Company: VCYT
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001384101-25-000014
Chunk: 29

Company: VERACYTE, INC.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1
Chunk 29
---
 including electronic, written, or oral, in a manner that is not permitted under HIPAA, and we are required to implement security measures to ensure the confidentiality, integrity, and availability of the electronic protected health information that we create, receive, maintain, or transmit. While we have some flexibility in determining which security safeguards are reasonable and appropriate to implement for our operations, it nonetheless requires significant effort and expense to ensure continuing compliance with the HIPAA security rule. We are also required to comply with the administrative simplification standards under HIPAA when we conduct the electronic transactions regulated by HIPAA, including by using standard code sets and formats and standardized identifiers for health plans and providers. The requirements under HIPAA and its implementing regulations may change periodically and could have an effect on our business operations if compliance becomes substantially costlier than under current requirements.

In addition to federal privacy regulations, there are a number of state laws governing confidentiality of health information that are applicable to our business. In particular, we are subject to the California Confidentiality of Medical Information Act, which is similar to but in some ways more restrictive than the HIPAA regulations, and the California Consumer Privacy Act, or CCPA, which was enacted in California in 2018 and substantially amended and expanded thereafter, most significantly by a ballot initiative adopted in November 2020 that enacted the California Privacy Rights Act, or CPRA. The CPRA amends and substantially expands the CCPA. The CCPA, among other things, requires covered companies to provide disclosures to California consumers concerning the collection and sale of personal information, and gives such consumers the right to opt-out of certain sales of personal information. The amendments to the CCPA that were adopted by ballot initiative include provisions creating a new category of “sensitive personal information” that is subject to more stringent protections than other personal information, and new requirements regarding sharing personal information for advertising purposes. In addition, the amendments established a new California Privacy Protection Agency, which has authority both to implement and enforce the CCPA. The new agency adopted implementing regulations that went into effect in March 2023. At the same time, other states, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, have enacted laws similar to the CCPA/CPRA, and other states are expected to follow suit. Monitoring the development, enactment and implementation of these laws and regulations issued pursuant to them adds to our compliance costs and we