Company: PHR
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001412408-25-000010
Chunk: 75

Company: Phreesia, Inc.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1
Chunk 75
---
. While we continue to evaluate the potential impact of new and proposed laws on our business, the application of such laws and their potential impact on our business is difficult to predict. In certain cases, it may become necessary to modify our planned operations and procedures to comply with more stringent state laws. The existence of privacy laws in different states in the country have increasingly made compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance. Not only may some of these state laws impose fines and penalties upon violators, but also some state laws, unlike HIPAA, may afford private rights of action to individuals who believe their personal information has been misused. In addition, state laws are changing rapidly, and there is discussion of a new federal privacy law to which we may be subject.

In recent years, there have been a number of well publicized data breaches involving the improper use and disclosure of personally identifiable information and PHI. Many states have responded to these incidents by enacting laws requiring holders of personal information to maintain safeguards and to take certain actions in response to a data breach, such as providing prompt notification of the breach to affected individuals and state officials. In addition, under HIPAA and pursuant to the related contracts with our business associates, we must report breaches of unsecured PHI to our contractual partners following discovery of the breach. Notification must also be made in certain circumstances to affected individuals, federal authorities and others. 

U.S. federal and state telecommunications laws

There are number of U.S. federal and state laws and regulations that concern telephone calls, text messages and other telephonic communications to patients, potential patients, clients and potential clients. For example, the Telephone Consumer Protection Act (“TCPA”) is a federal statute that restricts certain calls and text messages to individuals. Some states, including Florida and Oklahoma, have mini-TCPA laws that restrict certain calls and text messages to their residents and mini-TCPA laws have been proposed in other state legislatures. Our call and text communications are or may be (or may become) subject to these laws.

U.S. federal contracting laws

Our subsidiary, Insignia, receives a portion of its revenue from customers that are governmental agencies or funded by government programs. As a federal government contractor, Insignia’s government contracts and subcontracts subject Insignia to the Federal Acquisition Regulation (“FAR”) and, among other requirements, the following: (a) termination when appropriated funding for the current fiscal year is exhausted;