Company: ARWR
Filing Date: 2025-01-29
Form Type: ARS
Source: 0001628280-25-002866
Chunk: 48

Company: ARROWHEAD PHARMACEUTICALS, INC.
Filing Date: 2025-01-29
Form: ARS
Chunk 48
---
 as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH Act”), and the regulations promulgated thereunder, impose data privacy, security and data breach reporting obligations with respect to protected health information (“PHI”) on covered entities—which include health plans, healthcare clearinghouses and certain healthcare providers—and business associates—which include persons or entities that perform certain functions or activities that involve the use or disclosure of PHI on behalf of, or in connection with providing a service for, a covered entity. There are also a number of U.S. state privacy laws, such as the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA”), that govern the privacy and security of personal information in certain circumstances. The CCPA/CPRA applies to personal data of consumers (which is defined to include business representatives and employees) who are California residents, imposes obligations on certain businesses that do business in California, including to provide specific disclosures in privacy notices, and affords rights to California residents in relation to their personal information. Health information falls under the CCPA/CPRA’s definition of personal information where it identifies, relates to, describes, is reasonably capable of being associated with or could reasonably be linked, directly or indirectly, with a particular consumer or household and is considered “sensitive personal information,” which is offered greater protection. However, the CCPA/CPRA, like other U.S. state privacy laws, does not apply to PHI, and other U.S. state entities exempt covered entities and business associates altogether. Some of these laws and regulations impose different, and in certain instances, more stringent requirements than HIPAA. Failing to comply with these laws and regulations can result in significant civil and/or criminal penalties, as well as, in some cases, exposure to private litigation, all of which can result in financial and reputational risks. The collection and use of personal health data and other personal data in the EU is governed by the provisions of the European General Data Protection Regulation (EU) 2016/679 (“GDPR”), which came into force in May 2018, and by related implementing laws in the individual EU member states. The GDPR has a number of significant practical consequences, in particular for international data transfers, competent supervisory authorities and enforcement of the GDPR. The GDPR increased responsibility and liability in relation to personal data that we process. The GDPR imposes a number of strict obligations and restrictions on the ability to process (processing includes collection