Company: PHAT
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0000950170-25-034183
Chunk: 186

Company: Phathom Pharmaceuticals, Inc.
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1A
Chunk 186
---
 

79

of individually identifiable health information. While we are not a covered entity under HIPAA, we interact with healthcare providers regulated by HIPAA as covered entities. Certain states have also adopted comprehensive and health-specific privacy and security laws and regulations, some of which may be more stringent than HIPAA. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the CCPA requires covered businesses that process the personal information of California residents to, among other things: (i) provide certain disclosures to California residents regarding the business’s collection, use, and disclosure of their personal information; (ii) receive and respond to requests from California residents to access, delete, and correct their personal information, or to opt out of certain disclosures of their personal information; and (iii) enter into specific contractual provisions with service providers that process California resident personal information on the business’s behalf. Similar laws have passed in other states, and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent regulation in the United States of the collection, use, disclosure and other processing of personal information. The enactment of such laws creates the potential for a patchwork of overlapping, but different and potentially conflicting, requirements that may make compliance challenging. In the event that we become subject to HIPAA, the CCPA and similar state privacy laws, compliance will likely involve significant expenditure and resources, and any failure or perceived failure to comply with the requirements of these laws could adversely affect our business, results of operations and financial condition.  

Furthermore, the FTC and many state Attorneys General continue to enforce federal and state consumer protection laws against in relation to a variety of data privacy and security issues, such as promises made in privacy policies or failures to appropriately protect information about individuals, as unfair or deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act or similar state laws. The FTC expects a company’s cybersecurity measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities.

Given our past sponsorship of clinical trials at sites in Europe, we are also subject to GDPR which impose comprehensive data privacy compliance obligations in relation to processing the personal data of individuals within the EEA and UK. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust