Company: SUPN
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001356576-25-000017
Chunk: 639

Company: SUPERNUS PHARMACEUTICALS, INC.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1
Chunk 639
---
 including state security breach notification laws, state health information privacy laws and federal and state consumer protection laws, govern the collection, use, disclosure, and protection of personal information. Failure to comply with such laws and regulations could result in government enforcement actions and create liability for us (including the imposition of significant penalties), private litigation and/or adverse publicity that negatively affects our business. In addition, healthcare providers who prescribe our products and research institutions we collaborate with are subject to privacy and security requirements under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH). HIPAA and its implementing regulations impose certain requirements on covered entities, including certain healthcare providers, health plans, and healthcare clearinghouses as well as their respective business associates (including us) that create, receive, maintain or transmit individually identifiable health information for or on behalf of a covered entity and their subcontractors that use, disclose, access, or otherwise process individually identifiable protected health information, relating to the privacy, security and transmission of individually identifiable health information. Among other things, HITECH makes HIPAA's privacy and security standards directly applicable to business associates, which are independent contractors or agents of covered entities that receive or obtain protected health information in connection with providing a service on behalf of a covered entity. HITECH also created four new tiers of civil monetary penalties, amended HIPAA to make civil and criminal penalties directly applicable to business associates and possibly other persons, and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorneys' fees and costs associated with pursuing federal civil actions. In addition, state laws govern the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts.

In order to be eligible to have our products paid for with federal funds under the Medicaid and Medicare Part B programs and purchased by certain federal agencies and grantees, we must comply with the Veterans Health Care Act of 1992 (VHCA). The VHCA requires manufacturers to offer their covered drugs (biologics and single source and innovator multiple source drugs) for sale to certain federal agencies, including but not limited to, the Department of Veterans Affairs (VA), on a Federal Supply Schedule contract, at a price no higher than the statutory Federal Ceiling Price (FCP). The FCP is based on the non-federal average manufacturer