intrusions or other breaches, could result in the unauthorized access to patient data and personally identifiable information, theft of intellectual property or other misappropriation of assets, or otherwise compromise our confidential or proprietary information and disrupt our operations. Any of these events, in turn, may cause us to lose existing customers, have difficulty preventing, detecting and controlling fraud, have disputes with customers, physicians and other healthcare professionals, be subject to legal claims and liability, have regulatory sanctions or penalties imposed, have increases in operating expenses, incur expenses or lose revenues as a result of a data privacy breach or theft of intellectual property, or suffer other adverse consequences, any of which could have a material adverse effect on our business, financial condition or results of operations.
Additionally, the legal and regulatory environment surrounding information security and privacy is increasingly demanding, with the imposition of new and changing requirements across businesses, including rules requiring timely public disclosure of cybersecurity incidents. We are required to comply with increasingly complex and changing legal and regulatory requirements that govern the collection, use, storage, security, transfer, disclosure and other processing of personal data in the United States and in other countries, including, but not limited to, HIPAA, HITECH, the California Consumer Privacy Act, or CCPA, the California Privacy Rights Act, and the EU's General Data Protection Regulation, or GDPR. The GDPR imposes stringent EU data protection requirements and provides for significant penalties for noncompliance. HIPAA also imposes stringent data privacy and security requirements and the regulatory authority has imposed significant fines and penalties on organizations found to be out of compliance. CCPA provides consumers with a private right of action against companies who have a security breach due to lack of appropriate security measures, and several other U.S. states have introduced or proposed similar privacy laws which may apply to us directly or indirectly through our customers, manufacturers, suppliers or other third-party partners. In addition, new information security and privacy laws have also come into effect in China and other countries where we conduct business. We or our third-party providers and business partners may also be subjected to audits or investigations by one or more domestic or foreign government agencies relating to compliance with information security and privacy laws and regulations, and noncompliance with the laws and regulations could results in material fines or litigation.