Company: PHR
Filing Date: 2025-05-28
Form Type: 10-Q
Source: 0001412408-25-000039
Chunk: 283

Company: Phreesia, Inc.
Filing Date: 2025-05-28
Form: 10-Q
Item: Part I, Item 2
Chunk 283
---
 soared in recent years. Failing to comply with those requirements could leave us subject to claims, litigation, lawsuits and, ultimately, substantial fines and penalties. 

The healthcare regulatory and political framework is uncertain and evolving.

Healthcare laws and regulations are rapidly evolving and may change significantly in the future, which could adversely affect our financial condition and results of operations. For example, in 2020, the HHS, Office of the National Coordinator for Health Information Technology ("ONC") and Centers for Medicare & Medicaid Services (“CMS”) promulgated final rules to clarify and operationalize provisions of the 21st Century Cures Act ("Cures Act"), regarding interoperability and “information blocking,” and create significant new requirements for health care industry participants. Information blocking is defined as activity that is likely to interfere with, prevent, or materially discourage access, exchange, or use of EHI, where a health information technology developer, health information network or health information exchange knows or should know that such practice is likely to interfere with access to, exchange or use of EHI. In April 2023, the ONC issued a notice of proposed rulemaking that would modify certain 

62

Table of Contents

components of the Final Rule, including modifying and expanding certain exceptions to the information blocking regulations, which are intended to support information sharing. 

While these rules benefit us in that certain EHR vendors will no longer be permitted to interfere with our attempts at integration, they may also make it easier for other similar companies to enter the market, creating increased competition and reducing our market share.

In addition, on December 27, 2024, HHS-OCR issued a Notice of Proposed Rulemaking to modify the HIPAA Security Rule to enhance cybersecurity protections for electronic protected health information. The proposed rule would modify the HIPAA Security Rule to require covered entities and business associates to strengthen cybersecurity protections for individuals’ protected health information. Key proposals include removing the distinction between “required” and “addressable” implementation specifications and mandating the development and revision of a technology asset inventory and a network map. Given the recent change in presidential administration, it is difficult to anticipate when the proposed rule will be finalized or if the NPRM will be withdrawn. If the NPRM is finalized, we may be subject to additional compliance obligations and incur additional costs in connection with compliance.

In addition, we are subject to various other laws and regulations, including, among others, anti-kickback laws, antitrust laws and the privacy and data protection laws described below.

We conduct business in