Company: CORT
Filing Date: 2025-07-31
Form Type: 10-Q
Source: 0001628280-25-037005
Chunk: 234

Company: CORCEPT THERAPEUTICS INC
Filing Date: 2025-07-31
Form: 10-Q
Item: Part II, Item 1A
Chunk 234
---
 violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. In 2024, the FTC also finalized its rulemaking on additional data privacy rules and requirements, which may add additional complexity to compliance obligations going forward.

In addition, certain state laws govern the privacy and security of health information in certain circumstances, some of which are more stringent than HIPAA and many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Failure to comply with these laws, where applicable, can result in the imposition of significant civil and/or criminal penalties and private litigation. For example, the California Confidentiality of Medical Information Act imposes restrictive requirements regulating the use and disclosure of health information and other personally identifiable information. Further, the California Consumer Privacy Act, which took effect on January 1, 2020, and was later revised and expanded by the California Privacy Rights Act, collectively the “CCPA”, created individual privacy rights for California consumers and increased the privacy and security obligations of entities handling certain personal information as well as limitation on data uses, audit requirements for higher risk data, and opt outs for certain uses of sensitive data. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability. It also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. Similar laws passed in Virginia, Colorado, Connecticut, Montana, Oregon, Texas and Utah have taken effect in 2023 and 2024 and other states, including Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Rhode Island, and Tennessee, have passed similar laws that will take effect in or after 2025. In addition, along with the CPRA, some of these laws, along with other standalone health privacy laws, subject health-related information to additional safeguards and disclosures and some specifically regulate consumer health data, such as the Washington My Health My Data Privacy Law, which became effective in 2024, Nevada’s Consumer Health Data Privacy Law, which became effective in 2024