Company: ERAS
Filing Date: 2025-03-20
Form Type: 10-K
Source: 0000950170-25-042682
Chunk: 224

Company: Erasca, Inc.
Filing Date: 2025-03-20
Form: 10-K
Item: Item 1A
Chunk 224
---
. The global data protection landscape is rapidly evolving, and we may be affected by or subject to new, amended or existing laws and regulations in the future, including as our operations continue to expand or if we operate in foreign jurisdictions. This evolution may create uncertainty in our business, and could affect our ability to operate in certain jurisdictions or to collect, store, transfer use and share personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, our internal policies and procedures or our contracts governing our processing of personal information could result in negative publicity, government investigations and enforcement actions, claims by third parties and damage to our reputation, any of which could have a material adverse effect on our business, results of operation, and financial condition. 

In the United States, there are numerous federal and state data privacy and security laws and regulations governing the collection, use, disclosure and protection of personal information, including health information privacy laws, security breach notification laws and consumer protection laws. Each of these laws is subject to varying interpretations and constantly evolving. By way of example, HIPAA imposes privacy and security requirements and breach reporting 

99

obligations upon “covered entities” (health plans, health care clearinghouses and certain health care providers), and their respective business associates and subcontractors, individuals or entities that create, receive, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity, as well as their covered subcontractors. We do not believe that we are currently acting as a covered entity or business associate under HIPAA and thus are not directly subject to its requirements or penalties. However, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA. Depending on the facts and circumstances, we could be subject to significant penalties if we violate HIPAA.

In addition, certain states have also adopted comprehensive and health-specific data privacy and security laws and regulations governing the privacy, processing and protection of personal information, some of which are more stringent than HIPAA. For example, the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020, imposes a range of obligations on covered businesses that process personal information about California residents.