Company: DARE
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001401914-25-000012
Chunk: 158

Company: Dare Bioscience, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1
Chunk 158
---
 with applicable laws and regulations we could be subject to penalties or sanctions, including criminal penalties as well as reputational harm. Our customers and research partners must comply with laws governing the privacy and security of health information, including HIPAA, HITECH and state health information privacy laws. If we knowingly obtain protected health information without the authority to do so, our customers or research collaborators may be subject to enforcement and we may have direct liability for the unlawful receipt of protected health information or for aiding and abetting a HIPAA violation.

Even when HIPAA does not apply, according to the Federal Trade Commission, or the FTC, failing to take appropriate steps to keep consumers’ personal information secure, or failing to provide a level of security commensurate to promises made to individual about the security of their personal information (such as in a privacy notice) may constitute unfair or deceptive acts or practices in violation of Section 5(a) of the Federal Trade Commission Act, or the FTC Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. The FTC’s guidance for appropriately securing consumers’ personal information is similar to what is required by the HIPAA Security Rule. The FTC and states' Attorneys General have brought enforcement actions and prosecuted some data breach cases as unfair and/or deceptive acts or practices under the FTC Act and comparable state laws.

State laws protecting health and personal information are becoming increasingly stringent. For example, California has implemented the California Confidentiality of Medical Information Act that imposes restrictive requirements regulating the use and disclosure of health information and other personally identifiable information, and California has adopted the California Consumer Privacy Act of 2018, or CCPA, which went into effect in January of 2020. The CCPA mirrors a number of the key provisions of the European General Data Protection Regulation, or GDPR, described below. The CCPA establishes a new privacy framework for covered businesses by creating an expanded definition of personal information, establishing new data privacy rights for consumers in the State of California, imposing special rules on the collection of consumer data from minors, requiring covered companies to provide new disclosures to consumers about such companies' practices for collection and use of consumer data, and providing customers new ways to opt-out of certain sales or transfers of personal information. In addition, the CCPA creates a new and potentially severe statutory