Company: TEM
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000950170-25-025603
Chunk: 55

Company: Tempus AI, Inc.
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1
Chunk 55
---
 the Federal Trade Commission Act, the Telephone Consumer Protection Act of 1991, the Children’s Online Privacy Protection Act of 1998, the Controlling the Assault of Non-Solicited Pornography And Marketing Act of 2003, the California Consumer Privacy Act of 2018, or CCPA, the Canadian Personal Information Protection and Electronic Documents Act, Canada’s Anti-Spam Legislation, the European Union’s General Data Protection Regulation 2016/679, or EU GDPR, the EU GDPR as it forms part of United Kingdom, or UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 or UK GDPR, the ePrivacy Directive, and the Payment Card Industry Data Security Standard, or PCI DSS. In addition, HIPAA, as mentioned above, imposes privacy, security and breach reporting obligations with respect to individually identifiable health information upon "covered entities" (health plans, health care clearinghouses and certain health care providers), and their respective business associates, individuals or entities that create, received, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity. HIPAA mandates the reporting of certain breaches of health information to the U.S. Department of Health and Human Services, or HHS, affected individuals and if the breach is large enough, the media. Entities that are found to be in violation of HIPAA, including as the result of a breach of unsecured PHI, a complaint about privacy practices or an audit by HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance.

Even when HIPAA does not apply, failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C § 45(a). The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Personally identifiable health information is considered sensitive data that merits stronger safeguards. The FTC’s guidance for appropriately securing consumers’ personal information is similar to what is required by the HIPAA Security Rule. In addition, certain state laws govern the privacy and security of personal information, including health information in certain