Company: ALGN
Filing Date: 2025-05-08
Form Type: 10-Q
Source: 0001097149-25-000034
Chunk: 103

Company: ALIGN TECHNOLOGY INC
Filing Date: 2025-05-08
Form: 10-Q
Item: Item 1A
Chunk 103
---
 or remediate cybersecurity or other security vulnerabilities or problems or enact changes to minimize the attack surface of our network.

Additionally, our iTero intraoral scanners may be independently or collectively the target of cybersecurity incidents or attacks or subject to security vulnerabilities, bugs, errors, defects, or viruses or other malicious code. Due to the large and growing number of these decentralized devices, we may be unable, or not have the capacity, knowledge or infrastructure, to respond to or remedy a cybersecurity incident in a timely manner. Any such cybersecurity incident may cause loss or damage to us, our customers or strategic business partners or may cause further malfunctions in, or damage to, our products, services, or IT systems, damage to, or loss, unavailability, or unauthorized acquisition, use, or other processing of our data, or disruption, 

44 

interruption or temporary cessation of our operations. Further, any such security breach or incident, or other cybersecurity incident, or any belief or reporting that any of the foregoing has occurred, may otherwise have a negative impact upon our business or reputation.

We also are or may become, or alleged to be or become, subject to certain federal, state, and foreign laws and regulations respecting the security and privacy of patient healthcare information applicable to healthcare providers and their business associates, such as the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the HIPAA Standards for Privacy of Individually Identifiable Health Information and the Security Standards for the Protection of Electronic Protected Health Information under HIPAA and the Health Information Technology for Economic and Clinical Health Act of 2009 , as well as those relating to privacy, data security, content regulation and consumer protection, such as the California Consumer Protection Act, as amended by the California Privacy Rights Act (as amended, the “CCPA”). The CCPA requires covered businesses that process personal information of California residents to disclose certain practices, provides California residents with data privacy rights, imposes operational requirements, and provides for significant civil penalties for violations as well as a private right of action for certain data breaches and statutory damages. There are limited exemptions under the CCPA for protected health information covered by HIPAA and certain other state laws, but the CCPA and other new and evolving state laws could impact our business activities. Numerous other states have enacted, or plan to enact, laws relating to privacy, data protection, data governance and cybersecurity, with such enacted laws either in operation or slated to go into operation over the next several years. Many of these laws are comprehensive privacy laws similar