Company: ADPT
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000950170-25-030913
Chunk: 103

Company: Adaptive Biotechnologies Corp
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 103
---
-party contractors’ computer networks. Any wrongful use or disclosure of PHI by us or our third-party contractors, including disclosure due to data theft or unauthorized access to our or our third-party contractors’ computer networks, could subject us to fines or penalties that could adversely affect our business and results of operations. Although HIPAA and the regulations promulgated thereunder do not provide for a private right of action, we could incur damages under state laws to private parties for the wrongful use or disclosure of confidential health information or other private personal information. 

Further, various states, such as Washington, California and Colorado, have implemented similar privacy laws and regulations (such as the California Confidentiality of Medical Information Act, CCPA and California Privacy Rights Act) that impose restrictive requirements regulating the use and disclosure of personal information, while other states are considering adoption of similar provisions. These laws and regulations are not necessarily preempted by HIPAA, but they have a wider scope and afford greater protection to individuals than HIPAA. Where state laws are more protective, we and our collaborators must comply with the stricter provisions where they apply. In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. The interplay of federal and state laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and our customers and potentially exposing us to additional expense, adverse publicity and liability. Further, as regulatory focus on privacy, security and data use issues continues to increase and laws and regulations concerning the protection of personal information expand and become more complex, these potential risks to our immune medicine platform and related products and services could intensify. Changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, such as PHI, along with increased customer demand for enhanced data security infrastructure, could greatly increase the cost of providing our products and services, decrease demand for our products and services, reduce our revenue and subject us to additional liabilities. 

We currently operate in some and may eventually operate in additional countries outside of the U.S. whose laws may in some cases be more stringent than the requirements in the U.S. For example, the GDPR imposes strict rules on the transfer of personal data out of the EU to the U.S., and the obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other requirements or our practice. In addition, some countries have stricter consumer notice or consent requirements relating to personal data collection