Company: PTPI
Filing Date: 2025-02-19
Form Type: 424B4
Source: 0001410578-25-000164
Chunk: 132

Company: Petros Pharmaceuticals, Inc.
Filing Date: 2025-02-19
Form: 424B4
Chunk 132
---
 financial data, as well as security breach notification rules for loss or theft of such data. Additional legislation or regulation of this type might, among other things, require us to implement additional security measures and processes or bring within the legislation or regulation de-identified health or other data, each of which may require substantial expenditures or limit our ability to offer some of our services.

In particular, personal health information is recognized in many countries such as the United States, the European Union, or EU, and several countries in Asia, as a special, sensitive category of personal information, subject to additional mandatory protections. Violations of data protection regulations are subject to administrative penalties, civil money penalties and criminal prosecution, including corporate fines and personal liability.

Health Information Privacy Laws

There are numerous U.S. federal and state laws and regulations related to the privacy and security of our technology platform, including health information. In particular, HIPAA establishes privacy and security standards that limit the use and disclosure of personal health information, and require the implementation of administrative, physical, and technical safeguards to ensure the confidentiality, integrity and availability of such information, including health information, in electronic form. We will be a business associate of clients which may be deemed covered entities when we are providing technology services to those clients using our technology platform. We are likely to be also directly regulated by HIPAA and are required to provide satisfactory written assurances to our covered entity partners through written agreements that we will provide our services in accordance with HIPAA. Failure to comply with these contractual agreements could lead to loss of clients, liability to our clients and direct action by HHS, including monetary penalties.

Violations of HIPAA may result in significant civil and criminal penalties. Under the breach notification rule, covered entities must notify affected individuals without unreasonable delay in the case of a breach of unsecured personal health information, which may compromise the privacy, security or integrity of such information. In addition, notification must be provided to HHS and the local media

<div align='center'>78</div>

in cases where a breach affects more than 500 individuals. Breaches affecting fewer than 500 individuals must be reported to HHS on an annual basis. HIPAA also requires a business associate to notify its covered entity clients of breaches by the business associate.

State attorneys general also have the right to prosecute HIPAA violations committed against residents of their states. While HIPAA does not create a private right of action that would allow individuals to sue in civil court for a HIPAA violation, its standards have been used as the basis for the duty