Company: PHR
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001412408-25-000010
Chunk: 74

Company: Phreesia, Inc.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1
Chunk 74
---
 (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), creates individual privacy rights for California consumers (as defined in the law) and places increased privacy and security obligations on entities handling personal data of consumers or households. The CCPA requires covered companies to provide certain disclosures to consumers about its data collection, use and sharing practices, and provides consumers with additional rights in their personal data, such as to have their data deleted and to opt-out of certain sales or transfers of personal information. While any information we maintain in our role as a business associate may be exempt from the CCPA, other records and information we maintain may be subject to the CCPA. 

In addition to the CCPA, new privacy and data security laws have been enacted in numerous other states and have been proposed in even more states as well as in the U.S. Congress, reflecting a trend toward more stringent privacy legislation in the U.S., which may accelerate. Some of these laws are similar in scope to the CCPA, while other state laws, such as Washington’s My Health My Data Act or U.S. state biometric privacy laws, apply to distinct subsets of sensitive personal data, impose additional and different requirements on businesses, and grant distinct privacy 

15

rights to consumers. The legislature in New York recently passed the Health Information Privacy Act. While the legislation has not been signed by the Governor, if enacted, the legislation would create protections for certain regulated health information, including limitations on processing such information without authorization unless such processing is strictly necessary for providing or maintaining a specific product or service requested by the individual, conducting internal business operations, or certain other purposes. A request for authorization would have to be made at least 24 hours after an individual creates an account or first uses the requested service. The legislation would also prohibit making the provision of a product or service contingent on an individual providing authorization for processing of their regulated health information. The legislation would not apply to protected health information collected by a covered entity or business association or information collected as part of a clinical trial regulated by the Federal Policy for the Protection of Human Subjects which is commonly known as the Common Rule.  

We expect that there will continue to be new proposed and amended laws, regulations and industry standards concerning privacy, data protection and information security in the U.S. Already in the U.S. we have witnessed significant developments at the state level. These new laws and proposed legislation have added additional complexity, variation in requirements, restrictions and potential legal risk, and required additional investment of resources in compliance programs and impact strategies