Company: HRTX
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-028374
Chunk: 27

Company: HERON THERAPEUTICS, INC. /DE/
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 27
---
 and we incurred no costs in 2024, 2023 or 2022 associated with legal or regulatory fines or settlements associated with violations of bribery, corruption or anti-competitive standards.

Patient Privacy and Data Security

We are required to comply, as applicable, with numerous federal and state laws, including state security breach notification laws, state health and personal information privacy laws and federal and state consumer protection laws, and to govern the collection, use and disclosure of personal information. For example, the California Consumer Privacy Act (“CCPA”) became effective on January 1, 2020 and gave California residents expanded rights to access and request deletion of their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. Additionally, the California Privacy Rights Act, a ballot measure that was approved by California voters on November 3, 2020 and became operative on January 1, 2023, amends and expands the CCPA and its accompanying obligations, including through yet-to-be-finalized implementing regulations from a new enforcement agency, the California Privacy Protection Agency. Other states, such as Virginia and Colorado, have also passed comprehensive data privacy and security laws, and similar laws are being considered in several other states, as well as the federal and local levels. Other countries also have developed, or are developing, laws governing the collection, use and transmission of personal information, such as the General Data Protection Regulation in the EU that became effective in May 2018 and the Personal Information Protection and Electronic Documents Act that became effective in Canada in April 2000. In addition, most healthcare providers who utilize our Products or who may utilize other products we may sell in the future are subject to privacy and security requirements under the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology and Clinical Health Act, and its implementing regulations (collectively, “HIPAA”). We are not a HIPAA covered entity, do not intend to become one, and we do not operate as a business associate to any covered entities. Therefore, these privacy and security requirements do not apply to us. However, we could be subject to civil and criminal penalties if we knowingly obtain individually identifiable or protected health information from a covered entity in a manner that is not authorized or permitted by HIPAA or for aiding and abetting the violation of HIPAA. The legislative and regulatory landscape for privacy and data protection continues to evolve, and there has been an increasing amount of focus on privacy and data protection issues with the potential