Company: PHR
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001412408-25-000010
Chunk: 73

Company: Phreesia, Inc.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1
Chunk 73
---
AA, it is important to note that additional federal and state laws restrict the use and disclosure of personally identifiable information, particularly sensitive information such as individually identifiable health information. For example, the Federal Trade Commission (“FTC”) has advised that failing to take appropriate steps to keep consumers’ personal information private and secure may constitute an unfair act or practice in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act (the “FTCA”). The FTC expects a company’s data privacy and security policies and practices to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business and the cost of available tools to improve security and reduce vulnerabilities. In recent years, the FTC’s enforcement actions and guidance have focused on disclosures of sensitive health information by commonly used digital tracking technologies such as cookies, pixels, and software development kits in circumstances in which such disclosures are unfair or misleading. The FTC has initiated enforcement actions against entities in the health space that mislead consumers, make false or misleading statements in privacy policies, fail to limit third-party use of personal health information, fail to implement policies to protect personal health information or engage in other unfair practices that harm customers. We regularly review our privacy program in light of FTC guidance and enforcement actions and believe that our privacy standards are fair and transparent under the FTCA. However, in such an evolving regulatory space, there can be no assurances as to how future interpretations of law may affect our business.

Regulators and legislators in the United States are also increasingly scrutinizing and restricting certain personal data transfers and transactions involving foreign countries. For example, the Biden Administration’s executive order Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern as implemented by Department of Justice regulations issued in December 2024, prohibits data brokerage transactions involving certain sensitive personal data categories, including health data, genetic data, and biospecimens, to countries of concern, including China. The regulations also restrict certain investment agreements, employment agreements and vendor agreements involving such data and countries of concern, absent specified cybersecurity controls. Actual or alleged violations of these regulations may be punishable by criminal and/or civil sanctions, and may result in exclusion from participation in federal and state programs.

Many states also have laws that protect the privacy and security of sensitive and personal information, including health information, and are, in many cases, not preempted by HIPAA and may be subject to varying interpretations by courts and government agencies. For example, the California Consumer Privacy Act