Company: PHR
Filing Date: 2025-12-09
Form Type: 10-Q
Source: 0001412408-25-000132
Chunk: 237

Company: Phreesia, Inc.
Filing Date: 2025-12-09
Form: 10-Q
Item: Part I, Item 8
Chunk 237
---
 general also have the right to prosecute HIPAA violations in their states. While HIPAA does not create a private right of action that would allow individuals to sue in civil court, its standards have been used as the basis for the duty of care in state civil suits, such as those for recklessness in misusing individuals’ health information. If we are subject to investigation or litigation related to an alleged violation of HIPAA, then we may elect to resolve the matter through a settlement. Such settlement could require payment of a civil penalty or damages, corrective action and/or monitoring of our business by a third party. 

The security measures that we and our third-party vendors and subcontractors have in place to ensure compliance with privacy and data protection laws are not guarantees that we and our subcontractors will not be the victims of cyber-attacks, acts of vandalism or theft, computer viruses, misplaced or lost data, malfeasance, programming and human errors or other similar events. Under the HITECH Act, as a Business Associate we may also be liable for privacy and security breaches and failures of our subcontractors. Even though we provide for appropriate protections through our agreements with our subcontractors, we still have limited control over their actions and practices. A breach of privacy or security of individually identifiable health information by a subcontractor may result in an enforcement action, including criminal and civil liability, against us. We are not able to predict the extent of the impact such incidents may have on our business. Enforcement actions against us could be costly and could interrupt regular operations, which may adversely affect our business. While we are not aware of any non-compliance or violations of any applicable privacy and data protection laws and believe we are in compliance with such laws, there can be no assurance that we will not receive notices of non-compliance or violations in the future. 

Even when HIPAA does not apply, according to the FTC, failing to take appropriate steps to keep consumers’ personal information secure constitutes unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act (“FTCA”). The FTC’s current guidance for appropriately securing consumers’ personal information is similar to what is required by the HIPAA security regulations, but this guidance may change in the future, resulting in increased complexity and the need to expend additional resources to ensure we are complying with the FTCA.

Federal and state consumer protection laws are increasingly being applied by the FTC and states’ attorneys general to regulate the collection, use, storage and disclosure of personal or personally identifiable information, through