Company: CORT
Filing Date: 2025-05-05
Form Type: 10-Q
Source: 0001628280-25-022173
Chunk: 191

Company: CORCEPT THERAPEUTICS INC
Filing Date: 2025-05-05
Form: 10-Q
Item: Part I, Item 4
Chunk 191
---
 and rules adopted by the SEC and by The Nasdaq Stock Market LLC have and will likely continue to increase our cost of doing business and divert management’s attention from revenue-generating activities.

We and our partners are subject to federal, state and foreign laws and regulations concerning data privacy and security, including HIPAA and the EU General Data Protection Regulation (“GDPR”). These and other regulatory frameworks are evolving rapidly as new rules are enacted and existing ones updated and made more stringent. 

In the United States, numerous federal and state laws and regulations, including state data breach notification laws, state health information privacy, laws, and federal and state consumer protection laws and regulations (e.g., Section 5 of the Federal Trade Commission Act), that govern the collection, use, disclosure, and protection of health-related and other personal information could apply to our operations or the operations of our partners. In addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA. Depending on the facts and circumstances, we could be subject to criminal penalties if we knowingly obtain, use, or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA. Requirements for compliance under HIPAA are also subject to change, as the U.S. Department of Health and Human Services Office of Civil Rights issued a proposed rule that would amend certain security compliance requirements for covered entities and business associates.

Even when HIPAA does not apply, according to the Federal Trade Commission (the “FTC”), violating consumers’ privacy or failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. In 2024, the FTC also finalized its rulemaking on additional data privacy rules and requirements, which may add additional complexity to compliance obligations going forward.

In addition, certain state laws govern the privacy and security of health information in certain circumstances, some of which are more stringent than HIPAA and many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Failure to