Company: DVAX
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001029142-25-000049
Chunk: 33

Company: DYNAVAX TECHNOLOGIES CORP
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1
Chunk 33
---
 regardless of the payor. 

Separately, there are a number of other fraud and abuse laws that pharmaceutical manufacturers must be mindful of, particularly after a product candidate has been approved for marketing in the United States. For example, a 

20

Table of Contents

federal criminal law enacted as part of, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") prohibits, among other things, knowingly and willfully executing a scheme to defraud any healthcare benefit program, including private third-party payors. The false statements statute prohibits knowingly and willfully falsifying, concealing or covering up a material fact or making any materially false, fictitious or fraudulent statement in connection with the delivery of or payment for healthcare benefits, items or services. There are also federal and state consumer protection and unfair competition laws, which broadly regulate marketplace activities and activities that potentially harm consumers. 

Healthcare Privacy and Security Laws. We are subject to, or our marketing activities may be limited by, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 ("HITECH") and their respective implementing regulations, which established uniform standards for certain “covered entities” (certain healthcare providers, health plans and healthcare clearinghouses) governing the conduct of certain electronic healthcare transactions and protecting the security and privacy of protected health information. Among other things, HIPAA’s privacy and security standards are directly applicable to “business associates” — independent contractors or agents of covered entities that create, receive, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity, as well as their covered subcontractors. In addition to possible civil and criminal penalties for violations, HITECH created new tiers of civil monetary penalties, amended HIPAA to make civil and criminal penalties directly applicable to business associates, and gave state attorneys general authority to file civil actions for damages or injunctions in federal courts to enforce HIPAA and seek attorney’s fees and costs associated with pursuing federal civil actions. State laws also govern the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Further, we are required to comply with international personal data protection laws and regulations, particularly as the result of our operations in Düsseldorf, Germany. 

Privacy and Security Laws. We are subject to diverse laws and regulations relating to data privacy and security, including HIPAA in the United States, the European Union's General Data Protection Regulation