Company: SRPT
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-029973
Chunk: 166

Company: Sarepta Therapeutics, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1
Chunk 166
---
 generate negative publicity, which could harm our business, financial condition, results of operations or prospects.

Within the U.S., there are numerous federal and state laws and regulations related to the privacy and security of personal information. For example, at the federal level, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended, and its implementing regulations establish privacy and security standards that limit the use and disclosure of individually identifiable health information, or protected health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information. While we have determined that we are neither a “covered entity” nor a “business associate” directly subject to HIPAA, many of the U.S. health care providers with which we interact are subject to HIPAA, and we may have assumed obligations related to protecting the privacy of personal information. States are increasingly regulating the privacy and security of personal information. In some states, such as California and Washington, state privacy laws are even more protective than HIPAA. For example, the California Consumer Privacy Act as amended and expanded by the California Privacy Rights Act (together, the “CCPA”), gives California consumers (defined to include all California residents) certain rights, including the right to ask covered companies to disclose copies of personal information collected and delete a consumer’s personal information and requires covered companies to provide notice to California consumers regarding their data processing activities. The CCPA places limitations on a covered company’s ability to sell personal information and share it for purposes of cross-context behavioral advertising. Similar laws are in operation or have been adopted in eleven other states.

In addition, the processing of personal data relating to EEA citizens or in the context of the activities of an establishment in the EEA is subject to the General Data Protection Regulation (the “GDPR”). The GDPR increases obligations with respect to clinical trials conducted in the EEA, such as in relation to the provision of fair processing notices, responding to data subjects who exercise their rights and reporting certain data breaches to regulators and affected individuals. The GDPR also requires us to enter certain contractual arrangements with third parties that process GDPR-covered personal data on our behalf. The GDPR also increases the scrutiny applied to transfers of personal data from the EEA (including from clinical trial sites in the EEA) to countries that are considered by the EC to lack an adequate level of data protection. Similar rules and requirements are applicable in the UK by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the