Company: ICUI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000883984-25-000007
Chunk: 51

Company: ICU MEDICAL INC/DE
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 51
---
 ("PHI") by health plans, health care clearinghouses and certain health care providers, called covered entities, and the business associates with whom such covered entities contract for services that involve creating, receiving, maintaining or transmitting PHI, as well as their covered subcontractors. HIPAA also requires covered entities to provide individuals with certain rights with respect to their PHI, and requires covered entities to enter into a written business associate contract or other arrangement with the business associate that establishes specifically what the business associate has been engaged to do and requires the business associate to comply with the requirements of HIPAA.

HIPAA requires the notification of patients, and other compliance actions, in the event of a breach of unsecured PHI. If notification to patients of a breach is required, such notification must be provided without unreasonable delay and in no event later than 60 calendar days after discovery of the breach. In addition, if the PHI of 500 or more individuals is improperly used or disclosed, we would be required to report the improper use or disclosure to the U.S. Department of Health and Human Services ("HHS") which would post the violation on its website, and to the media. 

27

Penalties for failure to comply with a requirement of HIPAA vary significantly depending on the nature of violation and could include civil monetary or criminal penalties. HIPAA authorizes state attorneys general to file suit on behalf of their residents for violations. Courts are able to award damages, costs and attorneys’ fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to file suit against us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care cases in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI.

Certain states have also adopted privacy and security laws and regulations, which govern the privacy, processing and protection of health-related and other personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, California enacted the California Consumer Privacy Act of 2018 (the "CCPA"), as amended by the California Privacy Rights Act (collectively, the CCPA) requires covered businesses that process the personal information of California residents to, among other things: (i) provide certain disclosures to California residents regarding the business’s collection, use, and disclosure of their personal information; (ii) receive and respond to requests from California