Company: INGN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-029993
Chunk: 20

Company: Inogen Inc
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1
Chunk 20
---
 Notification Standards, which establish standards for notification in the event of a breach of unsecured individually identifiable health information. 

 13

In 2009, Congress passed the American Recovery and Reinvestment Act of 2009, or ARRA, which included sweeping changes to HIPAA, including an expansion of HIPAA’s privacy and security standards. ARRA includes the Health Information Technology for Economic and Clinical Health, or HITECH, which, among other things, made HIPAA’s privacy and security standards directly applicable to business associates of covered entities. A business associate is a person or entity that performs certain functions or activities on behalf of a covered entity that involve the use or disclosure of protected health information in connection with recognized healthcare operations activities. As a result, business associates are subject to significant civil and criminal penalties for failure to comply with applicable standards. HITECH also increased the civil and criminal penalties that may be imposed against covered entities, business associates and possibly other persons and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorney fees and costs associated with pursuing federal civil actions.  

In addition to federal regulations issued under HIPAA, some states have enacted privacy and security statutes or regulations that, in some cases, are more stringent than those issued under HIPAA. In those cases, it may be necessary to modify our planned operations and procedures to comply with the more stringent state laws. If we fail to comply with applicable state laws and regulations, we could be subject to additional sanctions. Any liability from failure to comply with the requirements of HIPAA, HITECH or state privacy and security statutes or regulations could adversely affect our financial condition. The costs of complying with privacy and security related legal and regulatory requirements are burdensome and could have a material adverse effect on our results or operations. 

Physician Payments Sunshine Act

In addition, there has been a recent trend of increased federal and state regulation of payments made to physicians and other healthcare providers. The Physician Payments Sunshine Act, enacted as part of the Patient Protection and Affordable Care Act, as amended by the Health Care and Education Reconciliation Act, imposed public reporting requirements on medical device manufacturers for payments or other transfers of value made by them to physicians and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family members. The Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act enacted in 2018, extended the reporting and transparency requirements under the Physician