Company: MYGN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000899923-25-000019
Chunk: 38

Company: MYRIAD GENETICS INC
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1
Chunk 38
---
compliance and established new breach notification requirements for Covered Entities. Under HITECH’s breach notification requirements, Covered Entities must report breaches of protected health information that has not been encrypted or otherwise secured in accordance with guidance from the Secretary of the U.S. Department of Health and Human Services. Required breach notices must be made as soon as is reasonably practicable, but no later than 60 days following discovery of the breach. Reports must be made to affected individuals and to the Secretary and, in some cases depending on the size and impact of the breach, they must be reported through local and national news media. Breach reports can lead to investigation, enforcement, civil monetary penalties and civil litigation, including class action lawsuits and enforcement by state authorities as well as significant reputational harm.

We are currently subject to the HIPAA regulations and maintain an active compliance program that is designed to meet requirements of the privacy and security rules and to identify privacy and security incidents and other issues in a timely fashion so that we may remediate, mitigate harm and report if required by law. However, even if we take steps to comply with HIPAA, we may be subject to breaches caused by human error or external threat actors, complaints and investigation at the federal and/or state level. In the event of a breach, even if we mitigate harm and make required reports on a timely basis, we may still be subject to penalties for the underlying breach.

22

Table of Contents

Other federal and state laws establish additional requirements for protecting the privacy and security of health information that is not protected by HIPAA.  For instance, Washington state recently passed the “My Health My Data” Act, which will regulate “consumer health data,” which is defined as “personal information that is linked or reasonably linkable to a consumer and that identifies a consumer’s past, present, or future physical or mental health.”  The “My Health My Data” Act provides exemptions for personal data used or shared in connection with certain research activities, including data subject to 45 C.F.R. Parts 46, 50 and 56.  Notably, the “My Health My Data” Act contains a private right of action.  In addition, Nevada recently enacted a consumer health data privacy bill, SB 370, which also regulates “consumer health data” and shares many similarities with Washington’s “My Health My Data” Act, and Connecticut recently amended its comprehensive privacy law to include heightened regulation of “consumer health data.”  Additional states may adopt health-specific privacy laws that could impact our business activities and