Company: DOMO
Filing Date: 2025-12-09
Form Type: 10-Q
Source: 0001628280-25-055921
Chunk: 39

Company: DOMO, INC.
Filing Date: 2025-12-09
Form: 10-Q
Item: Item 1A
Chunk 39
---
, as well as costs of compliance generally, could harm our financial condition. The regulatory environment applicable to the collection, use, and other processing of, and security measures with respect to, personal data of residents of the E.U., United Kingdom, Switzerland, Brazil, the PRC, and other foreign jurisdictions, and our actions taken in response, may cause us to be required to undertake additional contractual negotiations, modify policies and procedures, and otherwise to assume additional liabilities or incur additional costs, and could result in our business, operating results, and financial condition being harmed. 

We enter into business associate agreements with our customers who require them in order to comply with the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act, and therefore we are directly subject to certain provisions of HIPAA applicable to business associates. We may collect and process protected health information as part of our designated service, which may subject us to a number of data protection, security, privacy, and other government- and industry-specific requirements. In addition, if we are unable to comply with our obligations relating to the protection and processing of protected health information, we could be found to have breached our contracts with customers with whom we have a business associate relationship. Noncompliance with laws and regulations relating to privacy and security of personal information, including HIPAA, or with contractual obligations, including under any business associate agreement, may lead to significant fines, civil and criminal penalties, and other liabilities. The U.S. Department of Health and Human Services (HHS) audits the compliance of business associates and enforces HIPAA privacy and security standards. HHS enforcement activity has increased in recent years and HHS has signaled its intent to continue this trend. Implementing rules under HIPAA addressing privacy, and a related statute addressing security, are the subject of final and proposed modifications, respectively. In addition to HHS, state attorneys general are authorized to bring civil actions seeking either injunctions or damages to the extent violations implicate the privacy of state residents.

We expect laws, regulations, industry standards and other obligations worldwide relating to privacy, data protection, and cybersecurity to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations in these areas. For example, the Network and Information Security Directive II (NIS2), adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential services in the E.U. It expands the scope of the 2016