Company: TALK
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0000950170-25-038107
Chunk: 19

Company: Talkspace, Inc.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1
Chunk 19
---
 state laws could change rapidly, and there is currently a new federal privacy law or federal breach notification law under consideration to which we may be subject.

In addition to HIPAA and state health information privacy laws, we may be subject to other state and federal privacy laws, including laws that prohibit unfair privacy and security acts or practices and deceptive statements about privacy and security and laws that place specific requirements on certain types of activities, such as data security and texting. The FTC and states’ attorneys general have brought enforcement actions and prosecuted some data breach cases as unfair and/or deceptive acts or practices under the FTC Act and similar state laws. Further, the California Consumer Protection Act of 2018 (the “CCPA”), which took effect in 2020 and to which we are subject, imposes obligations and restrictions on businesses regarding their collection, use, and sharing of personal information and provides new and enhanced data privacy rights to California residents, such as affording them the right to access and delete their personal information and to opt out of certain sharing of personal information. Additionally, the California Privacy Rights Act (“CPRA”), which came into effect on January 1, 2023, significantly amends and expands the CCPA, including by providing consumers with additional rights with respect to their personal information. The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA. Laws similar to the CCPA and CPRA have passed in Colorado, Connecticut, Iowa, Indiana, Montana, Tennessee, Texas, Oregon, Utah, Virginia, and Washington and are expected in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the United States.

In recent years, there have been a number of well publicized data breaches involving the improper use and disclosure of personal information and PHI. Many states have responded to these incidents by enacting laws requiring holders of personal information to maintain safeguards and to take certain actions in response to a data breach, such as providing prompt notification of the breach to affected individuals and state officials and providing credit monitoring services and/or other relevant services to impacted individuals. In addition, under HIPAA, breach notification laws and pursuant to the related contracts that we enter into with our customers who are covered entities, we must report breaches of unsecured PHI to our customers following discovery of the breach. Notification must also be made in certain circumstances to affected individuals, federal authorities and others. 

10

Intellectual Property

It is important to our business that we establish intellectual property and maintain, protect