The collection, maintenance, protection, use, transmission, disclosure and disposal of protected personal information are regulated at the federal, state, international and industry levels and addressed in requirements imposed on us by contracts with customers. Additionally, legislative and regulatory action in the United States at the federal, state and local levels, as well as internationally, is emerging in the areas of AI/ML and automation. These laws, regulations and requirements are subject to change. Compliance with new privacy, security, technology and data laws, regulations and requirements may result in increased operating costs, and may constrain or require us to alter our business model or operations.
Internationally, many of the jurisdictions in which we operate have established their own data security and privacy legal framework with which we or our customers must comply. We expect there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection, information security, and AI/ML and automation in the European Union, UK, Chile, India and other jurisdictions, and we cannot yet determine the impacts such future laws, regulations and standards may have on our businesses or the businesses of our customers. For example, the European Union’s General Data Protection Regulation (GDPR) imposes stringent European Union data protection requirements on us or our customers, and prescribes substantial penalties for noncompliance.
Many of our businesses are also subject to the Payment Card Industry Data Security Standard, which is a multifaceted security standard designed to protect payment card account data.
HIPAA requires business associates as well as covered entities to comply with specified privacy and security requirements. While we provide for appropriate protections through our contracts with our third-party service providers and in certain cases assess their security controls, we have limited oversight or control over their actions and practices. Several of our businesses act as business associates to their covered entity customers and, as a result, collect, use, disclose and maintain protected personal information in order to provide services to these customers. HHS administers its audit program to assess HIPAA compliance efforts by covered entities and business associates. An audit resulting in findings or allegations of noncompliance could damage our reputation and subject us to monetary and other sanctions.
Through our Optum businesses, we maintain a database of administrative and clinical data statistically de-identified in accordance with HIPAA standards. Noncompliance or findings of noncompliance with applicable laws, regulations or requirements, or the occurrence of any privacy or security breach involving the misappropriation, loss or other unauthorized disclosure of protected personal information, whether by us or by one of our third-party service providers, could have a material adverse effect on our reputation and business and, among other consequences, could subject us to mandatory disclosure to the media, loss of existing or new customers, significant increases in the cost of managing and remediating privacy or security incidents, and material fines, penalties and litigation awards. Any of these consequences could have a material and adverse effect on our results of operations, financial position and cash flows.
As an enterprise, we increasingly rely on new and evolving technologies, including those powered by or incorporating AI/ML, as part of our internal operations and in the delivery of our products and services. New technologies have potential and power to improve and optimize operational processes and clinical outcomes across the healthcare system, but also present ethical, technological, legal, regulatory and other risks. With respect to AI/ML, we have developed and implemented policies and procedures intended to promote and sustain responsible design, development, and use of AI/ML, consistent with industry best practices. Any inadequacy or failure in compliance with our responsible use of AI/ML policies and procedures or emerging laws, regulations and standards governing AI/ML use could cause our technology products not to operate as intended or to produce outcomes that could have a material and adverse effect on our business, reputation, results of operations, financial position and cash flows.