Company: XAIR
Filing Date: 2025-06-20
Form Type: 10-K
Source: 0001641172-25-015750
Chunk: 558

Company: Beyond Air, Inc.
Filing Date: 2025-06-20
Form: 10-K
Item: Item 1
Chunk 558
---
) has direct enforcement authority against covered entities and business associates with regard to compliance with HIPAA regulations. We also could be subject to criminal penalties if we knowingly obtain individually identifiable health information from a covered entity in a manner that is not authorized or permitted by HIPAA or for aiding and abetting and/or conspiring to commit a violation of HIPAA. We are unable to predict whether our actions could be subject to prosecution in the event of an impermissible disclosure of health information to us;

    ●
    numerous U.S. federal and state laws and regulations, including state data breach notification laws, state health information privacy laws and federal and state consumer protection laws, govern the collection, use, disclosure and protection of personal information. These laws may impose a number of compliance obligations on us, including requiring that we obtain consent before we collect, use, or disclose personal information, implement certain security protections to safeguard personal information, and notify individuals or regulators in the event of a breach;

    ●
    other countries also have, or are developing, laws governing the collection, use, disclosure and protection of personal information. The GDPR, for example, imposes restrictions on the processing (e.g., collection, use, disclosure) of personal data in the EEA and also imposes strict restrictions on the transfer of personal data out of the EU to the U.S. Our business could be adversely impacted if our ability to transfer personal data outside of the EEA or Switzerland is restricted, which could adversely impact our operating results. For example, in July 2020, the Court of Justice of the European Union (the CJEU) declared the EU-U.S. Privacy Shield framework between the EU and U.S. to be invalid and raised concerns about other data transfer mechanisms in a case known colloquially as “Schrems II”, which could adversely impact our ability to transfer personal data from the EU to the U.S or otherwise may cause us to incur significant costs to do so legally. At present, there are few viable alternatives to the EU-U.S. Privacy Shield and the Standard Contractual Clauses (“SCCs”). If the level of protection in the U.S. or any other importing country is called into question under the SCCs, this could further impact our ability to transfer data outside of the EEA or Switzerland. Furthermore, following the Brexit and the UK’s exit from the EU, the UK became a third country to the EU in terms of personal data transfers. The European Commission has adopted an Adequacy Decision concerning the level of personal data protection in the