Company: SUPN
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001356576-25-000017
Chunk: 442

Company: SUPERNUS PHARMACEUTICALS, INC.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 442
---
 to patients’ rights to privacy apply to the Company’s business. The Company could be subject to allegations of patient privacy violations by both the federal government and the states in which the Company’s conducts its business. Regulations include, but are not limited to:

•The Federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), which prohibits a scheme to defraud any healthcare benefit program or making false statements relating to healthcare matters. Similar to the federal AKS, a person or entity does not need to have actual knowledge or specific intent to violate HIPAA in order to have committed a violation. On December 10, 2020, HHS released proposed modifications to the HIPAA Privacy Rule, which, if adopted, would change rules related to patient access to HIPAA protected records, among others. In 2021 OCR sought feedback on the proposed HIPAA changes. Publication of the Final Rule has not yet occurred;

•Effective April 26, 2024, HHS modified certain provisions of the HIPAA Privacy Rule to prohibit the use or disclosure of protected health information by a covered health care provider, health plan, or health care clearing house, or their business associate, to: (i) conduct a criminal, civil, or administrative investigation into or impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided; or (ii) identify any person for the purpose of conducting such investigation or imposing such liability;

•HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (commonly referred to as the HITECH Act), which imposes certain requirements relating to the privacy, security, and transmission of individually identifiable health information; and

•Various state and foreign laws also govern the privacy and security of health information in some circumstances, and many of these laws differ from each other in significant ways and often are not preempted by HIPAA.

Efforts to ensure that the Company's business arrangements will comply with applicable healthcare laws and regulations could be costly. If the Company's operations are found to be in violation of any of the laws described above or in violation of any 

49

Table of ContentsITEM 1A. RISK FACTORS.

governmental regulations that apply to us, then it may be subject to penalties, including civil and criminal penalties, damages, fines, and the curtailment, or restructuring of its operations. Any