Company: SNWV
Filing Date: 2025-03-20
Form Type: 10-K
Source: 0001628280-25-014141
Chunk: 57

Company: SANUWAVE Health, Inc.
Filing Date: 2025-03-20
Form: 10-K
Item: Item 1A
Chunk 57
---
 divert management’s attention from operating our business, which in turn could have a material adverse effect on our business. In addition, if our arrangements were found to violate the Federal Anti-Kickback Statute, False Claims Act or similar state laws, the consequences of such violations would likely have a material adverse effect on our business, results of operations and financial condition.

Failure to comply with the HIPAA and state-specific privacy laws, as such rules become applicable to our business, may increase our operational costs.

The HIPAA privacy and security regulations establish comprehensive Federal standards with respect to the uses and disclosures of PHI by certain entities, including health plans and health care providers, and set standards to protect the confidentiality, integrity, and availability of electronic PHI. The regulations establish a complex regulatory framework on a variety of subjects, including, for example: the circumstances under which uses and disclosures of PHI are permitted or required without a specific authorization by the patient; a patient’s right to access, amend and receive an accounting of certain disclosures of PHI; the content of notices of privacy practices describing how PHI is used and disclosed and individuals’ rights with respect to their PHI; and implementation of administrative, technical and physical safeguards to protect privacy and security of PHI. We anticipate that, as we expand our business, we will in the future be a covered entity under HIPAA. There can be no assurance that our policies and procedures will be adequate or will prevent all incidents of non-compliance with such regulations.

The HITECH Act and its implementing regulations also require healthcare providers to notify affected individuals, the Secretary of the U.S. Department of Health and Human Services, and in some cases, the media, when PHI has been breached as defined under and following the requirements of HIPAA. Many states have similar breach notification laws. In the event of a breach, to the extent such regulations are applicable to our business, we could incur operational and financial costs related to remediation as well as preparation and delivery of the notices, which costs could be substantial. Additionally, HIPAA, the HITECH Act, and their implementing regulations provide for significant civil fines, criminal penalties, and other sanctions for failure to comply with the privacy, security, and breach notification rules, including for wrongful or impermissible use or disclosure of PHI. Although the HIPAA statute and regulations do not expressly provide for a private right of action for damages, private parties may also seek damages under state laws for the wrongful or impermissible use or disclosure of confidential health information or other private personal information. Additionally, amendments