Company: VCYT
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001384101-25-000014
Chunk: 98

Company: VERACYTE, INC.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 98
---
 on the facts and circumstances, we could be subject to civil and criminal penalties if we obtain, use, or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA. 

The CCPA established individual privacy rights for California consumers and places increased privacy and data security obligations on entities handling personal information of consumers or households. The CCPA was amended several times after its enactment, most recently by the CPRA, which, as of its effective date of January 1, 2023, gives California residents expanded privacy rights, including the right to opt out of certain personal information sharing, the use of “sensitive personal information,” and the use of personal information for automated decision-making or targeted advertising.  The CCPA and CPRA provide for civil penalties and a private right of action for data breaches that are expected to increase data breach litigation. The CCPA and CPRA may increase our compliance costs and potential liability , and it remains unclear what, if any, further amendments will be made to this legislation or how it will be interpreted. Following the lead of California, several other states, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New 

47

Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia have each enacted laws similar to the CCPA/CPRA. The multiple layers of privacy law within the United States could increase our potential liability, increase our compliance costs, and adversely affect our business.

Other countries outside of the United States and Europe have enacted or are considering enacting international data transfer restrictions and laws requiring local data residency and restricting international data transfer, which could increase the cost and complexity of delivering our services and operating our business. For example, Brazil's General Data Protection Law (as amended by Law No. 13,853/2019) contains restrictions on international transfer and heightened requirements on data concerning health, genetic and biometric data. China’s Personal Information Protection Law (effective November 2021), together with the Cyberspace Administration of China’s Measures on Security Assessment on Cross-border Data Transfer, broadly regulate the processing and international transfer of personal information and impose compliance obligations and penalties comparable to those of the GDPR.

In addition, the interpretation and application of consumer, health-related and data protection laws in the United States, Europe and elsewhere are often uncertain, contradictory, and in flux. It is possible that these laws may be interpreted and enforced in a manner that we