Company: CRNX
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-029050
Chunk: 139

Company: Crinetics Pharmaceuticals, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 139
---
 insurers, or by patients themselves; state laws that require pharmaceutical companies to comply with the pharmaceutical industry’s voluntary compliance guidelines and the relevant compliance guidance promulgated by the federal government, or otherwise restrict payments that may be made to healthcare providers and other potential referral sources; state laws and regulations that require drug manufacturers to file reports relating to pricing and marketing information, which requires tracking gifts and other remuneration and items of value provided to physicians, other healthcare providers and entities; state and local laws that require the registration of pharmaceutical sales representatives. 

24

Efforts to ensure compliance with applicable healthcare laws and regulations can involve substantial costs. Violations of healthcare laws can result in significant penalties, including the imposition of significant civil, criminal and administrative penalties, damages, monetary fines, disgorgement, individual imprisonment, possible exclusion from participation in Medicare, Medicaid and other U.S. healthcare programs, integrity oversight and reporting obligations, contractual damages, reputational harm, diminished profits and future earnings, and curtailment or restructuring of operations.

Data Privacy and Security 

Numerous state, federal and foreign laws, including consumer protection laws and regulations, govern the collection, dissemination, use, access to, confidentiality and security of personal information, including health-related information. In the United States, numerous federal and state laws and regulations, including data breach notification laws, health information privacy laws, and consumer protection laws and regulations (e.g., Section 5 of the FTC Act), that govern the collection, use, disclosure, and protection of health-related and other personal information could apply to our operations or the operations of our partners. 

For example, California enacted the California Consumer Privacy Act, or CCPA, effective January 1, 2020, which gives California residents expanded rights to access, correct, and delete their personal information, opt out of certain personal information sharing and disclosure, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that has increased the likelihood of, and risks associated with, data breach litigation. The CCPA may increase our compliance costs and potential liability. Further, the California Privacy Rights Act, or CPRA, generally went into effect on January 1, 2023, and significantly amends the CCPA. The CPRA imposes additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also creates a