Company: PHR
Filing Date: 2025-12-09
Form Type: 10-Q
Source: 0001412408-25-000132
Chunk: 238

Company: Phreesia, Inc.
Filing Date: 2025-12-09
Form: 10-Q
Item: Part I, Item 8
Chunk 238
---
 websites or otherwise, and to regulate the presentation of website content. The FTC has authority to initiate enforcement actions against entities that mislead customers about HIPAA compliance, make deceptive statements about privacy and data sharing in privacy policies, fail to limit third-party use of personal health information, fail to implement policies to protect personal health information or engage in other unfair practices that harm customers or that may violate Section 5(a) of the FTCA, and has brought enforcement actions against companies in the healthcare space in recent years. As a result of regulatory enforcement proceedings, we may be subject to related litigation, settlements or enforcement actions that could include monetary penalties and/or compliance requirements that (1) impose significant and material costs, (2) require us to make modifications to our data practices and our marketing programs, (3) result in negative publicity, or (4) have a negative impact on consumer demand for our products and services, or on our commercial or industry relationships. Even an unsuccessful challenge of our privacy practices by our consumers, regulatory authorities or other third parties could result in negative publicity and could require a costly response from and defense by us. Any of these events could adversely affect our ability to operate our business and our financial results. 

Other federal and state laws restrict the use and protect the privacy and security of personally identifiable information, in many cases are not preempted by HIPAA and may be subject to varying interpretations by courts and government agencies. These varying interpretations can create complex compliance issues for us and our partners and potentially expose us to additional expense, adverse publicity and liability, any of which could adversely affect our business. States continue to introduce and adopt new and amended laws, regulations and industry standards concerning privacy, data protection and information security. The first of these was the CCPA, as amended by the CPRA, which amendments went into effect on January 1, 2023. The CCPA created specific obligations with respect to processing and storing personal information, and the CPRA amendments created a new state agency that is vested with authority to implement and enforce the CCPA. In addition to the CCPA, similar privacy and data security 

70

laws have been enacted or proposed in numerous other states as well as in the U.S. Congress. These new laws will impose similar, additional, and in some cases more restrictive requirements than the CCPA created.

Furthermore, other states have proposed or enacted legislation that is focused on more narrow aspects of privacy. For example, a number of states have passed laws that protect biometric information and a smaller number of states have