In the ordinary course of business, we and our tenants, managers and borrowers collect, use, store, disclose, transfer and otherwise process personal information, including personal information specific to tenants, residents and employees. We or our tenants, managers and borrowers may transfer some of this personal information to third parties who assist with certain aspects of our or their business for limited purposes. Accordingly, we and our tenants, managers and borrowers are subject to a variety of stringent data privacy and cybersecurity laws and regulations at the state, federal and international level, as well as contractual requirements and other obligations related to data privacy and cybersecurity. For more information about applicable data privacy and cybersecurity laws and regulations, see “Government Regulation—United States Healthcare Regulation, Licensing and Enforcement—Data Privacy and Cybersecurity” for a discussion of U.S. data privacy and cybersecurity laws and regulations and “Government Regulation—International Healthcare Regulation” for a discussion of international data privacy and cybersecurity laws and regulations.
The legal and regulatory environment surrounding data privacy and cybersecurity is constantly evolving and can be subject to significant change. Laws and regulations governing data privacy, cybersecurity, and the unauthorized disclosure of personal information pose increasingly complex compliance challenges, including the potential for inconsistent interpretation, and the implementation and maintenance of compliance measures may potentially elevate our costs. While we believe we have taken commercially reasonable steps, and depend on our tenants, managers and borrowers, to comply with applicable data privacy and cybersecurity laws and regulations, these laws and regulations are in some cases relatively new and the interpretation and application of these laws and regulations are uncertain. Thus, there can be no assurance that our efforts will be deemed effective by regulatory authorities. As noted below, we and our tenants, managers and borrowers, are also subject to the possibility of cybersecurity threats or incidents, which themselves may result in a violation of these laws and regulations and may require us or our tenants, managers or borrowers to report certain incidents to affected individuals or the relevant regulatory authorities. These laws and regulations, and the laws and regulations that may be enacted in the future, also may require us or our tenants, managers or borrowers to modify our or their data processing practices and policies, incur substantial compliance-related costs and expenses and otherwise suffer adverse impacts on our or their business. Any failure, or perceived failure, by us or our tenants, managers or borrowers to comply with applicable data privacy and cybersecurity laws and regulations could result in enforcement actions, investigations, imposition of fines, or civil or criminal penalties. If any of the foregoing occurs, our and our tenants’, managers’ and borrowers’ businesses, reputation, results of operations (including results of properties) or financial condition could be adversely affected.