Company: AGIO
Filing Date: 2025-05-01
Form Type: 10-Q
Source: 0001439222-25-000036
Chunk: 170

Company: AGIOS PHARMACEUTICALS, INC.
Filing Date: 2025-05-01
Form: 10-Q
Item: Part I, Item 8
Chunk 170
---
 any of these laws and regulations could result in enforcement action against us, including fines, imprisonment of company officials and public censure, claims for damages by affected individuals, damage to our reputation and loss of goodwill, any of which could have a material adverse effect on our business, financial condition, results of operations or prospects.

There are numerous U.S. federal and state laws and regulations related to the privacy and security of personal information. In particular, regulations promulgated pursuant to the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, establish privacy and security standards that limit the use and disclosure of individually identifiable health information, or protected health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information. Determining whether protected health information has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and may be subject to changing interpretation. These obligations may be applicable to some or all of our business activities now or in the future.

If we are unable to properly protect the privacy and security of protected health information, we could be found to have breached our contracts. Further, if we fail to comply with applicable privacy laws, including applicable HIPAA privacy and security standards, we could face civil and criminal penalties. Enforcement activity by the U.S. Department of Health & Human Services, or HHS, can result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal resources. In addition, state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents. We cannot be sure how these regulations will be interpreted, enforced or applied to our operations. In addition to the risks associated with enforcement activities and potential contractual liabilities, our ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to our policies, procedures and systems. 

In addition to potential enforcement by HHS, we are also potentially subject to privacy enforcement from the Federal Trade Commission, or FTC. The FTC has been particularly focused on the unpermitted processing of health and genetic data through its recent enforcement actions and is expanding the types of privacy violations that it interprets to be “unfair” under Section 5 of the FTC Act of 1914, as well as the types of activities it views to trigger the Health Breach Notification Rule (which the FTC also has the authority to enforce