Company: ADPT
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000950170-25-030913
Chunk: 37

Company: Adaptive Biotechnologies Corp
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1
Chunk 37
---
 certain categories of LDTs would have been grandfathered and exempt from certain regulatory requirements including premarket review, labeling requirements, test design requirements, and quality requirements. The VALID Act bill has yet to be passed in any form.

Federal and State Privacy, Security and Breach Notification Laws 

Many state and federal laws govern the processing of personal information or individually identifiable health information. At the federal level, under the administrative simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”), the U.S. Department of Health and Human Services (“HHS”) issued regulations that establish standards for protecting the privacy and security of “protected health information” used or disclosed by certain healthcare providers and other “covered entities” and their “business associates.” Three principal data protection-related regulations with which we are required to comply have been issued in final form under HIPAA and HITECH: privacy regulations, security regulations and security breach notification regulations.

The privacy regulations govern the use and disclosure of protected health information by covered healthcare providers, as well as health insurance plans. They also set forth certain rights that an individual has with respect to his or her protected health information maintained by a covered health care provider, including the right to access or amend certain records containing protected health information or to request restrictions on the use or disclosure of protected health information. The security regulations establish requirements for safeguarding the confidentiality, integrity and availability of protected health information that is electronically transmitted or electronically stored. HITECH, among other things, established certain health information security breach notification requirements. A covered entity must notify HHS and each affected individual of a breach of unsecured protected health information and must also notify the media if the breach involves more than 500 individuals. 

HIPAA violations are subject to civil and criminal penalties. Additionally, to the extent that we submit electronic healthcare claims and payment transactions that do not comply with the electronic data transmission standards established under HIPAA and HITECH, payments to us may be delayed or denied. 

Section 5(a) of the Federal Trade Commission Act (“FTCA”) has also been used to regulate data privacy and security at the federal level. According to the U.S. Federal Trade Commission (“FTC”), failing to take appropriate steps to keep consumers’ personal information secure or using or disclosing personal information in violation of a company’s privacy notice may constitute unfair or deceptive acts or practices in or affecting commerce in violation of the FTCA. The FTC