Company: CORT
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-008167
Chunk: 21

Company: CORCEPT THERAPEUTICS INC
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 21
---
 our operations are found to be in violation of any of such laws or any other governmental regulations that apply to us, we may be subject to penalties, including, without limitation, civil and criminal penalties, damages, fines, the curtailment or restructuring of our operations, exclusion from participation in federal and state healthcare programs and imprisonment, any of which could adversely affect our ability to operate our business and our financial results.

In addition to the above “fraud and abuse” laws and regulations, we must also account for other applicable state and foreign laws and regulations that could impact our business activities. For example, some states require pharmaceutical companies to certify that they are in compliance with the pharmaceutical industry’s voluntary compliance guidelines and certain federal government compliance guidance, while other states (and some local governments) require the public registration of pharmaceutical sales representatives.

Data Privacy and Security

Numerous state, federal and foreign laws and regulations govern the collection of, disclosure of, use of, access to, transfer of, and confidentiality and security of health-related and other personal information and could apply now or in the future to our operations or the operations of our partners. For example, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their implementing regulations, imposes requirements relating to the privacy, security and transmission of protected health information on HIPAA covered entities, which include certain healthcare providers, health plans and healthcare clearinghouses, and their business associates who conduct certain activities for or on their behalf involving protected health information on their behalf. Entities that are found to be in violation of HIPAA as the result of a breach of unsecured protected health information, a complaint about privacy practices or an audit by the United States Department of Health and Human Services (“HHS”) may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. Further, entities that knowingly receive individually identifiable health information from a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA may be subject to criminal penalties. 

Even when HIPAA does not apply, according to the Federal Trade Commission (the “FTC”), failing to take appropriate steps to keep consumers’ personal information secure constitutes unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and