Company: WHWK
Filing Date: 2025-01-21
Form Type: PREM14A
Source: 0001193125-25-009599
Chunk: 327

Company: Whitehawk Therapeutics, Inc.
Filing Date: 2025-01-21
Form: PREM14A
Chunk 327
---
 or found to be in violation of any of these laws or any other related governmental regulations that may apply to us, we may be subject to significant civil, criminal, and administrative penalties, damages, fines, imprisonment, disgorgement, exclusion of drugs from government funded healthcare programs, such as Medicare and Medicaid, reputational harm, additional oversight, and reporting obligations if we becomes subject to a corporate integrity agreement or similar settlement to resolve allegations of non-compliancewith these laws and the curtailment or restructuring of our operations. If any of the physicians or other healthcare providers or entities with whom we expect to do business is alleged or found to be not in compliance with applicable laws, they may be subject to similar actions, penalties, and sanctions, which may also adversely affect our business. Ensuring business arrangements comply with applicable healthcare laws, as well as responding to possible investigations by government authorities, can be time- and resource-consuming and can divert a company’s attention from the business. Privacy and Data Protection Laws We are subject to laws and regulations covering data privacy and the protection of health-related and other personal information. Federal, state, and foreign laws also govern the privacy and security of health information in some circumstances. For example, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations also impose obligations on covered entities such as health insurance plans, healthcare clearinghouses, and certain health care providers and their respective business associates and their covered subcontractors, including mandatory contractual terms, with respect to safeguarding - 225 -

the privacy, security and transmission of individually identifiable health information, State data privacy and security laws may differ from each other in significant ways and often are not pre-empted by HIPAA, which may complicate compliance efforts in states or jurisdictions we conduct business. For example, in 2020, California enacted the CCPA, which created new individual privacy rights for
California consumers, as defined in the law, and placed increased privacy and security obligations on entities handling personal data of consumers or households. The CCPA requires covered companies to provide certain disclosures to consumers about
its data collection, use and sharing practices, and to provide affected California residents with ways to opt-out of certain sales or transfers of personal information. The CCPA went into effect on
January 1, 2020 and became enforceable by the California Attorney General on July 1, 2020. It was further amended and supplemented by the California Privacy Rights Act, which became effective on January 1, 2023