Company: AGIO
Filing Date: 2025-05-01
Form Type: 10-Q
Source: 0001439222-25-000036
Chunk: 258

Company: AGIOS PHARMACEUTICALS, INC.
Filing Date: 2025-05-01
Form: 10-Q
Item: Part I, Item 4
Chunk 258
---
 and controls designed to prevent these events from occurring, and we have a process to assess, identify and manage threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become more sophisticated. Moreover, despite our efforts, the possibility of these events occurring cannot be eliminated entirely. We cannot guarantee that the measures we have taken to date, and actions we may take in the future, will be sufficient to prevent any cyber-attacks or security breaches.

We are subject to stringent privacy laws, information security laws, regulations, policies and contractual obligations related to data privacy and security and changes in such laws, regulations, policies, contractual obligations and failure to comply with such requirements could subject us to significant fines and penalties, which may have a material adverse effect on our business, financial condition or results of operations.

We are subject to data privacy and protection laws and regulations that apply to the collection, transmission, storage and use of personally-identifying information, which among other things, impose certain requirements relating to the privacy, security and transmission of personal information, including comprehensive regulatory systems in the United States and the EU. The legislative and regulatory landscape for privacy and data protection continues to evolve in jurisdictions worldwide, and there has been an increasing focus on privacy and data protection issues with the potential to affect our business. Failure to comply with any of these laws and regulations could result in enforcement action against us, including fines, imprisonment of company officials and public censure, claims for damages by affected individuals, damage to our reputation and loss of goodwill, any of which could have a material adverse effect on our business, financial condition, results of operations or prospects.

There are numerous U.S. federal and state laws and regulations related to the privacy and security of personal information. In particular, regulations promulgated pursuant to the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, establish privacy and security standards that limit the use and disclosure of individually identifiable health information, or protected health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information. Determining whether protected health information has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and may be subject to changing interpretation. These obligations may be applicable to some or all of our business activities now or in the future.

If we are unable to properly protect the privacy and security of protected health information,