Numerous federal, state and foreign laws and regulations govern the collection, dissemination, use, privacy, confidentiality, security, availability, and integrity of PII, including PHI. In particular, in the U.S., HIPAA establishes a set of basic national privacy and security standards for the protection of PHI by health plans, healthcare clearinghouses, and certain healthcare providers, referred to as covered entities, and the business associates with whom such covered entities contract for services, which includes us. HIPAA requires healthcare providers like us to develop and maintain policies and procedures with respect to PHI that is used or disclosed, including the adoption of administrative, physical, and technical safeguards to protect such information. HIPAA also implemented the use of standard transaction code sets and standard identifiers that covered entities must use when submitting or receiving certain electronic healthcare transactions, including activities associated with the billing and collection of healthcare claims.
HIPAA imposes mandatory penalties for certain violations. However, a single breach incident can result in violations of multiple standards, which could result in significant fines. HIPAA also authorizes state attorneys general to file suit on behalf of their residents. Courts will be able to award damages, costs, and attorneys' fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. Any such penalties or lawsuits could harm our business, financial condition, results of operations, and reputation.
In addition, HIPAA mandates that the Secretary of HHS conduct periodic compliance audits of HIPAA-covered entities or business associates for compliance with the HIPAA Privacy and Security Standards. It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the Civil Monetary Penalty fine paid by the violator.
HIPAA further requires that patients be notified of any unauthorized acquisition, access, use or disclosure of their unsecured PHI that has more than a low probability of compromising the privacy or security of such information, with certain exceptions related to unintentional or inadvertent use or disclosure by employees or authorized individuals. HIPAA specifies that such notifications must be made "without unreasonable delay and in no case later than 60 calendar days after discovery of the breach." If a breach affects 500 patients or more, it must be reported to HHS without unreasonable delay, and HHS will post the name of the breaching entity on its public website. Breaches affecting 500 patients or more in the same state or jurisdiction must also be reported to the local media. If a breach involves fewer than 500 people, the covered entity must record it in a log and notify HHS at least annually.
Numerous other federal and state laws protect the confidentiality, privacy, availability, integrity, and security of PII, including PHI and other personal data. These laws in many cases are more restrictive than, and may not be preempted by, the HIPAA rules and may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and our Clients and potentially exposing us to additional expense, adverse publicity, and liability. In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. There are many other state-based data privacy and security laws and regulations that may impact our business. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may require us to modify our data processing practices and policies, divert resources from other initiatives and projects, and could restrict the way services involving data are offered, all of which may adversely affect our business, financial condition, and results of operations. For example, U.S. states have begun to introduce more comprehensive data protection laws. The CCPA went into effect in January 2020 and established a new privacy framework for covered businesses such as ours that expands the scope of personal information and provides new privacy rights for California residents. These changes required us to modify our data processing practices and policies and incur compliance-related costs and expenses. The CCPA also provides for civil penalties for violations, as well as a private right of action for data breaches, which may increase the likelihood and cost of data breach litigation. Additionally, the CPRA went into effect on January 1, 2023 and significantly modifies the CCPA by, among other things, creating a dedicated privacy regulatory agency, requiring businesses to implement data minimization and data integrity principles, and imposing additional requirements for contracts addressing the processing of personal information. Numerous states have enacted, or are currently reviewing, legislation that is similar to the CCPA and/or CPRA. For example, the Virginia Consumer Data Protect Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and the Utah Consumer Privacy Act became effective in 2023. There are also bills that have been approved or are going through the legislative process in many more states. In 2022, a draft of the American Data Privacy and Protection Act was released and would be a comprehensive federal data privacy law that would seek to ease the burden of a patchwork of overlapping but different state laws. These changes may result in further uncertainty with respect to privacy, data protection, and information security issues and will require us to incur additional costs and expenses in an effort to comply.
New health information standards, whether implemented pursuant to HIPAA, congressional action, or otherwise, could have a significant effect on the manner in which we must handle healthcare-related data, and the cost of complying with standards could be significant. If we do not comply with existing or new laws and regulations related to PHI, we could be subject to criminal or civil sanctions and our reputation could be harmed.
Because of the extreme sensitivity of the PII we store and transmit, the security features of our technology platform are very important. If our security measures, some of which are managed by third parties, are breached or fail, unauthorized persons may be able to obtain access to sensitive Client and member data, including HIPAA-regulated PHI. As a result, our reputation could be severely damaged, adversely affecting Client and member confidence. Members may curtail their use of, or stop using, our services or our Client base could decrease, which would cause our business to suffer. In addition, we could face litigation, damages for contract breach, penalties, and regulatory actions for violation of HIPAA and other applicable laws or regulations and significant costs for remediation, notification to individuals, and for measures to prevent future occurrences. Any potential security breach could also result in increased costs associated with liability for stolen assets or information, repairing system damage that may have been caused by such breaches, incentives offered to Clients or other business partners in an effort to maintain our business relationships after a breach, and implementing measures to prevent future occurrences, including organizational changes, deploying additional personnel and protection technologies, training employees, and engaging third-party experts and consultants. While we maintain insurance covering certain security and privacy damages and claim expenses, we may not carry insurance or maintain coverage sufficient to compensate for all liability and in any event, insurance coverage would not address the reputational damage that could result from a security incident.
