Company: ARVN
Filing Date: 2025-02-11
Form Type: 10-K
Source: 0001655759-25-000016
Chunk: 175

Company: ARVINAS, INC.
Filing Date: 2025-02-11
Form: 10-K
Item: Item 1
Chunk 175
---
 is looking to amend some of its rules (including those relating to data security), both of create additional compliance risks for our business.

Our clinical trials will be regulated by the Common Rule, which also includes specific privacy-related provisions. In addition to federal privacy regulations, there are a number of state laws governing confidentiality and security of health information that may be applicable to our business. In addition to possible federal civil and criminal penalties for HIPAA violations, state attorneys general are authorized to file civil actions for damages or injunctions in federal courts to enforce HIPAA and seek attorney’s fees and costs associated with pursuing federal civil actions. In addition, state attorneys general (along with private plaintiffs) have brought civil actions seeking injunctions and damages resulting from alleged violations of HIPAA’s privacy and security rules. State attorneys general also have authority to enforce state privacy and security laws. New laws and regulations governing privacy and security may be adopted in the future as well.

There are also increased restrictions at the federal level relating to transferring sensitive data outside of the United States to certain foreign countries. For example, in 2024, Congress passed H.B. 815, which included the Protecting Americans’ Data from Foreign Adversaries Act of 2024. This law creates certain restrictions for entities that disclose sensitive data (including potential health data) to countries such as China. Failure to comply with these rules can lead to a potential FTC enforcement action. Additionally, the Department of Justice recently finalized a rule implementing Executive Order 14117, which creates similar restrictions related to the transfer of sensitive US data to countries such as China. These data transfer restrictions (and others that may pass in the future) may create operational challenges and legal risks for our business. 

In addition to potential enforcement by the HHS and state attorneys general, we could also be potentially subject to privacy enforcement from the Federal Trade Commission, or the FTC. The FTC has been particularly focused on the unpermitted processing of health and genetic data through its recent enforcement actions and is expanding the types of privacy violations that it interprets to be “unfair” under Section 5 of the FTC Act, as well as the types of activities it views to trigger the Health Breach Notification Rule (which the FTC also has the authority to enforce). The agency is also in the process of developing rules related to commercial surveillance and data security. We will need to account for the FTC’s evolving rules and guidance for proper privacy and data security practices in order to mitigate risk for a potential enforcement action, which may be costly. Finally,