Company: AGIO
Filing Date: 2025-05-01
Form Type: 10-Q
Source: 0001439222-25-000036
Chunk: 259

Company: AGIOS PHARMACEUTICALS, INC.
Filing Date: 2025-05-01
Form: 10-Q
Item: Part I, Item 4
Chunk 259
---
 we could be found to have breached our contracts. Further, if we fail to comply with applicable privacy laws, including applicable HIPAA privacy and security standards, we could face civil and criminal penalties. Enforcement activity by the U.S. Department of Health & Human Services, or HHS, can result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal resources. In addition, state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents. We cannot be sure how these regulations will be interpreted, enforced or applied to our operations. In addition to the risks associated with enforcement activities and potential contractual liabilities, our ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to our policies, procedures and systems. 

In addition to potential enforcement by HHS, we are also potentially subject to privacy enforcement from the Federal Trade Commission, or FTC. The FTC has been particularly focused on the unpermitted processing of health and genetic data through its recent enforcement actions and is expanding the types of privacy violations that it interprets to be “unfair” under Section 5 of the FTC Act of 1914, as well as the types of activities it views to trigger the Health Breach Notification Rule (which the FTC also has the authority to enforce). The agency is also in the process of developing rules related to commercial surveillance and 

37

data security that may impact our business. We will need to account for the FTC’s evolving rules and guidance for proper privacy and data security practices in order to mitigate our risk for a potential enforcement action, which may be costly. If we are subject to a potential FTC enforcement action, we may be subject to a settlement order that requires us to adhere to very specific privacy and data security practices, which may impact our business. We may also be required to pay fines as part of a settlement (depending on the nature of the alleged violations). If we violate any consent order that we reach with the FTC, we may be subject to additional fines and compliance requirements.

A number of states have passed comprehensive privacy laws, which are either currently in effect or will go into effect sometime over the next several years. These laws create obligations related to the processing of personal information, as well as special obligations for the processing of “sensitive” data (which includes health data in some cases). Some of the provisions of these laws may apply to our business activities. There are also states that are