Company: PHR
Filing Date: 2025-12-09
Form Type: 10-Q
Source: 0001412408-25-000132
Chunk: 7

Company: Phreesia, Inc.
Filing Date: 2025-12-09
Form: 10-Q
Item: Part II, Item 1A
Chunk 7
---
 our expansion into new markets, cause us to incur remediation costs, or cause us to lose existing customers. The risk of state-supported and geopolitical-related cyber-attacks may increase in connection with political unrest or wars and any related political or economic responses and counter-responses. We may not discover all such cybersecurity incidents, data breaches, or other activity or be able to respond or otherwise address them promptly, in sufficient respects or at all.

We are subject to state laws requiring notification of affected individuals and state regulators in the event of a breach of personal information. Furthermore, certain health privacy laws, data breach notification laws, consumer protection laws and genetic testing laws may apply directly to our business and/or those of our collaborators and may impose restrictions on our collection, use and dissemination of individuals’ health information. Patients about whom we obtain health information, as well as the healthcare services clients who share this information with us, may have statutory or contractual rights that limit our ability to use and disclose the information. Additionally, our subsidiary, AccessOne MedCard, Inc. (“AccessOne MedCard”) is subject to regulation and supervision of 

56

cybersecurity and data privacy matters by state and federal regulators, including state financial regulatory agencies, the U.S. Federal Trade Commission (the “FTC”) and the Consumer Financial Protection Bureau (the “CFPB”), including the New York Department of Financial Services 23 NYCRR Part 500 Cybersecurity Requirements for Financial Services Companies (the “NYDFS Part 500 Requirements”), and the Graham-Leach-Bliley Act (the “GLBA”) and Regulation P promulgated thereunder, which, among other things, require financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data. We may be required to expend significant capital and other resources to ensure ongoing compliance with applicable privacy and data security laws and regulatory requirements. Claims that we have violated individuals’ privacy rights, violated applicable privacy laws and regulations or breached our contractual obligations, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business, or enforcement and other supervisory actions. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and data security obligations. Further, although we maintain cyber liability insurance, this insurance may not provide adequate coverage against potential liabilities related to any experienced cybersecurity incident or breach.

Like all