Company: ISRG
Filing Date: 2025-01-31
Form Type: 10-K
Source: 0001035267-25-000017
Chunk: 212

Company: INTUITIVE SURGICAL INC
Filing Date: 2025-01-31
Form: 10-K
Item: Item 1A
Chunk 212
---
 Technology for Economic and Clinical Health Act of 2009, and regulations implemented thereunder, or HIPAA, imposes privacy, security, and breach notification obligations on covered entities and their business associates to ensure the confidentiality, integrity, and availability of individually identifiable health information. Entities that are found to be in violation of HIPAA, as a result of a breach of unsecured protected health information, a complaint about privacy practices, or an audit by the U.S. Department of Health and Human Services (“HHS”), may be subject to significant civil, criminal, and administrative fines and penalties and/or additional reporting and oversight obligations if they are required to enter into a resolution agreement and corrective action plan with HHS through settlement agreements.

Further, in the U.S., when HIPAA does not apply, according to the Federal Trade Commission (the “FTC”), violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair and/or deceptive acts or practices in violation of Section 5(a) of the FTC Act. The FTC has the authority to initiate enforcement actions against entities that make deceptive statements about privacy and data sharing in privacy policies, fail to limit third-party use of personal health information, fail to implement policies to protect personal health information, or engage in other unfair practices that harm customers or that may violate Section 5(a) of the FTC Act. The FTC expects a company’s data security measures to be reasonable and appropriate in proportion to the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Additionally, federal and state consumer protection laws are increasingly being applied by the FTC and states’ attorneys general to regulate the collection, use, storage, and disclosure of personal information, through websites or otherwise, and to regulate the presentation of website content.

At the state level, multiple states have comprehensive consumer privacy laws enacted. Notably, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”) gives California residents expanded rights to access, correct, and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA allows for significant fines by the California attorney general as well as a private right of action from individuals in relation to certain security breaches. Similar laws have passed in other states and are continuing to be proposed at the state and federal level, reflecting the continuing trend toward more stringent privacy legislation in the U.S. These developments are