Company: HRTX
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-028374
Chunk: 75

Company: HERON THERAPEUTICS, INC. /DE/
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 75
---
 implement and enforce the law. Other states, such as Virginia and Colorado, have also passed comprehensive data privacy and security laws, and similar laws are being considered in several other states, as well as at the federal and local levels. These developments may further complicate compliance efforts and may increase legal risk and compliance costs for us and the third parties upon whom we rely. 

For example, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health information. Healthcare providers who prescribe our products and from whom we may obtain patient health information are subject to privacy and security requirements under HIPAA. We currently are not a HIPAA covered entity, do not intend to become one, and we do not operate as a business associate to any covered entities. We could be subject to criminal penalties if we knowingly obtain individually identifiable health information from a covered entity in a manner that is not authorized or permitted by HIPAA or for aiding and abetting the violation of HIPAA. We are unable to predict whether our actions could be subject to prosecution in the event of an impermissible disclosure of health information to us. 

Outside the U.S., an increasing number of laws, regulations, and industry standards may govern data privacy and security.  For example, the European Union’s General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and Canada’s Anti-Spam Legislation (“CASL”), impose strict requirements for processing personal data. For example, under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

In addition, we may be unable to transfer personal data from Europe and other jurisdictions to the U.S. or other countries due to data localization requirements or limitations on cross-border data flows.  Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries.  In particular, the EEA and the United Kingdom (“UK”) have significantly restricted the transfer of personal data to the U.S. and other countries whose data privacy and security laws it believes are inadequate.  Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer