Pharma

Pharma covers pharmaceutical and biotech companies, which hold employee, clinical-trial participant and, for companies that also run patient-support programs, patient data -- but most are not themselves a HIPAA covered entity, since HIPAA's notification duty attaches to health plans, providers and clearinghouses rather than to a drug manufacturer. An incident is instead reported under the general state or national data-breach notification statute covering the individuals affected, and a publicly traded pharma company separately discloses a material cybersecurity incident to the SEC on Form 8-K, Item 1.05.