Company: CNTB
Filing Date: 2025-05-15
Form Type: 10-Q
Source: 0001835268-25-000035
Chunk: 60

Company: Connect Biopharma Holdings Ltd
Filing Date: 2025-05-15
Form: 10-Q
Item: Part I, Item 8
Chunk 60
---
, and there has been an increasing focus on privacy and data protection issues with the potential to affect our business. Complying with such requirements can be difficult, time-consuming, expensive, and could require us to change our business practices and put in place additional compliance mechanisms. Failure to comply with laws, regulations and 

23

contractual and other obligations governing personal or other sensitive information could result in enforcement actions against us, including fines, public censure, processing penalties, claims for damages by affected individuals, damage to our reputation and loss of goodwill. It is possible that new and existing laws may be interpreted and applied in a manner that is inconsistent with our practices and our efforts to comply with the evolving data protection rules may be unsuccessful.

In the U.S., the Health Information Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations, or collectively HIPAA, imposes, among other things, specific standards relating to the privacy, security, transmission and breach reporting of protected health information. Most healthcare providers, including research institutions from which we obtain patient’s protected health information, are subject to privacy and security regulations promulgated under HIPAA. While we do not believe that we are currently acting as a “covered entity” or “business associate” under HIPAA and thus are not directly regulated under HIPAA, any person may be prosecuted under HIPAA’s criminal provisions either directly or under aiding-and-abetting or conspiracy principles. Consequently, depending on the facts and circumstances, we could face substantial criminal penalties if we knowingly receive protected health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA’s requirements for disclosure of individually identifiable health information.

Numerous states have also adopted data privacy and security laws and regulations, which govern the privacy, processing and protection of consumer health-related information and other personal information. Such laws and regulations are subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the California Consumer Privacy Act of 2018 went into effect on January 1, 2020 and was amended by the California Privacy Rights Act on January 1, 2023 (as amended, the “CPRA”). The CPRA creates individual privacy rights for California consumers and increases the privacy and security obligations of entities handling specific personal information. It also provides a private right of action for data breaches which has increased the likelihood of, and risks associated with, data breach