The appropriate privacy and security of personal information whether stored, maintained, received or transmitted electronically or in paper form is a key regulatory issue in the United States and abroad. While we strive to comply with all applicable privacy and security laws and regulations, as well as our posted privacy policies, legal standards for privacy, including but not limited to "unfairness" and "deception," as enforced by the FTC and state attorneys general, continue to evolve and any failure or perceived failure to comply may result in proceedings or actions against us by government entities or others, or could cause us to lose audience and customers, which could have a material adverse effect on our business. Recently, there has been an increase in public awareness of privacy issues in the wake of revelations about the activities of various government agencies and in the number of private privacy-related lawsuits filed against companies. Concerns about our practices with regard to the collection, use, disclosure, security or deletion of personal information or other privacy-related matters, even if unfounded and even if we are in compliance with applicable laws, could damage our reputation and harm our business.
Numerous foreign, federal and state laws and regulations govern collection, dissemination, use and confidentiality of personally identifiable health information, including (i) state privacy and confidentiality laws (including state laws requiring disclosure of breaches); (ii) HIPAA; and (iii) European and other foreign data protection laws, including the EU GDPR and the UK GDPR.
HIPAA establishes a set of national privacy and security standards for the protection of individually identifiable health information, or protected health information, by health plans, healthcare clearinghouses and healthcare providers that submit certain covered transactions electronically, collectively referred to as "covered entities," and their "business associates," which are persons or entities that perform certain services for, or on behalf of, a covered entity that involve creating, receiving, maintaining or transmitting protected health information, as well as their covered subcontractors. Through certain portions of our business, such as the cloud-based software digital health applications, we are subject to HIPAA as a business associate of our covered entity clients. To provide our covered entity clients with services that involve access to PHI, HIPAA requires us to enter into business associate agreements that require us to safeguard PHI in accordance with HIPAA. As a business associate, we are also directly liable for compliance with HIPAA. Penalties for violations of HIPAA regulations include civil and criminal penalties.
HIPAA authorizes state attorneys' general to file suit under HIPAA on behalf of state residents. Courts can award damages, costs and attorneys' fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for HIPAA violations, its standards have been used as the basis for a duty of care claim in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI.
HIPAA further requires business associates like us to notify our covered entity clients in the event of a breach. Covered entities must notify affected individuals "without unreasonable delay and in no case later than 60 calendar days after discovery of the breach" if their unsecured PHI is subject to an unauthorized access, use or disclosure. If a breach affects 500 patients or more, covered entities must report it to HHS and local media without unreasonable delay, and HHS will post the name of the breaching entity on its public website. If a breach affects fewer than 500 individuals, the covered entity must log it and notify HHS at least annually. Breach notification obligations under business associate agreements often have shorter notification timeframes which we are required to abide by contractually. We could also face contractual liability if we fail to meet our obligations under our business associate agreements.
If we are unable to properly protect the privacy and security of health information entrusted to us, our solutions may be perceived as not secure, we may incur significant liabilities and customers may curtail their use of or stop using our solutions. In addition, if we fail to comply with the terms of our business associate agreements with our clients, we may be liable not only contractually but also directly under HIPAA.
In addition, the California Consumer Privacy Act of 2018, or CCPA, as amended by the California Privacy Rights Act (collectively, "CCPA"), became effective on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined) and provide such consumers new ways to opt-out of certain sales of personal information. The CCPA includes civil penalties for violations, as well as a private right of action for data breaches. Although the law includes limited exceptions, including for "protected health information" maintained by a covered entity or business associate, it may regulate or impact our processing of personal information depending on the context. We also expect that there will continue to be new laws, regulations and industry standards concerning privacy, data protection and information security proposed and enacted in various jurisdictions. If we are subject to other domestic privacy and data protection laws, beyond HIPAA and the CCPA, any liability from failure to comply with these laws could adversely affect our financial condition.
