In the ordinary course of our business, we and our CROs and other service providers collect, store and otherwise process petabytes of sensitive data, including legally protected health information, personal information, intellectual property and proprietary business information owned or controlled by ourselves or our strategic partners. We manage and maintain our applications and data by using a combination of on-site systems, managed data center systems and cloud-based data center systems. These applications and data encompass a wide variety of business-critical information, including research and development information, commercial information and business and financial information. We face four primary risks relative to protecting this critical information: loss of access risk, inappropriate disclosure risk, inappropriate modification risk and the risk of being unable to adequately monitor our controls over the first three risks.
Although we take measures designed to protect sensitive information from unauthorized access or disclosure, our information technology and infrastructure and those that our CROs and our other third-party service providers may use in the past have been subject to, and may be vulnerable to, attacks by hackers or other third parties, viruses, ransomware or other malicious code, or other breaches, incidents, outages, interruptions, compromises or vulnerabilities due to inadvertent or intentional actions by our employees, contractors, business partners, and/or other third parties, or from cyber-attacks by malicious third parties (including supply chain cyber-attacks or the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering and other means to affect service reliability and threaten the confidentiality, integrity and availability of systems or information). The risks of these types of incidents and other matters occurring may be heightened in connection with geopolitical events. Any such breach, incident, outage, interruption, compromise or vulnerability could compromise systems and networks used in our business and lead to system and other operational outages, interruptions and disruptions and the loss, destruction, alteration, prevention of access to, disclosure, or dissemination of, or damage or unauthorized access to, our data (including trade secrets or other confidential information, intellectual property, proprietary business information, and personal information) or data that is maintained or otherwise processed on our behalf, or other assets, which could result in financial, legal, business and reputational harm to us. Any such event could result in legal claims, demands and litigation or governmental investigations or other proceedings, liability under laws that protect the privacy of personal information, such as the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), and regulatory penalties and other liabilities. Although we have implemented security measures and a formal enterprise security program designed to prevent unauthorized access to sensitive data, and make use of third-party service providers to perform certain operational and security functions on our behalf,there is no guarantee that we or our third-party service providers can, or have been able to, protect our systems or networks or other systems or networks used in our business from security breaches, incidents, outages, interruptions, compromises, or vulnerabilities, or that we or they have been or will be able to identify, identify the cause of or otherwise respond to any actual or potential security breach, incident, outage, interruption, compromise or vulnerability. We have engaged in efforts to improve our security measures, and we expect to continue to incur additional expenses in further efforts to do so, whether in response to actual or perceived security breaches or incidents, compromises, outages, interruptions, vulnerabilities or otherwise. Any loss, destruction, alteration, prevention of access to, disclosure, or dissemination of, or damage or unauthorized access to, our data or other data that is processed or maintained on our behalf could also disrupt our operations (including our ability to conduct our analyses, pay providers, conduct research and development activities, collect, process and prepare company financial information, provide information about any future products, and manage the administrative aspects of our business) and damage our reputation, any of which could adversely affect our business.
HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and its implementing regulations, impose certain requirements relating to the privacy, security, transmission and breach reporting of individually identifiable health information. Penalties for HIPAA violations can be significant, and criminal and monetary penalties, as well as injunctive relief, may be imposed for HIPAA violations. Most drug manufacturers are not directly subject to HIPAA, but prosecutors increasingly are using HIPAA-related theories of liability against drug manufacturers and their agents and we also could be subject to criminal penalties if we knowingly obtain individually identifiable health information from a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA.
Furthermore, HIPAA regulations impose specific reporting requirements to regulators, individuals impacted by the breach, as defined by HIPAA, and, in some cases, the media. Issuing such notifications can be costly, time and resource intensive, and can generate significant negative publicity. In addition to HIPAA, other applicable data privacy and security obligations may require us to notify relevant stakeholders of any security breaches or incidents that result in the unauthorized disclosure, or dissemination of, personal information. Such disclosures are costly, and the disclosures or the failure to comply with such requirements, could lead to adverse impacts.
Furthermore, the loss, corruption, or unavailability of clinical trial data from completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Likewise, we rely on other third parties for the manufacture of our product candidates and to conduct clinical trials, and similar events relating to their computer systems or otherwise relating to their collection, storage, or processing of data could also have a material adverse effect on our business.