13 Many states have similar laws and regulations that may differ from federal law in significant ways, thus complicating compliance efforts. For example, states have anti-kickback and false claims laws that may be broader in scope than analogous federal laws and may apply regardless of payor. In addition, the federal physician payment transparency requirements, sometimes referred to as the “Physician Payments Sunshine Act,” created under the ACA and its implementing regulations, require certain manufacturers of drugs, devices, biologics and medical supplies for which payment is available under Medicare, Medicaid or the Children’s Health Insurance Program (with certain exceptions) to report annually to CMS information related to payments or other transfers of value made to physicians (defined to include doctors, dentists, optometrists, podiatrists and chiropractors), other healthcare professionals (such as physician assistants and nurse practitioners) and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family members. HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, or HITECH, and their respective implementing regulations, impose requirements on certain covered healthcare providers, health plans, and healthcare clearinghouses and their respective business associates that perform services for them that involve the use, or disclosure of, individually identifiable health information as well as their covered subcontractors, relating to the privacy, security, and transmission of such individually identifiable health information. In addition, state data privacy laws that protect the security of health information may differ from each other and may not be preempted by federal law. Moreover, several states and local jurisdictions have enacted legislation requiring pharmaceutical manufacturers to, among other things, establish marketing compliance programs, file periodic reports with the state, make periodic public disclosures on sales and marketing activities, report information related to drug pricing, require certain regulatory licenses to manufacture or distribute products commercially and/or the registration of sales representatives, and prohibit certain other sales and marketing practices. In addition, the approval and commercialization of any of our product candidates outside the United States will also likely subject us to foreign equivalents of the healthcare laws mentioned above. Pricing and rebate programs must comply with the Medicaid rebate requirements of the U.S. Omnibus Budget Reconciliation Act of 1990 and more recent requirements in the ACA. If products are made available to authorized users of the Federal Supply Schedule of the General Services Administration, additional laws and requirements apply. Products must meet applicable child-resistant packaging requirements under the U.S. Poison Prevention Packaging Act. Manufacturing, sales, promotion and other activities also are potentially subject to federal and state consumer protection and unfair competition laws. The manufacturing and distribution of biologic and pharmaceutical products is subject to additional requirements and regulations, including extensive record-keeping, licensing, storage and security requirements intended to prevent the unauthorized sale of pharmaceutical products. Failure to maintain compliance with these healthcare laws could result in the imposition of significant civil, criminal and administrative penalties, damages, disgorgement, monetary fines, imprisonment, possible exclusion from participation in Medicare, Medicaid and other federal healthcare programs, contractual damages, reputational harm, diminished profits and future earnings and curtailment of our operations, any of which could adversely affect our ability to operate our business and our results of operations. Data Privacy and Security Data privacy and security laws in the U.S. are also increasingly complex and changing rapidly. Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. These state laws allow for statutory fines for noncompliance. In addition, the processing of personal data in connection with clinical trials in the EU must comply with the EU’s General Data Protection Regulation, or EU GDPR. The EU GDPR imposes stringent data protection requirements and provides for penalties for noncompliance that can include bans on processing personal data and fines of up to the greater of 20 million euros or four percent of worldwide annual revenues. The EU GDPR requires organizations to give detailed disclosures about how they collect, use and share personal data; under certain conditions, obtain explicit consent to process sensitive personal data, such as health or genetic information; contractually require vendors to meet data protection requirements; maintain adequate data security measures; notify regulators and affected individuals of certain data breaches; meet extensive privacy governance and documentation requirements; and afford individuals’ data protection rights, including their rights to access, correct and delete their personal data. European data protection laws generally restrict the transfer of personal data from Europe, including from the European Economic Area, or EEA, the United Kingdom and Switzerland, to the U.S. and most other countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data. Legal challenges have in the past and may in the future be successful in limiting the mechanisms available to transfer personal data across national borders.