Company: PHR
Filing Date: 2025-09-05
Form Type: 10-Q
Source: 0001412408-25-000062
Chunk: 34

Company: Phreesia, Inc.
Filing Date: 2025-09-05
Form: 10-Q
Item: Part II, Item 1A
Chunk 34
---
 complex compliance issues for us and our partners and potentially expose us to additional expense, adverse publicity and liability, any of which could adversely affect our business. States continue to introduce and adopt new and amended laws, regulations and industry standards concerning privacy, data protection and information security. The first of these was the CCPA, as amended by the CPRA, which amendments went into effect on January 1, 2023. The CCPA created specific obligations with respect to processing and storing personal information, and the CPRA amendments created a new state agency that is vested with authority to implement and enforce the CCPA. In addition to the CCPA, similar privacy and data security laws have been enacted or proposed in numerous other states as well as in the U.S. Congress. These new laws will impose similar, additional, and in some cases more restrictive requirements than the CCPA created.

Furthermore, other states have proposed or enacted legislation that is focused on more narrow aspects of privacy. For example, a number of states have passed laws that protect biometric information and a smaller number of states have passed or are considering laws that are specifically focused upon health privacy, such as Washington’s My Health My Data Act. The My Health My Data Act imposes new state restrictions and requirements on the processing and sale of consumer health data and creates a private right of action, which further increases the relevant compliance risk. Connecticut and Nevada have also passed similar laws regulating consumer health data. The effects of state and federal privacy laws are potentially significant and may require us to modify our data processing practices and policies and to incur substantial costs and potential liability in an effort to comply with such legislation.

We cannot yet determine the full impact these laws or other such future laws, regulations and standards may have on our current or future business. Any of these laws may broaden their scope in the future, and similar laws have been proposed on both a federal level and in various states in the U.S. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. The existence of comprehensive privacy laws in different states in the country, and the heightened scrutiny associated with the enforcement of such laws, could make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance. State laws are changing rapidly and there are discussions in the