Company: TEM
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000950170-25-025603
Chunk: 107

Company: Tempus AI, Inc.
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1
Chunk 107
---
, “process”) personal data and other sensitive information, including large amounts of personal health and financial information, proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials, and sensitive third-party data. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. 

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, imposes specific requirements relating to the privacy, security, and transmission of individually identifiable protected health information.

HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, or HITECH, establishes a set of national privacy and security standards for the protection of PHI by health plans, healthcare clearinghouses, and certain healthcare providers that submit certain covered transactions electronically, or ‘‘covered entities,’’ and their ‘‘business associates,’’ which are persons or entities that perform certain services for, or on behalf of, a covered entity that involve creating, receiving, maintaining or transmitting PHI, and their covered subcontractors. We are a covered entity under HIPAA, and also routinely receive large amounts of PHI as a business associate under HIPAA, and therefore must comply with its requirements to protect the privacy and security of health information and must provide individuals with certain rights with respect to their health information. If we engage a business associate to help us carry out healthcare activities and functions, we must have a written business associate contract or other arrangement with the business associate that establishes specifically what the business associate has been engaged to do and requires the business associate to comply with the same requirements. 

Penalties for violations of these laws vary. For instance, a single breach incident can result in findings of violations of multiple HIPAA provisions. Penalties for failure to comply with a requirement of HIPAA and HITECH vary significantly, and include civil monetary penalties for each provision of HIPAA that is violated and, in certain circumstances, criminal penalties, including imprisonment and/or additional fines. A person who knowingly obtains or discloses individually identifiable health