Company: ADPT
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000950170-25-030913
Chunk: 102

Company: Adaptive Biotechnologies Corp
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 102
---
 in complexity and number, may change frequently and sometimes conflict. 

56

The HIPAA privacy, security and breach notification regulations, including the expanded requirements under HITECH, establish comprehensive federal standards with respect to the uses and disclosures of PHI by health plans, healthcare providers, including laboratories, and healthcare clearinghouses, in addition to setting standards to protect the confidentiality, integrity and security of PHI. The regulations establish a complex regulatory framework on a variety of subjects, including: 

•the circumstances under which uses and disclosures of PHI are permitted or required without a specific authorization by the patient; 

•a patient’s rights to access, amend and receive an accounting of certain disclosures of PHI; 

•requirements to notify individuals if there is a breach of their unsecured PHI; 

•the contents of notices that must be provided to patients regarding our privacy practices for PHI; 

•administrative, technical and physical safeguards required of entities that use or receive PHI; and 

•the safeguarding of PHI. 

Penalties for violations of these laws vary. For instance, penalties for failure to comply with a requirement of HIPAA and HITECH vary significantly, and include substantial per violation civil monetary penalties for each provision of HIPAA that is violated up to a statutory cap and, in certain circumstances, significant criminal penalties with fines per violation and potential imprisonment. A single breach can result in findings of violations of multiple provisions, leading to possible penalties in excess of any applicable cap for violations in a calendar year. Any person who knowingly obtains or discloses PHI in violation of HIPAA may face a significant criminal penalty and up to one year of imprisonment. The criminal penalties increase if the wrongful conduct involves false pretenses or the intent to sell, transfer or use identifiable health information for commercial advantage, personal gain or malicious harm. In addition, responding to government investigations or related third-party private rights of action regarding alleged violations of these and other laws and regulations, even if they ultimately result in no findings of violations or no penalties imposed, can consume our resources and impact our business and, if public, harm our reputation. 

Computer networks are vulnerable to breach and unauthorized persons may in the future be able to exploit weaknesses in the security systems of our computer networks and gain access to PHI. Additionally, we share PHI with third-party contractors, and while they are contractually obligated under business associate agreements to safeguard and maintain the confidentiality of PHI, their indemnification of us would not insulate us from reputational harm. Unauthorized persons may be able to gain access to PHI stored in such third