may be subject to penalties, including significant civil and criminal penalties, damages, fines, disgorgement, exclusion from participation in government healthcare programs, such as Medicare and Medicaid, imprisonment, and the curtailment or restructuring of our operations, any of which could adversely affect our business, financial condition, results of operations, and prospects.
The U.S. Supreme Court’s June 2024 decision in Loper Bright Enterprises v. Raimondo overturned the longstanding Chevron doctrine, under which courts were required to give deference to regulatory agencies’ reasonable interpretations of ambiguous federal statutes. The Loper decision could result in additional legal challenges to regulations and guidance issued by federal agencies, including FDA and the Center for Medicare & Medicaid Services, on which we rely. Any such legal challenges, if successful, could have a material impact on our business. Additionally, the Loper decision may result in increased regulatory uncertainty, inconsistent judicial interpretations, and other impacts to the agency rulemaking process, any of which could adversely impact our business and operations. We cannot predict the likelihood, nature or extent of government regulation that may arise from future legislation or administrative action or as a result of legal challenges, either in the United States or abroad. If we are slow or unable to adapt to changes in existing requirements or the adoption of new requirements or policies, or if we are not able to maintain regulatory compliance, our business could be materially harmed.
Governments outside the United States tend to impose strict price controls, which may adversely affect our revenue, if any.
In some countries, particularly in the EU, the pricing of prescription pharmaceuticals is subject to governmental control. In these countries, pricing negotiations with governmental authorities can take considerable time after the receipt of marketing approval for a drug. To obtain coverage and reimbursement or pricing approval in some countries, we may be required to conduct a clinical trial that compares the cost-effectiveness of our product candidate to other available therapies. In addition, many countries outside the U.S. have limited government support programs that provide for reimbursement of drugs such as our product candidates, with an emphasis on private payors for access to commercial products. If reimbursement of our products, if approved, is unavailable or limited in scope or amount, or if pricing is set at unsatisfactory levels, our business could be materially harmed.
We are subject to stringent and evolving U.S. and foreign laws, regulations, rules, contractual obligations, and policies related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse business consequences.
In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process or processing) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, employee data, intellectual property, data we collect about trial participants in connection with clinical trials, and other sensitive third-party data (collectively, sensitive data). Our data processing activities may subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security.
Various federal, state, local and foreign legislative and regulatory bodies, or self-regulatory organizations, may expand current laws, rules or regulations, enact new laws, rules or regulations or issue revised rules or guidance regarding data privacy and security. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health information. Additionally, the California Consumer Privacy Act (“CCPA”) applies to personal information of consumers, business representatives, and employees, and among other things requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights, including the right to opt out of certain disclosures of their information. The CCPA provides for civil penalties of up to $7,500 per violation as well as a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated with
