Company: AMWL
Filing Date: 2025-02-12
Form Type: 10-K
Source: 0000950170-25-019024
Chunk: 131

Company: American Well Corp
Filing Date: 2025-02-12
Form: 10-K
Item: Item 1A
Chunk 131
---
 claims. 

Violations of HIPAA may result in significant civil and criminal penalties. HIPAA also authorizes state attorneys general to file suit on behalf of their residents. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. Any such penalties or lawsuits could harm our business, financial condition, results of operations and prospects. 

In addition, HIPAA mandates that the Secretary of the U.S. Department of Health and Human Services (“HHS”) conduct periodic compliance audits of HIPAA covered entities or business associates for compliance with the HIPAA Privacy and Security Standards. It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the Civil Monetary Penalty fine paid by the violator. 

Further, the U.S. federal government and various states and governmental agencies have adopted or are considering adopting various laws, regulations, rules and standards regarding the collection, use, retention, security, disclosure, transfer and other processing of sensitive and personal information. For example, the California Confidentiality of Medical Information Act imposes restrictive requirements regulating the use and disclosure of health information and other personally identifiable information, and the California Privacy Rights Act increases privacy rights for California residents and imposes obligations on companies that process their personal information. Where state laws are more protective than HIPAA, we have to comply with the stricter provisions. Violations of these laws could result in significant fines and penalties, and, if these laws afford private rights of action to individuals, data breach litigation.  

There are numerous foreign laws, regulations, rules, standards and directives regarding privacy and the collection, storage, transmission, use, processing, disclosure and protection of PII and other personal or client data, the scope of which is continually evolving and subject to differing interpretations. If we provide digital care services outside the United States, we must comply with such laws, regulations and directives and we may be subject to significant consequences, including penalties and fines, for our failure to comply. For example, we must comply with GDPR and the applicable national data protection laws in the European Union and the UK GDPR in the United Kingdom. The GDPR and the UK GDPR may increasingly diverge from each other, exposing us to additional compliance obligations. Further, European data protection law also imposes strict rules on the transfer of personal data out of the EEA