Company: OFIX
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000950170-25-026066
Chunk: 105

Company: Orthofix Medical Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1
Chunk 105
---
 for the purchase, order, or recommendation of any item or service reimbursed by a federal healthcare program (including Medicare and Medicaid); (ii) require that claims for payment submitted to federal healthcare programs be truthful; (iii) prohibit the transmission of protected healthcare information to persons not authorized to receive that information; and (iv) require the maintenance of certain government licenses and permits. 

Laws Protecting the Confidentiality of Health Information 

U.S. federal and state laws protect the confidentiality of certain health information, in particular individually identifiable information such as medical records, and restrict the use and disclosure of that protected information. At the federal level, the HHS promulgates health information privacy and security rules under HIPAA. These rules protect health information by regulating its use and disclosure, including for research and other purposes. Failure of a HIPAA "covered entity" to comply with HIPAA regarding such "protected health information" ("PHI") could constitute a violation of federal law, subject to civil and criminal penalties. Covered entities include healthcare providers (including certain of those that sell devices or equipment) that engage in particular electronic transactions, including, as we do, the transmission of claims to health plans. Consequently, health information that we access, collect, analyze, and otherwise use and/or disclose includes PHI that is subject to HIPAA. As noted above, many state laws also pertain to the confidentiality of health information. Such laws are not necessarily preempted by HIPAA, in particular those state laws that afford greater privacy protection to the individual than HIPAA. These state laws typically have their own penalty provisions, which could be applied in the event of an unlawful action affecting health information. 

In the E.U., the General Data Protection Regulation ("GDPR"), includes, among other things, a requirement for prompt notice of data breaches to data subjects and supervisory authorities in certain circumstances and significant fines for non-compliance. Internationally, some countries have also passed laws that require individually identifiable data on their citizens to be maintained on local servers and that may restrict transfer or processing of that data.

These laws and regulations impact the ways in which we use and manage personal data, PHI, and our information technology systems. They also impact our ability to move, store, and access data across geographic boundaries. Compliance with these requirements may require changes in business practices, complicate our operations, and add complexity and additional management and oversight needs. They also may complicate our clinical research activities, as well as product offerings that involve transmission or use of clinical data.

Physician Payments