Company: EVCM
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001853145-25-000009
Chunk: 69

Company: EverCommerce Inc.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1A
Chunk 69
---
 another and may conflict with other requirements or our practices. At the state level, lawmakers continue to pass new laws concerning privacy and data security. For example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”) requires covered businesses that process the personal information of California residents to, among other things: (i) provide certain disclosures to California residents regarding the business’s collection, use, and disclosure of their personal information; (ii) receive and respond to requests from California residents to access, delete, and correct their personal information, or to opt out of certain disclosures of their personal information; and (iii) enter into specific contractual provisions with service providers that process California resident personal information on the business’s behalf.

Similar laws have passed in other states, and are continuing to be proposed at the state and federal level. Recent and new state and federal legislation relating to privacy may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment in resources to compliance programs, could impact strategies and availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies.

HIPAA imposes privacy, security and breach notification obligations on “covered entities,” including certain health care providers, health plans, and health care clearinghouses, and their respective “business associates” that create, receive, maintain or transmit individually identifiable health information for or on behalf of a covered entity, with respect to safeguarding the privacy, security and transmission of individually identifiable health information, as well as their covered subcontractors. Entities that are found to be in violation of HIPAA, whether as the result of a breach of unsecured protected health information (“PHI”), a complaint about privacy practices, or an audit by the U.S. Department of Health and Human Services (“HHS”), may be subject to significant civil, criminal, and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. Additionally, if we or our subcontractor business associates fail to comply with HIPAA or contractual requirements, or are otherwise involved in a HIPAA data breach, we may face significant fines and penalties, ongoing compliance requirements, reputational harm, contractual reimbursement, recoupment or other obligations, FTC enforcement actions and private litigation brought by impacted individuals.

I-31

Furthermore, the FTC and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection,