Company: CNTB
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001835268-25-000014
Chunk: 135

Company: Connect Biopharma Holdings Ltd
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 135
---
 to build and maintain robust and expandable systems to comply with multiple jurisdictions with different compliance and/or reporting requirements increases the possibility that we might run afoul of one or more of the requirements. 

If our operations are found to be in violation of any of these laws or any other governmental regulations that may apply to us, we may be subject to significant civil, criminal and administrative penalties, damages, fines, disgorgement, imprisonment, exclusion from participation in government funded healthcare programs, such as Medicare and Medicaid, additional reporting requirements and oversight if we become subject to a corporate integrity agreement or similar agreement to resolve allegations of non-compliance with these laws and the curtailment or restructuring of our operations. 

Actual or perceived failures to comply with applicable data protection, privacy and security laws, regulations, standards and other requirements could adversely affect our business, results of operations, and financial condition.

The legislative and regulatory landscape for privacy and data protection continues to evolve in jurisdictions worldwide, and there has been an increasing focus on privacy and data protection issues with the potential to affect our business. Complying with such requirements can be difficult, time-consuming, expensive, and could require us to change our business practices and put in place additional compliance mechanisms. Failure to comply with laws, regulations and contractual and other obligations governing personal or other sensitive information could result in enforcement actions against us, including fines, public censure, processing penalties, claims for damages by affected individuals, damage to our reputation and loss of goodwill. It is possible that new and existing laws may be interpreted and applied in a manner that is inconsistent with our practices and our efforts to comply with the evolving data protection rules may be unsuccessful.

In the U.S., HIPAA, as amended by HITECH, and their implementing regulations, or collectively HIPAA, imposes, among other things, specific standards relating to the privacy, security, transmission and breach reporting of protected health information. Most healthcare providers, including research institutions from which we obtain patient’s protected health information, are subject to privacy and security regulations promulgated under HIPAA. While we do not believe that we are currently acting as a “covered entity” or “business associate” under HIPAA and thus are not directly regulated under HIPAA, any person may be prosecuted under HIPAA’s criminal provisions either directly or under aiding-and-abetting or conspiracy principles. Consequently, depending on the facts and circumstances, we could face substantial criminal penalties if we knowingly receive protected health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA