Company: PHR
Filing Date: 2025-05-28
Form Type: 10-Q
Source: 0001412408-25-000039
Chunk: 278

Company: Phreesia, Inc.
Filing Date: 2025-05-28
Form: 10-Q
Item: Part I, Item 2
Chunk 278
---
 challenge of our privacy practices by our consumers, regulatory authorities or other third parties could result in negative publicity and could require a costly response from and defense by us. Any of these events could adversely affect our ability to operate our business and our financial results. 

Other federal and state laws restrict the use and protect the privacy and security of personally identifiable information, in many cases are not preempted by HIPAA and may be subject to varying interpretations by courts and government agencies. These varying interpretations can create complex compliance issues for us and our partners and potentially expose us to additional expense, adverse publicity and liability, any of which could adversely affect our business. States continue to introduce and adopt new and amended laws, regulations and industry standards concerning privacy, data protection and information security. The first of these was the CCPA, as amended by the CPRA, which amendments went into effect on January 1, 2023. The CCPA created specific obligations with respect to processing and storing personal information, and the CPRA amendments created a new state agency that is vested with authority to implement and enforce the CCPA. In addition to the CCPA, similar privacy and data security laws have been enacted or proposed in numerous other states as well as in the U.S. Congress. These new laws will impose similar, additional, and in some cases more restrictive requirements than the CCPA created.

Furthermore, other states have proposed or enacted legislation that is focused on more narrow aspects of privacy. For example, a number of states have passed laws that protect biometric information and a smaller number of states have passed or are considering laws that are specifically focused upon health privacy, such as Washington’s My Health My Data Act. The My Health My Data Act imposes new state restrictions and requirements on the processing and sale of consumer health data and creates a private right of action, which further increases the relevant compliance risk. Connecticut and Nevada have also passed similar laws regulating consumer health data, and New York’s Health Information Privacy Act is awaiting the governor’s signature. The effects of state and federal privacy laws are potentially significant and may require us to modify our data processing practices and policies and to incur substantial costs and potential liability in an effort to comply with such legislation.

We cannot yet determine the full impact these laws or other such future laws, regulations and standards may have on our current or future business. Any of these laws may broaden their scope in the future, and similar laws have been proposed on both a federal level and in various states in the U.S. Such proposed legislation, if enacted, may add additional