Company: HCWB
Filing Date: 2025-03-28
Form Type: 10-K
Source: 0000950170-25-046724
Chunk: 226

Company: HCW Biologics Inc.
Filing Date: 2025-03-28
Form: 10-K
Item: Item 1A
Chunk 226
---
, share price, stockholder value, and financial condition. We could also incur substantial remediation costs, including the costs of investigating the incident, repairing or replacing damaged systems, restoring normal business operations, implementing increased cybersecurity protections, and paying increased insurance premiums.

We face potential liability related to the privacy of health information we obtain from clinical trials sponsored by us or our collaborators, from research institutions and our collaborators, and directly from individuals.

We and our partners and vendors are subject to various federal, state, and foreign data protection laws and regulations (i.e., laws and regulations that address data privacy and security). If we fail to comply with these laws and regulations, we may be subject to litigation, regulatory investigations, enforcement notices, enforcement actions, fines, and criminal or civil penalties, as well as negative publicity and a potential loss of business.  

In the United States, numerous federal and state laws and regulations, including state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws and regulations that govern the collection, use, disclosure, and protection of health-related and other personal information could apply to our operations or the operations of our partners. For example, most healthcare providers, including research institutions from which we or our collaborators obtain patient health information, are subject to privacy and security regulations promulgated under HIPAA, as amended HITECH. Under HIPAA, we could potentially face substantial criminal or civil penalties if we knowingly receive individually identifiable health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA’s requirements for disclosure of individually identifiable health information, or otherwise violate applicable HIPAA requirements related to the protection of such information. Even when HIPAA does not apply, failing to take appropriate steps to keep consumers’ personal information secure may constitute a violation of the Federal Trade Commission Act.  

In addition, we may maintain sensitive personally identifiable information, including health information, that we receive throughout the clinical trial process, in the course of our research collaborations, and directly from individuals (or their healthcare providers) who enroll in our patient assistance programs. As such, we may be subject to state laws (for example, the CCPA and the California Privacy Rights Act) requiring notification of affected individuals and state regulators in the event of a breach of personal information. 

69 

Our clinical trial programs and research collaborations outside the United States may implicate international data protection laws, including in Europe the GDPR. If our privacy or data security measures fail to comply with the GDPR requirements, we may be subject to litigation,