Company: CORT
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-008167
Chunk: 22

Company: CORCEPT THERAPEUTICS INC
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 22
---
 volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. In 2024, the FTC finalized updates to the Health Breach Notification Rule that, among other things, clarified its applicability to health apps and other similar technologies and expanded the information the breach notification requirements for entities subject to the rule, which may add additional complexity to compliance obligations going forward.

In addition, certain state laws govern the privacy and security of health information in certain circumstances, some of which are more stringent than HIPAA and many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Failure to comply with these laws, where applicable, can result in the imposition of significant civil and/or criminal penalties and private litigation. For example, the California Confidentiality of Medical Information Act imposes restrictive requirements regulating the use and disclosure of health information and other personally identifiable information. Further, the California Consumer Privacy Act which took effect on January 1, 2020, and was later revised and expanded by the California Privacy Rights Act (collectively, “CCPA”), created individual privacy rights for California consumers and increased the privacy and security obligations of entities handling certain personal information as well as limitations on data uses, audit requirements for higher risk data, and opt outs for certain uses of sensitive data. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. It also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The CCPA may increase our compliance costs and potential liability. Similar laws passed in Virginia, Colorado, Connecticut, Montana, Oregon, Texas, and Utah took effect in 2023 and 2024. Additionally, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Rhode Island and Tennessee have adopted privacy laws, which take effect from January 1, 2025 through 2026. In addition, some of these laws (including the CPRA), along with other standalone health privacy laws, subject health-related information to additional safeguards and disclosures and some specifically regulate consumer health data. For example, Washington’s My Health My Data Act, effective as of March 31, 2024, imposes similar requirements specific to consumer health data. Similar laws have also passed in Connecticut and