Company: CORT
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-008167
Chunk: 45

Company: CORCEPT THERAPEUTICS INC
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 45
---
 in certain circumstances, some of which are more stringent than HIPAA and many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Failure to comply with these laws, where applicable, can result in the imposition of significant civil and/or criminal penalties and private litigation. For example, the California Confidentiality of Medical Information Act imposes restrictive requirements regulating the use and disclosure of health information and other personally identifiable information. Further, the California Consumer Privacy Act, which took effect on January 1, 2020, and was later revised and expanded by the California Privacy Rights Act, collectively the CCPA, created individual privacy rights for California consumers and increased the privacy and security obligations of entities handling certain personal information as well as limitation on data uses, audit requirements for higher risk data, and opt outs for certain uses of sensitive data. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability. It also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. Similar laws passed in Virginia, Colorado, Connecticut, Montana, Oregon, Texas and Utah have taken effect in 2023 and 2024 and other states, including Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Rhode Island, and Tennessee, have passed similar laws that will take effect in or after 2025. In addition, along with the CPRA, some of these laws, along with other standalone health privacy laws, subject health-related information to additional safeguards and disclosures and some specifically regulate consumer health data, such as the Washington My Health My Data Privacy Law, which became effective in 2024, Nevada’s Consumer Health Data Privacy Law, which became effective in 2024, and Connecticut’s amendments to its privacy law to address health data, which became effective in 2023. As a result, additional compliance investment and potential business process changes may be required. In the event that we are subject to or affected by HIPAA, the CCPA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition. Additional legislation proposed at the federal level and in other states, along with increased regulatory action, reflect a trend toward more stringent privacy legislation in the United States.

Outside the United States, many jurisdictions have or