Company: WRBY
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001504776-25-000010
Chunk: 200

Company: Warby Parker Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 200
---
 paid a civil monetary penalty to OCR in December 2024 and the investigation was formally closed in February 2025.

HIPAA imposes mandatory civil and criminal penalties for certain violations. HIPAA also authorizes state attorneys general to file suit on behalf of their residents. While HIPAA does not create a private right of action that would allow individuals to sue in civil court for a HIPAA violation, its standards have been used as the basis for the duty of care in state civil suits, such as those for negligence or recklessness in misusing personal information. 

Many states in which we operate and in which our customers reside also have laws that protect the privacy and security of health information, many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts. For example, Washington has adopted the My Health My Data Act, a privacy law that imposes new state restrictions and requirements on the processing and sale of consumer health data and creates a private right of action, which took effect as to the substantial majority of the legislation in March 31, 2024. Where state laws are more protective than HIPAA, we have to comply with the stricter provisions, absent statutory exemptions. Whether and how these exemptions will be applied under new laws such as the My Health My Data Act and the CCPA and CPRA is an unsettled area of law. In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused, such as the CCPA and CPRA. 

In addition, laws, regulations, and standards covering marketing, advertising, and other activities conducted by telephone, email, mobile devices, and the internet may be or become applicable to our business, including consumer protection and communication privacy laws. For example, the Telephone Consumer Protection Act, or TCPA, imposes significant restrictions on the ability to make telephone calls or send text messages to mobile telephone numbers without the prior consent of the person being contacted. Claims that we have violated the TCPA could be costly to litigate, and if successful, expose us to substantial statutory damages.

Foreign privacy laws are also rapidly changing, have become more stringent in recent years, and may increase the costs and complexity of offering our offerings in new geographies. In Canada, where we operate, the Personal Information Protection and Electronic Documents Act, or PIPEDA, and various provincial laws require that companies give detailed privacy notices to consumers, obtain consent to use personal information, with