Company: GEHC
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001932393-25-000005
Chunk: 17

Company: GE HealthCare Technologies Inc.
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1
Chunk 17
---
-level laws; the Lei Geral de Proteção de Dados Pessoias (“Brazil LGPD”); the various laws and accompanying regulations in China governing data privacy and cybersecurity (e.g., the Cybersecurity Law of the People’s Republic of China, Personal Information Protection Law (“China PIPL”) & Data Security Law (“China DSL”)), the Digital Personal Data Protection Act of India, and significant privacy legislation recently adopted in the Middle East and Africa Personal Data Protection Law (“PDPL”) Royal Decree No. M/19 on September 16, 2021. In addition, there are also various U.S. state-level laws (e.g., the California Consumer Privacy Act), country regional laws, and proposed legislation that we monitor for applicability and impact to our business. These laws present a continuing challenge to businesses to structure their data collection, storage, use, and cross-border transmission in a compliant manner.

10

Many of these laws impose a significant compliance burden on organizations within their scope, and failure to comply can result in a variety of sanctions, including, with respect to GDPR, administrative fines for the most serious compliance failures up to 4% of a company’s global total annual revenue of the preceding fiscal year. While there have been some recent enforcement actions by EU country-level data protection authorities resulting in substantial fines pursuant to GDPR, there remains uncertainty as to how data protection authorities throughout the rest of the globe will choose to interpret and enforce violations of applicable privacy laws and regulations (e.g., Brazil LGPD, China PIPL). Furthermore, these laws and regulations are continuously evolving, and further clarification in the form of implementing rules, guidelines, and related guidance from the data protection authorities is necessary to understand the full picture of the compliance obligations imposed on businesses within their scope. Additionally, in recent years, the EU has introduced upcoming legislation that would regulate the use and transfer of non-personal, technical data only.

GLOBAL HEALTHCARE COMPLIANCE.

The marketing, promotion, and sale of medical devices, drugs, and services are regulated by the U.S. Department of Health and Human Services and comparable U.S. state and non-U.S. governments and agencies responsible for reimbursement and regulation of the delivery of healthcare items and services, representing government’s interest in regulating the quality and cost of healthcare. Industry trade associations (such as Advanced Medical Technology Association (“AdvaMed”) and MedTech) increasingly provide guidance on applicable laws and regulations.

U.S. federal healthcare laws apply when we or our customers submit claims for items or services that are