38
If we fail to comply with laws and regulations relating to the collection,
storage and processing of sensitive
personal information or standards in electronic health records or transmissions,
we could be required to make
significant changes to our products, or incur substantial fines, penalties, or
other liabilities.
Our businesses that involve physician and dental practice management
products, equipment and our specialty home
medical supplies businesses, and our self-funded employee benefits programs
include information technology (IT)
systems that store and process personal health, clinical, financial, and
other sensitive information of individuals.
These IT systems may be vulnerable to breakdown, wrongful intrusions, data
breaches and malicious attack, which
could require us to expend significant resources to eliminate these
problems and address related security concerns,
and could involve claims against us by private parties and/or governmental agencies.
We are directly or indirectly subject to numerous and evolving federal, state, local and foreign laws and regulations
that protect the privacy and security of personal information (including
health data), such as HIPAA, CAN-SPAM,
TCPA, Section 5 of the FTC Act, the CCPA
and various other privacy laws that have or will soon come into
effect.
Laws and regulations relating to privacy and data protection are
continually evolving and subject to potentially
differing interpretations, including those relating to AI.
These requirements may not be harmonized, may be
interpreted and applied in a manner that is inconsistent from one jurisdiction
to another or may conflict with other
rules or our practices.
In addition, cybersecurity laws such as the federal Cyber Incident
Reporting for Critical
Infrastructure Act of 2022, proposed Federal Acquisition Regulations and
amendments to SEC reporting
requirements may require us to provide notifications about cybersecurity
incidents in limited timeframes and before
investigations are complete.
Our businesses’ failure to comply with these laws and regulations
could expose us to
breach of contract claims, substantial fines, penalties and other
liabilities and expenses, costs for remediation and
harm to our reputation.
Evolving laws and regulations in this area could restrict the
ability of our customers to
obtain, use or disseminate patient information, or could require us
to incur significant additional costs to re-design
our products to reflect these legal requirements, which could have
a material adverse effect on our operations.
In addition, the European Parliament and the Council of the EU adopted
the GDPR effective from May 25, 2018,
which increased privacy rights for Data Subjects, including individuals
who are our customers, suppliers and
employees.
The GDPR extended the scope of responsibilities for data controllers
and data processors, and
generally imposes increased requirements and potential penalties on companies,
such as us, that are either
established in the EU and process personal data of Data Subjects (regardless
the Data Subject location), or that are
not established in the EU but that offer goods or services to Data Subjects in the EU
or monitor their behavior in the
EU. Noncompliance can result in penalties of up to the greater of EUR 20
million, or 4% of global company
revenues (sanction that may be public), and Data Subjects may seek damages.
Member states may individually
impose additional requirements and penalties regarding certain limited
matters (for which the GDPR left some
room of flexibility), such as employee personal data.
With respect to the personal data it protects, the GDPR
requires, among other things, controller accountability, consents from Data Subjects or another acceptable legal
basis to process the personal data, notification within 72 hours
of a personal data breach where required, data
integrity and security, and fairness and transparency regarding the storage, use or other processing of the personal
data.
The GDPR also provides rights to Data Subjects relating notably
to information, access, rectification, erasure
of the personal data and the right to object to the processing.
Despite Brexit, the UK also has data protection laws
equivalent to the GDPR).
Switzerland enacted FADP.
Uncertainty about compliance with these data protection
laws remains, with the possibilities that data protection authorities located
in different EU Member States may
interpret GDPR differently, or requirements of national laws may vary between the EU Member States, or guidance
on GDPR and compliance practices may be often updated or otherwise revised.
Any of these events will increase
the complexity and costs of processing personal data in the European Economic
Area, UK or Switzerland or
concerning individuals located in these jurisdictions.
Effective November 1, 2021, China’s PIPL imposes specific rules for processing personal information and specifies
that the law shall also apply to personal information activities carried
out outside China but for the purpose of
providing products or services to PRC citizens.
Any non-compliance with these laws and regulations may
subject
us to fines, orders to rectify or terminate any actions that are deemed
illegal by regulatory authorities, other
penalties, reputational damage, or legal proceedings against us, which
may affect our business, financial condition
or results of operations.
The PIPL carries maximum penalties of CNY50 million or
5% of the annual revenue of
entities that process personal data.
Data protection laws in other countries are also quickly
evolving, with many