Company: MLTX
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001821586-25-000006
Chunk: 54

Company: MoonLake Immunotherapeutics
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 54
---
 from government-funded healthcare programs, such as Medicare and Medicaid or similar programs in other countries or jurisdictions, integrity oversight and reporting obligations to resolve allegations of non-compliance, disgorgement, individual imprisonment, contractual damages, reputational harm, diminished profits and the curtailment or restructuring of our operations.

Data Privacy and Security

Numerous state, federal, and foreign laws govern the collection, dissemination, use, access to, confidentiality and security of personal information, including health-related information. In the United States, numerous federal and state laws and regulations, including state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws and regulations, govern the collection, use, disclosure, and protection of health-related and other personal information could apply to our operations or the operations of our partners. For example, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health (“HITECH”), and their respective implementing regulations imposes data privacy, security, and breach notification obligations on certain health care providers, health plans, and health care clearinghouses, known as covered entities, as well as their business associates and their covered subcontractors that perform certain services that involve using, disclosing, creating, receiving, maintaining, or transmitting individually identifiable protected health information (“PHI”) for or on behalf of such covered entities. These requirements imposed by HIPAA and the HITECH Act on covered entities and business associates include entering into agreements that require business associates protect PHI provided by the covered entity against improper use or disclosure, among other things; following certain standards for the privacy of PHI, which limit the disclosure of a patient’s past, present, or future physical or mental health or condition or information about a patient’s receipt of health care if the information identifies, or could reasonably be used to identify, the individual; ensuring the confidentiality, integrity, and availability of all PHI created, received, maintained, or transmitted in electronic form, to identify and protect against reasonably anticipated threats or impermissible uses or disclosures to the security and integrity of such PHI; and reporting of breaches of PHI to individuals and regulators. 

Entities that are found to be in violation of HIPAA may be subject to significant civil, criminal, and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. A covered entity or business associate is also liable for civil money penalties for a violation that is based on an act or omission of any of its agents, which may include