Company: SNWV
Filing Date: 2025-03-20
Form Type: 10-K
Source: 0001628280-25-014141
Chunk: 14

Company: SANUWAVE Health, Inc.
Filing Date: 2025-03-20
Form: 10-K
Item: Item 1
Chunk 14
---
, thus creating potentially complex compliance issues for us and our future customers and strategic partners. Failure to comply with these laws, where applicable, can result in the imposition of significant civil and/or criminal penalties and private litigation.  By way of example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, (“CCPA”) gives California residents individual privacy rights to access and delete their personal information, opt out of certain personal information sharing, limit the use of their sensitive personal information, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches. The CCPA also established a new California agency, the California Privacy Protection Agency, which is authorized to issue new substantive regulations and has independent enforcement power alongside the California Attorney General. These additional rights and the establishment of an agency with independent enforcement powers are expected to increase data breach litigation and government enforcement activity in California. Comprehensive privacy legislation similar to the CCPA has been adopted in other U.S. states including Colorado, Connecticut, Kentucky, Maryland, Minnesota, Montana, New Jersey, New Hampshire, Nevada, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. In the event that we are subject to or affected by HIPAA, the CCPA, or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

In addition to the state comprehensive data privacy laws, recent years have brought substantial changes to the federal and state treatment of non-HIPAA consumer health information. At the federal level, the FTC brought three enforcement actions in 2023 against a range of companies that handle electronic health information relating to collection and disclosure of non-HIPAA covered consume health information under Section 5 of the FTC Act, two of which included allegations made under the FTC’s Health Breach Notification Rule (“HBNR”). The FTC’s focus on health information continued in 2024 with changes to the HBNR that clarified its scope and emphasized applicability to non-HIPAA health care providers as well as three additional enforcement actions against companies for their use of health information for advertising purposes. On the state level, Washington and Nevada have adopted significant new legislation addressing businesses treatment of consumer health information and Connecticut added more stringent protections for health information to its existing comprehensive state privacy law. In both Washington and Nevada’s laws, there are restrictive provisions limiting collection and disclosure of consumer health information, and Washington’s law provides a separate private