Company: SCLXW
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0000950170-25-047800
Chunk: 458

Company: Scilex Holding Co
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1
Chunk 458
---
 we are neither a covered entity nor business associate, and therefore not subject to the HIPAA Privacy and Security Rules, we must monitor developments with these requirements for changing obligations that may apply to us. The Federal Trade Commission (the “FTC”) also requires companies to take appropriate steps to keep consumers’ personal information secure and to make accurate statements regarding how they secure personal information under their custody or control, such as in a privacy notice. The FTC also expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of personal information it holds, the size and complexity of its business, and the cost of available tools to improve data security and reduce vulnerabilities. Individually identifiable health information, which we process, is considered sensitive data that merits stronger safeguards. Violations of the foregoing FTC requirements may constitute unfair or deceptive acts or practices under Section 5(a) of the Federal Trade Commission Act (the “FTC Act”). While we do not intend to engage in unfair or deceptive acts or practices, the FTC has the power to bring enforcement actions based on the FTC’s interpretation of public privacy statements. Further, events that we cannot fully control, such as data breaches, may also result in civil penalties, FTC 

 47

enforcement or enforcement by U.S. state attorneys general or other regulators. Various U.S. states have implemented privacy laws and regulations that regulate the use and disclosure of health information and other personal information. For example, the California Consumer Privacy Act and its implementing regulations (the “CCPA”), established a privacy framework for covered businesses by, among other items, expanding the definition of personal information, establishing new data privacy rights for consumers who are California residents, imposing rules on the collection of personal information from minors, and creating a statutory damages framework for violations of the CCPA, including for failure to implement reasonable security procedures and practices to prevent data breaches. Penalties for violations of the CCPA include civil penalties and may result in related legal claims. The California Privacy Rights Act (“CPRA”), most provisions of which became operative on January 1, 2023, introduced significant amendments to the CCPA and established and funded a dedicated California privacy regulator, the California Privacy Protection Agency. Several other states have implemented similar consumer privacy laws that took effect in the past year or will take effect in the near future. Further, Washington’s My Health My Data Act, taking effect July 1, 2024, imposes requirements specific to consumer health data. The foregoing U.S. state privacy laws impose many similar obligations