We outsource important aspects of the storage and transmission of Client and member information, and thus rely on third parties to manage functions that have material cybersecurity risks. We attempt to address these risks by requiring outsourcing subcontractors who handle Client and member information to sign business associate agreements and/or data processing agreements contractually requiring those subcontractors to adequately safeguard personal health data to the same extent that applies to us and in some cases by requiring such outsourcing subcontractors to undergo third-party security examinations. In addition, we periodically hire third-party security experts to assess and test our security posture. However, we cannot assure you that these contractual measures and other safeguards will adequately protect us from the risks associated with the storage and transmission of Client and members' proprietary and protected health information.
We publish statements to our members and potential members that describe how we handle and protect personal information. If federal or state regulatory authorities or private litigants consider any portion of these statements to be untrue, we may be subject to claims of deceptive practices, which could lead to significant liabilities and consequences, including, without limitation, costs of responding to investigations, defending against litigation, settling claims, and complying with regulatory or court orders. For example, we have been subject to litigation alleging improper disclosure and/or use of PII and PHI. We also engage in digital marketing which has come under additional scrutiny by the FTC and state regulators. If our practices are deemed to have been unlawful or deceptive or potentially a violation of FTC requirements, it could lead to significant liabilities and consequences including, without limitation, costs of responding to investigations, defending against litigation, including class action suits, settling claims, complying with regulatory or court orders, and managing public relations and Client and member concerns associated with such violations. For example, see Note 19. "Legal Matters," to the consolidated financial statements for additional information regarding the settlement and consent order entered into with the FTC and the related putative class-action litigations, which have resulted in certain changes to the operation of the BetterHelp business.
We also send short message service ("SMS") text messages to potential end users who are eligible to use our service through certain customers and partners. While we obtain consent from or on behalf of these individuals to send text messages, federal or state regulatory authorities or private litigants may claim that the notices and disclosures we provide, form of consents we obtain, or our SMS texting practices, are not adequate. These SMS texting campaigns are potential sources of risk for our company since they are governed by the Telephone Consumer Protection Act, which allows for private right of action and class action lawsuits and is enforced by the Federal Communications Commission. Numerous class action suits under federal and state laws have been filed against companies that conduct SMS texting programs, with many resulting in multi-million-dollar settlements for the plaintiffs. Any such future litigation against us could be costly and time-consuming to defend.
Further, there are numerous foreign laws, regulations and directives regarding privacy and the collection, storage, transmission, use, processing, disclosure, and protection of PII and other personal or customer data, the scope of which is continually evolving and subject to differing interpretations. We must comply with such laws, regulations, and directives and we may be subject to significant consequences, including penalties and fines, for our failure to comply. Failure to comply with the requirements of the GDPR and the applicable national data protection laws of the EU member states may result in fines of up to €10,000,000 or up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher, and other administrative penalties. To comply with the data protection rules imposed by the GDPR we may be required to put in place additional mechanisms to ensure compliance. In addition, privacy laws are developing quickly in other jurisdictions where we operate, which impose similar accountability, transparency, and security obligations. These additional privacy law obligations may be onerous and adversely affect our business, financial condition, results of operations, and prospects.
In addition, recent legal developments in Europe have created complexity and compliance uncertainty regarding certain transfers of information from the EU to the U.S. If one or more of the legal bases for transferring PII from Europe to the U.S. is invalidated, or if we are unable to transfer PII between and among countries and regions in which we operate, it could affect the manner in which we provide our services or could adversely affect our financial results. Furthermore, any failure, or perceived failure, by us to comply with or make effective modifications to our policies, or to comply with any federal, state, or international privacy, data-retention or data-protection-related laws, regulations, orders, or industry self-regulatory principles could result in proceedings or actions against us by governmental entities or others, a loss of customer confidence, damage to our brand and reputation, and a loss of customers, any of which could have an adverse effect on our business.
Finally, federal, state, and foreign legislative or regulatory bodies may enact new or additional laws and regulations concerning privacy, data-retention, and data-protection issues, including laws or regulations mandating disclosure to domestic or international law enforcement bodies, which could adversely impact our business, our brand, or our reputation with customers. For example, some countries have adopted laws mandating that PII regarding customers in their country be maintained solely in their country. Having to maintain local data centers and redesign product, service, and business operations to limit PII processing to within individual countries could increase our operating costs significantly.