Company: TALK
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0000950170-25-038107
Chunk: 51

Company: Talkspace, Inc.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1A
Chunk 51
---
, access, use or disclosure of their unsecured PHI that compromises the privacy or security of such information, with certain exceptions related to unintentional or inadvertent use or disclosure by employees or authorized individuals. Further, if a breach affects 500 patients or more, it must be reported to the U.S. Department of Health and Human Services Office (“HHS”) without unreasonable delay, and HHS will post the name of the breaching entity on its public web site. Breaches affecting 500 patients or more in the same state or jurisdiction must also be reported to the local media. If a breach involves fewer than 500 people, the covered entity must record it in a log and notify HHS at least annually. 

27

Entities that are found to be in violation of HIPAA as the result of a breach of unsecured PHI or following a complaint about privacy practices or an audit by HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. HIPAA also authorizes state attorneys general to file suit on behalf of their residents and HIPAA's standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. Any such penalties or lawsuits could harm our business, financial condition, results of operations and prospects. 

In addition to HIPAA, the U.S. federal government and various states and governmental agencies have adopted or are considering adopting various laws, regulations and standards regarding the collection, use, retention, security, disclosure, transfer and other processing of sensitive and personal information, to which we are or may become subject. For example, California implemented the California Consumer Privacy Act, or CCPA, which came into effect in 2020, and the California Privacy Rights Act (“CPRA”), which came into effect on January 1, 2023, which we are subject. The CCPA imposes obligations and restrictions on businesses regarding their collection, use, processing, retaining and sharing of personal information and provides new and enhanced data privacy rights to California residents. Protected health information that is subject to HIPAA is excluded from the CCPA; however, information we hold about individual residents of California that is not subject to HIPAA would be subject to the CCPA. The CPRA significantly amends and expands the CCPA, including by providing consumers with additional rights with respect to their personal information