The integrity and protection of our own data, and that of our customers and employees, is critical to our business. We rely on information technology systems, some of which are provided and/or managed by third parties, to process, transmit and store electronic information (including sensitive data such as confidential business information and personally identifiable data relating to employees, customers, other business partners and patients), and to manage or support a variety of critical business processes and activities (such as receiving and fulfilling orders, billing, collecting and making payments, shipping products, providing services and support to customers and fulfilling contractual obligations). These systems, products and services (including those we acquire through business acquisitions) can be damaged, disrupted or shut down due to attacks by computer hackers, computer viruses, ransomware, human error or malfeasance, power outages, hardware failures, telecommunication or utility failures, catastrophes or other unforeseen events, and in any such circumstances our system redundancy and other disaster recovery planning may be ineffective or inadequate. Attacks can also target hardware, software and information installed, stored or transmitted in our products after such products have been purchased and incorporated into third-party products, facilities or infrastructure. Security breaches of systems provided or enabled by us, regardless of whether the breach is attributable to a vulnerability in our products or services, or security breaches of third party systems we rely on to process, store or transmit electronic information, can result in the misappropriation, destruction or unauthorized disclosure of confidential information or personal data belonging to us or to our employees, partners, customers, patients or suppliers. These attacks, breaches, misappropriations and other disruptions and damage can interrupt our operations or the operations of our customers and partners, delay production and shipments, result in theft of our and our customers' intellectual property and trade secrets, result in disclosure of personally identifiable information, damage customer, patient, business partner and employee relationships and our reputation and result in defective products or services, legal claims and proceedings, liability and penalties under privacy laws and increased costs for security and remediation, in each case resulting in an adverse effect on our business and financial results.
In addition, our information technology systems require an ongoing commitment of significant resources to maintain and enhance existing systems and develop or integrate new systems to keep pace with continuing changes in information processing technology, evolving legal and regulatory standards, evolving customer expectations, changes in the techniques used to obtain unauthorized access to data and information systems, and the information technology needs associated with our changing products and services. There can be no assurance that we will be able to successfully maintain, enhance and upgrade our systems as necessary to effectively address these requirements.
If we are unable to maintain reliable information technology systems or appropriate controls with respect to global data privacy and security requirements and prevent data breaches, we may suffer regulatory consequences in addition to business consequences. As a global organization, we are subject to data privacy and security laws, regulations, and customer-imposed controls in numerous jurisdictions as a result of having access to and processing confidential, personal and/or sensitive data in the course of our business. For example, in the United States, a small number of our businesses are subject to HIPAA. Entities that violate HIPAA due to a breach of unsecured patient health information, or that arise from a complaint about privacy practices or an audit by the HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. Individual states regulate data breach and security requirements, and multiple governmental bodies assert authority over aspects of the protection of personal privacy. Most notably, in the last several years, some states, including California, Virginia, Utah, Colorado and Connecticut, have passed broad privacy legislation that could result in more material impacts as implementing regulations are issued. European laws require us to have an approved legal mechanism to transfer personal data out of Europe. Failure to comply with the requirements of GDPR and the applicable national data protection laws of the EU member states may result in fines of up to €20 million or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, and other administrative penalties. Several other countries such as China and Russia have passed, and other countries are considering passing, laws that require personal data relating to their citizens to be maintained on local servers and impose additional data transfer restrictions. Government enforcement actions can be costly and interrupt the regular operation of our business, and data breaches or violations of data privacy laws can result in fines, reputational damage and civil lawsuits, any of which may adversely affect our business, reputation and financial results.