Company: AMWL
Filing Date: 2025-02-12
Form Type: 10-K
Source: 0000950170-25-019024
Chunk: 76

Company: American Well Corp
Filing Date: 2025-02-12
Form: 10-K
Item: Item 1
Chunk 76
---
 that HHS conduct periodic compliance audits of HIPAA covered entities and their business associates for compliance. It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the Civil Monetary Penalty fine paid by the violator. In light of the HIPAA Omnibus Final Rule, recent enforcement activity, and statements from HHS, we expect increased federal and state HIPAA privacy and security enforcement efforts. 

Many states in which we operate and in which our patients reside also have laws or are in the process of adopting laws that protect the privacy and security of sensitive and personal information, including health information. These laws may be similar to or even more protective or broader than HIPAA and other federal privacy laws. Where state laws are more protective or broader than HIPAA, we must comply with the state laws we are subject to, in addition to HIPAA. In certain cases, it may be necessary to modify our planned operations and procedures to comply with these more stringent state laws. Not only may some of these state laws impose fines and penalties upon violators, but, unlike HIPAA, some may afford private rights of action to individuals who believe their personal information has been misused. In addition, state laws are changing rapidly, and there is discussion of a new federal privacy law or federal breach notification law, to which we may be subject. 

In addition to HIPAA and state health information privacy laws, we may be subject to other state and federal privacy laws, including laws that prohibit unfair privacy and security acts or practices and deceptive statements about privacy and security and laws that place specific requirements on certain types of activities, such as data security and texting. The FTC and state attorneys general have brought enforcement actions and prosecuted some data breach cases as unfair and/or deceptive acts or practices under the FTC Act and similar state laws. 

15

In recent years, there have been a number of well publicized data breaches involving the improper use and disclosure of PII and PHI. Many states have responded to these incidents by enacting laws requiring holders of personal information to maintain safeguards and to take certain actions in response to a data breach, such as providing prompt notification of the breach to affected individuals and state officials and provide credit monitoring services and/or other relevant services to impacted individuals. In addition, under HIPAA and pursuant to the related contracts that we enter into with our clients who are covered entities, we must report breaches of unsecured PHI to our clients following discovery of the breach. Notification must also be made in certain