Company: AMWL
Filing Date: 2025-02-12
Form Type: 10-K
Source: 0000950170-25-019024
Chunk: 130

Company: American Well Corp
Filing Date: 2025-02-12
Form: 10-K
Item: Item 1A
Chunk 130
---
 applicable laws, could damage our reputation and harm our business. 

For example, we send short message service, or SMS, text messages to potential end users who are eligible to use our service through certain clients and partners. While we obtain consent from or on behalf of these individuals to send text messages, federal or state regulatory authorities or private litigants may claim that the notices and disclosures we provide, form of consents we obtain or our SMS texting practices, are not adequate. These SMS texting campaigns are potential sources of risk for class action lawsuits and liability for our company. Numerous class-actions suits under federal and state laws have been filed in the past year against companies who conduct SMS texting programs, with many resulting in multi-million-dollar settlements to the plaintiffs. Any future such litigation against us could be costly and time-consuming to defend. 

46

We also publish statements to our clients and clients that describe how we handle and protect personal information. If federal or state regulatory authorities or private litigants consider any portion of these statements to be untrue, we may be subject to claims of deceptive practices, which could lead to significant liabilities and consequences, including, without limitation, costs of responding to investigations, defending against litigation, settling claims and complying with regulatory or court orders. FTC and HHS enforcement actions and class-actions suits under federal and state laws have been filed in the past year against healthcare companies alleged to have failed to protect personal information. Any such litigation against us could be costly and time-consuming to defend.  

Numerous foreign, federal and state laws and regulations govern collection, dissemination, use and confidentiality of personally identifiable health information, including (i) state privacy and confidentiality laws (including state laws requiring disclosure of breaches); (ii) HIPAA; and (iii) European and other foreign data protection laws. 

HIPAA establishes a set of basic national privacy and security standards for the protection of PHI, by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates with whom such covered entities contract for services, which includes us. We are considered a business associate under HIPAA; AMG is considered a covered entity. 

HIPAA requires healthcare entities like us to develop and maintain policies and procedures with respect to PHI that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information. HIPAA also implemented the use of standard transaction code sets and standard identifiers that covered entities must use when submitting or receiving certain electronic healthcare transactions, including activities associated with the billing and collection of healthcare