Company: PHR
Filing Date: 2025-12-09
Form Type: 10-Q
Source: 0001412408-25-000132
Chunk: 447

Company: Phreesia, Inc.
Filing Date: 2025-12-09
Form: 10-Q
Item: Part I, Item 4
Chunk 447
---
 to avoid unauthorized access or other adverse impacts to such data or our systems. 

In addition, some of our third-party service providers and partners, such as Change Healthcare and other clearinghouses, also collect and/or store our sensitive information and our clients' data on our behalf, and these service providers and partners have in the past, and may in the future be subject to similar threats of cyber-attacks and other malicious internet-based activities, which could also expose us to risk of loss, litigation, and potential liability. Even though we may have contractual protections with such vendors, contractors, or other organizations, notifications and follow-up actions related to a cybersecurity incident or data breach could impact our reputation, cause us to incur significant costs, including legal expenses, harm customer confidence, expose us to government enforcement action, hurt our expansion into new markets, cause us to incur remediation costs, or cause us to lose existing customers. The risk of state-supported and geopolitical-related cyber-attacks may increase in connection with political unrest or wars and any related political or economic responses and counter-responses. We may not discover all such cybersecurity incidents, data breaches, or other activity or be able to respond or otherwise address them promptly, in sufficient respects or at all.

We are subject to state laws requiring notification of affected individuals and state regulators in the event of a breach of personal information. Furthermore, certain health privacy laws, data breach notification laws, consumer protection laws and genetic testing laws may apply directly to our business and/or those of our collaborators and may impose restrictions on our collection, use and dissemination of individuals’ health information. Patients about whom we obtain health information, as well as the healthcare services clients who share this information with us, may have statutory or contractual rights that limit our ability to use and disclose the information. Additionally, our subsidiary, AccessOne MedCard, Inc. (“AccessOne MedCard”) is subject to regulation and supervision of 

56

cybersecurity and data privacy matters by state and federal regulators, including state financial regulatory agencies, the U.S. Federal Trade Commission (the “FTC”) and the Consumer Financial Protection Bureau (the “CFPB”), including the New York Department of Financial Services 23 NYCRR Part 500 Cybersecurity Requirements for Financial Services Companies (the “NYDFS Part 500 Requirements”), and the Graham-Leach-Bliley Act (the “GLBA”) and Regulation P promulgated thereunder, which, among other things, require financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data. We