Company: PHAT
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0000950170-25-034183
Chunk: 75

Company: Phathom Pharmaceuticals, Inc.
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1
Chunk 75
---
.

Data Privacy and Security Laws

As a pharmaceutical company, we are subject to federal, state and foreign data privacy, cybersecurity and data breach notification laws governing the collection, use, disclosure and protection of health-related and other personal information. For example, in the U.S., HIPAA imposes privacy, security and breach reporting obligations upon “covered entities” (health plans, health care clearinghouses and certain health care providers), and their respective business associates, individuals or entities that create, receive, maintain or transmit protected health information, or PHI, in connection with providing certain services for or on behalf of a covered entity. HIPAA mandates the reporting of certain breaches of protected health information to the HHS, to affected individuals, and if the breach is large enough, to the media. Entities that are found to be in violation of HIPAA as the result of a breach of unsecured personal health information, a complaint about privacy practices or an audit by the HHS may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI.

47

Even when HIPAA does not apply, according to the Federal Trade Commission or the FTC, failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s cybersecurity measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. In addition, certain other federal, state laws, such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act, or collectively, the CCPA and similar state laws in other U.S. states govern the privacy and security of personal information, including health-related information in certain circumstances, some of which are more stringent than HIPAA and many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. 

 We are also subject