Company: CORT
Filing Date: 2025-11-04
Form Type: 10-Q
Source: 0001628280-25-048841
Chunk: 88

Company: CORCEPT THERAPEUTICS INC
Filing Date: 2025-11-04
Form: 10-Q
Item: Part I, Item 8
Chunk 88
---
 circumstances, we could be subject to criminal penalties if we knowingly obtain, use, or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA. Requirements for compliance under HIPAA are also subject to change, as the U.S. Department of Health and Human Services Office of Civil Rights issued a proposed rule that would amend certain security compliance requirements for covered entities and business associates.

Even when HIPAA does not apply, according to the Federal Trade Commission (the “FTC”), violating consumers’ privacy or failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. In 2024, the FTC also finalized its rulemaking on additional data privacy rules and requirements, which may add additional complexity to compliance obligations going forward.

In addition, certain state laws govern the privacy and security of health-related and other personal information in certain circumstances, some of which may be more stringent, broader in scope or offer greater individual rights with respect to protected health information than HIPAA and many of which may differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Failure to comply with these laws, where applicable, can result in the imposition of significant civil and/or criminal penalties and private litigation. For example, the California Confidentiality of Medical Information Act imposes restrictive requirements regulating the use and disclosure of health information and other personally identifiable information. Further, the California Consumer Privacy Act, which took effect on January 1, 2020, and was later revised and expanded by the California Privacy Rights Act (the “CPRA” and collectively, the “CCPA”), created individual privacy rights for California consumers and increased the privacy and security obligations of entities handling certain personal information as well as limitation on data uses, audit requirements for higher risk data, and opt outs for certain uses of sensitive data. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability. It also created a new California data protection agency