Company: AMWL
Filing Date: 2025-02-12
Form Type: 10-K
Source: 0000950170-25-019024
Chunk: 75

Company: American Well Corp
Filing Date: 2025-02-12
Form: 10-K
Item: Item 1
Chunk 75
---
 program beneficiaries, the routine waivers of copayments and deductibles offered to patients covered by commercial payers may implicate applicable state laws related to, among other things, unlawful schemes to defraud, excessive fees for services, tortious interference with patient contracts, and statutory or common law fraud. 

U.S. State and Federal Health Information Privacy and Security Laws 

There are numerous U.S. federal and state laws and regulations related to the privacy and security of PII, including health information. In particular, HIPAA establishes privacy and security standards that limit the use and disclosure of PHI, and require the implementation of administrative, physical, and technical safeguards to ensure the confidentiality, integrity and availability of PII, including health information, in electronic form. AMG, our health system clients, and our health plan clients are all regulated as covered entities under HIPAA. We are a business associate of our covered entity clients when we are working on behalf of our covered entity clients including our affiliated medical groups and also when we are providing technology services to those clients via our enterprise platform. As a business associate, we are also directly regulated by HIPAA and are required to provide satisfactory written assurances to our covered entity clients through written business associate agreements that we will provide our services in accordance with HIPAA. Failure to comply with these contractual agreements could lead to loss of clients, contractual liability to our clients, and direct action by HHS, including monetary penalties. 

Violations of HIPAA may result in significant civil and criminal penalties. Our management responsibilities to AMG include assisting it with its obligations under HIPAA’s breach notification rule. Under the breach notification rule, covered entities must notify affected individuals without unreasonable delay in the case of a breach of unsecured PHI, which may compromise the privacy, security or integrity of the PHI. In addition, notification must be provided to HHS and the local media in cases where a breach affects more than 500 individuals. Breaches affecting fewer than 500 individuals must be reported to HHS on an annual basis. HIPAA also requires a business associate to notify its covered entity clients of breaches by the business associate. 

State attorneys general also have the right to prosecute HIPAA violations committed against residents of their states. While HIPAA does not create a private right of action that would allow individuals to sue in civil court for a HIPAA violation, its standards have been used as the basis for the duty of care in state civil suits, such as those for negligence or recklessness in misusing personal information. In addition, HIPAA mandates