Company: GHRS
Filing Date: 2025-07-29
Form Type: 20-F/A
Source: 0001140361-25-027850
Chunk: 85

Company: GH Research PLC
Filing Date: 2025-07-29
Form: 20-F/A
Chunk 85
---
, and federal and state consumer protection laws, govern the collection, use, processing, storage, transmission, disclosure, destruction and protection of health-related and other personal information. In addition, we may obtain health information from third parties, including research institutions from which we obtain clinical trial data, which are subject to privacy and security requirements under HIPAA, as amended by HITECH. To the extent that we act as a business associate we may also be subject to the privacy and security provisions of HIPAA, as amended by HITECH, which restricts the use and disclosure of patient-identifiable health information, mandates the adoption of certain standards relating to the privacy and security of patient-identifiable health information, and requires the reporting of certain security breaches to healthcare provider customers with respect to such information. Additionally, many states have enacted similar laws that may impose more stringent requirements on entities like ours. Depending on the facts and circumstances, we could be subject to significant civil, criminal, and administrative penalties if we obtain, use, or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA. Additionally, in June 2018, the State of California enacted the California Consumer Privacy Act of 2018, or CCPA, which came into effect on January 1, 2020, and provides new data privacy rights for California consumers (as that term is defined in the legislation) and new operational requirements for companies that process information of California residents, which may increase our compliance costs and potential liability. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action and statutory damages for data breaches that is expected to increase data breach litigation. While there is currently an exception under the CCPA for protected health information that is subject to HIPAA and clinical trial regulations, as currently written, the CCPA may nevertheless impact certain of our business activities depending on how the CCPA will be interpreted, and exemplifies the vulnerability of our business to the evolving regulatory environment related to personal information. In addition, the California Privacy Rights Act of 2020, or CPRA, which went into effect on January 1, 2023, imposes additional obligations on companies covered by the legislation and significantly modifies the CCPA, including by expanding consumers’ rights with respect to certain sensitive personal information. The