Company: SRPT
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-029973
Chunk: 225

Company: Sarepta Therapeutics, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1
Chunk 225
---
 sensitive information, including personal information and health-related data, which subjects us to numerous evolving and complex data privacy and security obligations, including various laws, regulations, guidance, and industry standards. Within the U.S., there are numerous federal and state laws and regulations related to the privacy and security of personal information. For example, at the federal level, HIPAA, as amended, and its implementing regulations establish privacy and security standards that limit the use and disclosure of individually identifiable health information, or protected health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information. While we have determined that we are neither a “covered entity” nor a “business associate” directly subject to HIPAA, many of the U.S. health care providers with which we interact are subject to HIPAA, and we may have assumed obligations related to protecting the privacy of personal information. States are increasingly regulating the privacy and security of personal information. In some states, such as California and Washington, state privacy laws are even more protective than HIPAA. For example, the CCPA, regulates companies’ use and disclosure of the personal information of California residents and grants California residents several rights with respect to their personal information. The CCPA also provides for civil penalties for violations, including statutory fines for noncompliance, as well as a limited private right of action in connection with certain data breaches, and establishes a new regulatory agency to implement and enforce the law. In addition, almost 20 other states have now passed comprehensive privacy laws that have taken effect or will come into effect at various times over the next few years. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may require us to modify our data processing practices and policies, divert resources from other initiatives and projects and could restrict the way services involving data are offered, all of which may adversely affect our results of operations. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, than federal or other state laws, and such laws may differ from each other, which may complicate compliance efforts. State laws are changing rapidly and there is ongoing discussion in Congress of a new federal data protection and privacy law to which we may be subject. We will continue to monitor and assess the impact of these state laws, which may impose substantial penalties for violations, impose significant costs for investigations and compliance, and carry significant potential liability for our business. 

Outside of the U.S., data protection laws, including the GDPR, which also forms