Company: CSTL
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001447362-25-000031
Chunk: 79

Company: CASTLE BIOSCIENCES INC
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 79
---
 to access or amend certain records containing PHI, or to request restrictions on the use or disclosure of PHI. The HIPAA security regulations establish requirements for safeguarding the confidentiality, integrity, and availability of PHI that is electronically transmitted or electronically stored. HITECH, among other things, established certain health information security breach notification requirements. A covered entity must notify any individual whose PHI is breached according to the specifications set forth in the breach notification rule. The HIPAA privacy and security regulations establish a uniform federal “floor” and do not preempt state laws that are more stringent or provide individuals with greater rights with respect to the privacy or security of, and access to, their records containing PHI or insofar as such state laws apply to personal information that is broader in scope than PHI.

Individuals (or their personal representatives, as applicable) have the right to access test reports directly from laboratories and to direct the copies of those reports to be transmitted to persons or entities designated by the individual.

HIPAA authorizes state attorneys general to file suit on behalf of their residents for violations. Courts are able to award damages, costs and attorneys’ fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to file suit against us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care cases in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. In addition, HIPAA mandates that the Secretary of HHS conduct periodic compliance audits of HIPAA covered entities, such as us, and their business associates for compliance with the HIPAA privacy and security standards. It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the civil monetary penalty paid by the violator.

As a covered entity with downstream vendors and subcontractors and, in certain instances, as a business associate of other covered entities with whom we have entered into a business associate agreement, we have certain obligations under HIPAA regarding the use and disclosure of any PHI that may be provided to us. HIPAA and HITECH impose civil and criminal penalties against covered entities and business associates for noncompliance with privacy and security requirements. Further, various states, such as California and Massachusetts, have implemented similar privacy laws and regulations that impose restrictive requirements regulating the use and disclosure of health information and other personally identifiable information (“PII”).

Numerous other federal, state and foreign laws, including consumer protection laws and