37 need to have actual knowledge of these statutes or specific intent to violate them in order to have committed a violation; • HIPAA, as amended by HITECH, and their respective implementing regulations, which impose requirements on certain covered healthcare providers, health plans and healthcare clearinghouses and their respective business associates and their subcontractors that perform services for them that involve the use, or disclosure of, individually identifiable health information as well as their covered subcontractors, relating to the privacy, security and transmission of individually identifiable health information; • the federal Physician Payments Sunshine Act, created under the ACA, and its implementing regulations, which require manufacturers of drugs, devices, biologicals and medical supplies for which payment is available under Medicare, Medicaid or the Children’s Health Insurance Program to report annually to CMS under the Open Payments Program, information related to payments or other transfers of value made to physicians (defined to include doctors, dentists, optometrists, podiatrists and chiropractors), other healthcare professionals (such as physician assistant and nurse practitioners), and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family members; • federal consumer protection and unfair competition laws, which broadly regulate marketplace activities and activities that potentially harm consumers; and • analogous state and foreign laws and regulations, such as state and foreign anti-kickback, false claims, consumer protection and unfair competition laws which may apply to pharmaceutical business practices, including but not limited to, research, distribution, sales and marketing arrangements as well as submitting claims involving healthcare items or services reimbursed by any third-party payor, including commercial insurers; state and local laws that require certain regulatory licenses to manufacture or distribute our products commercially and/or the registration of pharmaceutical sales representatives; state laws that require pharmaceutical companies to comply with the pharmaceutical industry’s voluntary compliance guidelines and the relevant compliance guidance promulgated by the federal government that otherwise restricts payments that may be made to healthcare providers and other potential referral sources; state laws that require drug manufacturers to file reports with states regarding pricing and marketing information, such as the tracking and reporting of gifts, compensations and other remuneration and items of value provided to healthcare professionals and entities; and state and foreign laws governing the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Because of the breadth of these laws and the narrowness of the statutory exceptions and safe harbors available, it is possible that some of our business activities could, despite our efforts to comply, be subject to challenge under one or more of such laws. Efforts to ensure that our business arrangements will comply with applicable healthcare laws may involve substantial costs. It is possible that governmental and enforcement authorities will conclude that our business practices may not comply with current or future statutes, regulations or case law interpreting applicable fraud and abuse or other healthcare laws and regulations. If any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, including the imposition of significant civil, criminal and administrative penalties, damages, disgorgement, monetary fines, imprisonment, possible exclusion from participation in Medicare, Medicaid and other federal healthcare programs, contractual damages, reputational harm, diminished profits and future earnings and curtailment of our operations, any of which could adversely affect our ability to operate our business and our results of operations. In addition, the approval and commercialization of any of our product candidates outside the United States will also likely subject us to foreign equivalents of the healthcare laws mentioned above, among other foreign laws. We and the third parties with whom we work are subject to stringent and evolving obligations related to data privacy and security. These obligations include U.S. and foreign laws, regulations and rules; contractual obligations; industry standards and policies. Our (or the third parties with whom we work) actual or perceived failure to comply with such obligations could lead to regulatory investigations and actions; litigation (including class claims) and arbitration; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue and profits; loss of sales and other adverse business consequences. In the ordinary course of business, we and the third parties with whom we work collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials, and sensitive third-party data (collectively, sensitive information). Our data processing activities subject us to numerous data privacy and security obligations such as various laws and regulations, as well as guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations related to data privacy and security. Data privacy and security laws and regulations are evolving and resulting in increased regulatory and public scrutiny and escalating levels of enforcement and sanctions.