In addition to these comprehensive data protection laws, to date, at least three states have adopted laws specifically regulating the collection, use, storage, and disclosure of biometrics, and additional states may seek to regulate-and/or restrict the use of-biometrics in the future. Certain of our products use, or permit the use of, information that could be classified as a biometric under these or other laws. If we are subject to or affected by these or other laws, including potential damages for improper use of biometrics, we may be subject to damages claims, required to modify the way in which we make available our products or certain features of our products. More recently, the FTC and the Office for Civil Rights (OCR, the agency that enforces HIPAA) have taken interest in the use of online tracking technologies that collect, use, and disclose personal information about users, including use of online tracking tools to gather information to be used for redirected marketing. FTC has taken enforcement actions against companies that have used online tracking tools either in a misleading or deceptive manner. In response to this new area of enforcement, we have been assessing our websites and applications to assess any online tracking and to ensure compliance with privacy and security standards. We also may be required to implement additional practices or processes or otherwise invest our resources to comply with these and other regulations. If we are unable to comply with these laws, or if these laws require us to change our products or services, we may encounter liability that could adversely affect our financial condition.
We are also subject to laws and regulations in non-U.S. countries covering data privacy and the protection of health-related and other personal information. For example, EU member states, the United Kingdom, and other jurisdictions have adopted data protection laws and regulations, which impose significant compliance obligations. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure and security of personal information that identifies or may be used to identify an individual, such as names, contact information, and sensitive personal data such as health data.
These laws and regulations are subject to frequent revisions and differing interpretations and have generally become more stringent over time.
In addition, the EU GDPR and UK GDPR went into effect in May 2018. The GDPR imposes stringent data protection requirements for the processing of personal data in the EEA or UK. The GDPR imposes several stringent requirements for controllers and processors of personal data, and increased our obligations, for example, by imposing higher standards for obtaining consent from individuals to process their personal data, requiring more robust disclosures to individuals, strengthening individual data rights, shortening timelines for data breach notifications, limiting retention periods and secondary use of information (including for research purposes), increasing requirements pertaining to health data and pseudonymized (i.e., key-coded) data and imposing additional obligations when we contract with third party processors in connection with the processing of personal data. The GDPR also imposes strict rules on the transfer of personal data out of the EEA and recent legal developments in Europe have created complexity regarding such transfers of personal data from the EEA and UK to the United States. For example, the European Commission and the United Kingdom have adopted new standard contractual clauses under which entities may transfer personal data from the European Union and the United Kingdom, which we may be required to implement. We must evaluate such data transfers on a case-by-case basis to ensure continued permissibility under current law and consistent with the new standard contractual clauses. GDPR provides that EEA member states and the UK may make their own further laws and regulations limiting the processing of genetic, biometric or health data, which could limit our ability to use and share personal data or could cause our costs to increase, and harm our business and financial condition. Failure to comply with the requirements of GDPR and the applicable national data protection and marketing laws of the EEA member states may result in fines of up to €20.0 million or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, and other administrative penalties as well as individual claims for compensation. EU Member States and the UK also have established laws pertaining to electronic monitoring, which could require us to take additional compliance measures. Failure to comply with such laws may subject us to penalties.
The UK GDPR mirrors the fines under the EU GDPR, i.e., fines up to the greater of £17.5 million or 4% of global turnover.
Compliance with these and any other applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms ensuring compliance with data protection rules. Any failure or perceived failure by us to comply with privacy or security laws, policies, legal obligations or industry standards or any security incident that results in the unauthorized release or transfer of personally identifiable information may also result in governmental enforcement actions and investigations, fines and penalties, litigation and/or adverse publicity, including by consumer advocacy groups, and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business. Such failures could have a material adverse effect on our financial condition and operations. If the third parties we work with violate applicable laws, contractual obligations or suffer a security incident, such violations may also put us in breach of our obligations under privacy laws and regulations and/or could in turn have a material adverse effect on our business.