Company: HMDCF
Filing Date: 2025-03-19
Form Type: 20-F
Source: 0001410578-25-000377
Chunk: 54

Company: HUTCHMED (China) Ltd
Filing Date: 2025-03-19
Form: 20-F
Item: Item 1
Chunk 54
---
 establish privacy and security standards that limit the use and disclosure of individually identifiable health information (known as “protected health information”), require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information, and create breach reporting obligations in cases of certain unauthorized uses or disclosures. While we do not believe that we are directly subject to HIPAA as either a “covered entity” or “business associate,” U. S. sites at which we conduct clinical trials are likely to be covered entities and thus must ensure that they obtain adequate patient authorization or establish another basis under HIPAA to disclose a clinical trial subject’s individually identifiable health information to us and other entities participating in our clinical trials. In addition to federal regulation, many U. S. states have begun to focus on efforts to regulate privacy and data security. For example, in California, the California Consumer Protection Act (“ CCPA”), which went into effect on January 1, 2020 and was expanded by the California Consumer Privacy Rights Act (“ CPRA”), which went into effect on January 1, 2023, collectively establishes a privacy framework for covered businesses by creating an expanded definition of personal information, establishing new data privacy rights for consumers in the State of California, imposing special rules on the collection of consumer data from minors, and creating a new and potentially severe statutory damages framework for violations and for businesses that fail to implement reasonable security procedures and practices to prevent data breaches. A separate law, the California Confidentiality of Medical Information Act, also applies to pharmaceutical companies, including requirements for written authorization to use and disclose medical information and restrictions on the circumstances under which medical information can be used for marketing purposes. Several other states have also recently enacted or are considering comprehensive data privacy and security laws. Furthermore, all fifty states, the District of Columbia, Puerto Rico, and U. S. territories have enacted data breach notification laws that require, among other things, notifications to state governments and/or the affected individuals in the event of a data breach. These various state laws differ from one another and impose significant compliance burden. Although we take measures to protect sensitive data from unauthorized access, use or disclosure, and whenever possible contractually require third-party partners to do the same, our information technology and infrastructure and those of our third-party partners may be vulnerable to attacks by hackers or viruses or breached due to employee error, malfeasance or other malicious or inadvertent disruptions. Any such breach or interruption could compromise those networks and the information stored there could