Company: PHR
Filing Date: 2025-12-09
Form Type: 10-Q
Source: 0001412408-25-000132
Chunk: 236

Company: Phreesia, Inc.
Filing Date: 2025-12-09
Form: 10-Q
Item: Part I, Item 8
Chunk 236
---
Risks relating to laws and regulations applicable to our industry

We are subject to health care laws and data privacy and security laws and regulations governing our collection, use, disclosure, storage and transmission of personally identifiable information, including protected health information and payment card data, which may impose restrictions on us and our operations, require us to change our business practices and put in place additional compliance mechanisms, and subject us to fines, penalties, lawsuits, adverse publicity, reputational harm, loss of customer trust or government enforcement actions if we are unable to fully comply with such laws.

Numerous complex federal and state laws and regulations govern the collection, use, disclosure, storage and transmission of personally identifiable information, including protected health information, and account holder information collected by our subsidiary AccessOne MedCard pursuant to its role as a consumer lender. State laws may be even more restrictive and not preempted by HIPAA, and may be subject to varying interpretations by the courts and government agencies. In addition, our subsidiary AccessOne MedCard is subject to certain federal and state regulations applicable to financial institutions related to cybersecurity, including the NYDFS Part 500 Requirements, and the GLBA and Regulation P promulgated thereunder, which, among other things, require financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data. These laws and regulations, including their interpretation by governmental agencies, are subject to frequent change and could have a negative impact on our business. Further, these varying interpretations could create complex compliance issues for us and our partners and potentially expose us to additional expense, liability, penalties, negatively impact our client relationships, and lead to adverse publicity, and all of these risks could adversely affect 

69

our business in the short and long term. In addition, contractual obligations and legislation may limit, forbid or regulate the use or transmission of health information outside of the United States or across other national borders. These developments, if adopted, could render our use of Indian employees and other non-U.S. resources for work related to such data impracticable or substantially more expensive. 

We are a “Business Associate” as defined under HIPAA. The U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights may impose civil penalties on a Business Associate for a failure to comply with HIPAA requirements. The U.S. Department of Justice is responsible for criminal prosecutions under HIPAA. Penalties can vary significantly depending on a number of factors, such as whether the Business Associate’s failure to comply was due to willful neglect. State attorneys