Company: KROS
Filing Date: 2025-05-06
Form Type: 10-Q
Source: 0001664710-25-000046
Chunk: 85

Company: Keros Therapeutics, Inc.
Filing Date: 2025-05-06
Form: 10-Q
Item: Item 1A
Chunk 85
---
, state data breach notification laws, and federal and state consumer protection laws (including Section 5 of the Federal Trade Commission Act) and other similar laws (e.g., wiretapping laws), that govern the collection, use, disclosure and protection of health information and other personal information could apply to our operations or the operations of our collaborators. In addition, we obtain health information from third parties, including research institutions from which we obtain clinical trial data, that are subject to privacy and security requirements under HIPAA, as amended by HITECH, which imposes 

73

specific requirements relating to the privacy, security, and transmission of individually identifiable protected health information. Depending on the facts and circumstances, we could be subject to civil, criminal and administrative penalties and fines if we violate HIPAA. 

In addition, certain state and foreign laws govern the privacy and security of health information in certain circumstances, some of which are more stringent than U.S. federal law and many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. 

In the past few years, numerous U.S. states—including California, Virginia, Colorado, Connecticut, and Utah—have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, or the CPRA, collectively referred to as the CCPA, applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages.

Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. These developments further complicate compliance efforts, and increase legal