Company: PFSA
Filing Date: 2025-08-11
Form Type: S-1
Source: 0001213900-25-073872
Chunk: 68

Company: Profusa, Inc.
Filing Date: 2025-08-11
Form: S-1
Chunk 68
---
 in our business operations that could adversely affect our business, financial condition, and results of operations. Additionally, while we have implemented industry standard security measures for offshore access to protected health information and other personal information, unauthorized access or disclosure of such information by offshore personnel could result in legal claims or proceedings, and liability under laws that protect the privacy of personal information and regulatory penalties, disrupt our operations and the services we provide to our clients, damage to our reputation or result in the termination of contractual relationships, penalties or the loss of coverage, any of which could adversely affect our profitability, revenue and competitive position. Security breaches and other disruptions that compromise our information and expose us to liability, could cause our business and reputation to suffer and could subject us to substantial liabilities. The Administrative Simplification Provisions of the Health Insurance Portability and Accountability Act of 1996, as amended, and implementing regulations, or HIPAA, extensively regulate the use and disclosure of individually identifiable health information, known as “protected health information,” and require covered entities, including health plans and most health care providers, to implement administrative, physical and technical safeguards to protect the security of such information. Certain provisions of the security and privacy regulations apply to business associates 40 (entities that handle protected health information on behalf of covered entities), and business associates are subject to direct liability for violation of these provisions. In addition, a covered entity may be subject to penalties as a result of a business associate violating HIPAA, if the business associate is found to be an agent of the covered entity. Profusa is a covered entity under HIPAA and may also function in a business associate capacity to other covered entities. Covered entities must report breaches of unsecured protected health information to affected individuals without unreasonable delay and notification must also be made to the U.S. Department of Health & Human Services, Office for Civil Rights, or OCR and, in certain situations involving large breaches, to the media. Various U.S. state laws and regulations may also require us to notify affected individuals and state agencies in the event of a data breach involving individually identifiable information. Violations of the HIPAA privacy and security regulations may result in criminal and civil penalties. The OCR enforces the regulations and performs compliance audits. In addition to enforcement by OCR, state attorneys general are authorized to bring civil actions seeking either injunction or damages in response to violations that threaten the privacy of state residents. We follow and maintain a HIPAA compliance plan, which we believe complies with the HIPAA privacy and security regulations, but there can be no assurance that OCR