Company: PHR
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001412408-25-000010
Chunk: 72

Company: Phreesia, Inc.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1
Chunk 72
---
 

Violations of HIPAA may result in civil and criminal penalties and a single data breach can result in violations of multiple standards. We must also comply with HIPAA’s breach notification rule. Under the breach notification rule, business associates must notify covered entities of a breach, and those covered entities must notify affected individuals without unreasonable delay in the case of a breach of unsecured PHI, which may compromise the privacy, security or integrity of the PHI. In addition, notification must be provided to the U.S. Department of Health and Human Services (“HHS”), and, in cases where a breach affects more than 500 individuals, the local media. Breaches affecting fewer than 500 individuals must be reported to HHS on an annual basis. In the event of a breach, our covered entity customers may require that we provide assistance or request that we make these notifications on behalf of the covered entity in the breach notification process and may seek indemnification and other contractual remedies. 

State attorneys general also have the right to prosecute HIPAA violations in their states. While HIPAA does not create a private right of action that would allow individuals to sue in civil court, its standards have been used as the 

14

basis for the duty of care in state civil suits, such as those for negligence or recklessness in misusing personal information. In addition, HIPAA tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the Civil Monetary Penalty fine paid by the violator. We expect a continued or increased level of federal and state HIPAA privacy and security enforcement efforts.

On December 27, 2024, the HHS Office for Civil Rights (“HHS-OCR”) issued a Notice of Proposed Rulemaking to modify the HIPAA Security Rule to enhance cybersecurity protections for electronic protected health information (“ePHI”). The proposed rule would modify the HIPAA Security Rule to require covered entities and business associates to strengthen cybersecurity protections for individuals’ protected health information. Key proposals include removing the distinction between “required” and “addressable” implementation specifications and mandating the development and revision of a technology asset inventory and a network map. Given the recent change in presidential administration, it is difficult to anticipate when the proposed rule will be finalized or if the NPRM will be withdrawn. 

In recent years, federal and state regulators have increased their focus on the application of HIPAA and other privacy laws to the digital space and to technology companies, and states have adopted new statutes applicable to this area.

Beyond HIP