Company: HCWB
Filing Date: 2025-03-28
Form Type: 10-K
Source: 0000950170-25-046724
Chunk: 52

Company: HCW Biologics Inc.
Filing Date: 2025-03-28
Form: 10-K
Item: Item 1
Chunk 52
---
 information privacy laws, and federal and state consumer protection laws and regulations that govern the collection, use, disclosure, and protection of health-related and other personal information could apply to our operations or the operations of our partners. For example, HIPAA, as amended by HITECH, and their respective implementing regulations, imposes privacy, security and breach notification obligations on certain health care providers, health plans, and health care clearinghouses, known as covered entities, as well as their business associates that perform certain services that involve creating, receiving, maintaining or transmitting individually identifiable health information for or on behalf of such covered entities. Entities that are found to be in violation of HIPAA may be subject to significant civil, criminal and administrative fines and penalties, and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. Further, entities that knowingly obtain, use, or disclose individually identifiable health 

34 

information maintained by a HIPAA covered entity in a manner that is not authorized or permitted by HIPAA may be subject to criminal penalties.

Even when HIPAA does not apply, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.

In addition, certain state and non-U.S. laws, such as the General Data Protection Regulation (the “GDPR”) govern the privacy and security of personal information, including health-related information, in certain circumstances. Failure to comply with these laws, where applicable, can result in the imposition of significant civil and/or criminal penalties and private litigation. For example, the California Consumer Privacy Act (“CCPA”), which went into effect on January 1, 2020, creates new data privacy obligations for covered companies and provides new privacy rights to California residents. On January 1, 2023, the California Privacy Rights Act (“CPRA”), which substantially amends the CCPA, went into effect. The CCPA and CPRA provide for unlimited civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. Virginia’s Consumer Data Protection Act, which took effect on January 1, 2023, requires businesses subject to the legislation to conduct data protection assessments in certain circumstances and requires opt-in consent from consumers to acquire and process their sensitive personal information, which includes information revealing a consumer’s physical