Company: ARWR
Filing Date: 2025-11-25
Form Type: 10-K
Source: 0000879407-25-000029
Chunk: 61

Company: ARROWHEAD PHARMACEUTICALS, INC.
Filing Date: 2025-11-25
Form: 10-K
Item: Item 1
Chunk 61
---
 decisions. 

To obtain reimbursement or pricing approval in some countries, including the EU member states, we may be required to conduct studies that compare the cost-effectiveness of our product candidates to other therapies that are considered the local standard of care. There can be no assurance that any country will allow favorable pricing, reimbursement and market access conditions for any of our products, or that we will be feasible to conduct additional cost-effectiveness studies, if required.

In certain EU member states, pharmaceutical products designated as orphan pharmaceutical products may be exempted or waived from having to provide certain clinical, cost-effectiveness and other economic data in connection with their filings for pricing/reimbursement approval. 

On October 27, 2025, the Council of the European Union approved a framework for compulsory licensing of crisis-relevant products (including medicinal products) in crisis situations. While the proposal focuses on voluntary agreements with intellectual property rights holders, it includes rules on compulsory licensing as a measure of last resort upon declaration of a crisis or emergency. The European Parliament is yet to vote on the proposal. 

Data Privacy and Security Laws

There are numerous U.S. federal, state, and local laws and regulations, as well as foreign legislation, in particular in the EU and UK, which regulate personal information, including how that information may be used, processed, and disclosed. These regulations also cover sensitive personal information, including medical and health information, and impose requirements on entities that handle such information to implement certain privacy and security measures.  We and/or our partners may be subject to these laws.

In the United States, at the federal level, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH Act”), and the regulations promulgated thereunder, impose data privacy, security and data breach reporting obligations with respect to protected health information (“PHI”) on covered entities—which include health plans, healthcare clearinghouses and certain healthcare providers—and business associates—which include persons or entities that perform certain functions or activities that involve the use or disclosure of PHI on behalf of, or in connection with providing a service for, a covered entity.

There are also a number of U.S. state privacy laws, such as the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA”), that govern the privacy and security of personal information in certain circumstances. The CCPA/CPRA applies to personal data of