Company: TALK
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0000950170-25-038107
Chunk: 18

Company: Talkspace, Inc.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1
Chunk 18
---
 the local media in cases where a breach affects more than 500 individuals. Breaches affecting fewer than 500 individuals must be reported to HHS on an annual basis. HIPAA also requires a business associate to notify its covered entity customers of breaches by the business associate. State attorneys general may also enforce HIPAA violations, and overlapping state laws may impose additional obligations.

State attorneys general also have the right to prosecute HIPAA violations committed against residents of their states. While HIPAA does not create a private right of action that would allow individuals to sue in civil court for a HIPAA violation, its standards have been used as the basis for the duty of care in state civil suits, such as those for negligence or recklessness in misusing personal information. In addition, HIPAA mandates that HHS conduct periodic compliance audits of HIPAA covered entities and their business associates for compliance. It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the civil monetary penalty fine paid by the violator. In light of the HIPAA Omnibus Final Rule, recent enforcement activity, and statements from HHS, we expect increased federal and state HIPAA privacy and security enforcement efforts.

HIPAA also required HHS to adopt national standards for electronic transactions that all healthcare providers must use when submitting or receiving certain healthcare transactions electronically. On January 16, 2009, HHS released the final rule mandating that everyone covered by HIPAA must implement ICD 10 for medical coding on October 1, 2013, which was subsequently extended to October 1, 2015, and is now in effect.

Many states in which we operate and in which our patients reside also have laws that protect the privacy and security of sensitive and personal information, including health information. Moreover, state laws may be similar to or even more protective than HIPAA and other federal privacy laws. For example, the laws of the State of California, in which we operate, are more restrictive than HIPAA. Where state laws are more protective/restrictive than HIPAA, we must comply with the state laws we are subject to, in addition to HIPAA. In certain cases, it may be necessary to modify our existing or planned operations and procedures to comply with these more stringent state laws. Not only may some of these state laws impose fines and penalties upon violators, but, unlike HIPAA, some may afford private rights of action to individuals who believe their personal information has been misused. In addition,