Company: CRNX
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-029050
Chunk: 187

Company: Crinetics Pharmaceuticals, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 187
---
 laws, diminished profits and the curtailment or restructuring of our operations. Further, defending against any such actions can be costly, time-consuming and may require significant financial and personnel resources. Therefore, even if we are successful in defending against any such actions that may be brought against us, our business may be impaired. If any of the physicians or other providers or entities with whom we expect to do business are found to not be in compliance with applicable laws, they may be subject to criminal, civil or administrative sanctions, including exclusion from government funded healthcare programs and imprisonment. If any of the above occur, it could adversely affect our ability to operate our business and our results of operations. 

Actual or perceived failures to comply with applicable data protection, privacy and security laws, regulations, standards and other requirements could have a material adverse effect on our business, financial condition or results of operations.

Privacy and data security have become significant issues in the U.S., E.U. and in many other jurisdictions where we may in the future conduct our operations. The legislative and regulatory landscape for privacy and data protection continues to evolve, and there has been an increasing focus on privacy and data protection issues, which may affect our business and may increase our compliance costs and exposure to liability. As we receive, collect, process, use and store personal and confidential data, we are or may be subject to diverse laws and regulations relating to data privacy and security. Compliance with these privacy and data security requirements is rigorous and time-intensive and may increase our cost of doing business, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation and reputational harm, which could materially and adversely affect our business, financial condition and results of operations.

In the U.S., we may be subject to data privacy and security regulation by both the federal government and the states in which we conduct our business. HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations, or collectively, HIPAA, impose, among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information held by covered entities and their business associates. We may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA. Depending on the 

48

facts and circumstances, we could be subject to criminal penalties if we knowingly receive individually identifiable health information from a HIPAA-covered entity in a manner that is not authorized or permitted by