CoreCivic Inc

Business Regulations

The industry in which we operate is subject to extensive federal, state, and local regulations, including educational, health care, data privacy and security, transportation, telecommunications, and safety regulations, which are administered by many governmental and regulatory authorities. Some of the regulations are unique to the corrections industry, and some target private, for-profit entities by imposing location requirements, compliance requirements, elevated litigation risk and financial penalties only on private, for-profit correction and detention providers. Facility management contracts typically include specific staffing requirements, reporting requirements, supervision, and on-site monitoring by representatives of the contracting governmental agencies. Corrections and reentry personnel are customarily required to meet certain training standards and, in some instances, facility personnel are required to be licensed and subject to background investigation. Certain jurisdictions also require us to award subcontracts on a competitive basis or to subcontract with certain types of businesses, such as small businesses and businesses owned by members of minority groups. Our facilities are also subject to operational and financial audits by the governmental agencies with which we have contracts. In addition, our technological infrastructure is required by federal agencies to undergo a security compliance audit and provide security logs on a monthly basis. Failure to comply with these regulations and contract requirements can result in material penalties or non-renewal or termination of facility management contracts which could have a material effect on our financial position, results of operations and cash flows, or on our competitive position as a dependable government partner.

Environmental Matters

Under various federal, state, and local environmental laws, ordinances and regulations, a current or previous owner or operator of real property may be liable for the costs of removal or remediation of hazardous or toxic substances on, under, or in such property. Such laws often impose liability whether or not the owner or operator knew of, or was responsible for, the presence of such hazardous or toxic substances. As an owner of real estate assets and as the result of our operation and management of correctional, detention, and residential reentry facilities, we have been, and continue to be, subject to these laws, ordinances, and regulations. Phase I environmental assessments have been obtained on substantially all of the properties we currently own. We are not aware of any environmental matters that are expected to materially affect our financial condition or results of operations; however, if such matters are detected in the future, the costs of complying with environmental laws could have a material effect on our financial position, results of operations and cash flows, or on our competitive position as a dependable government partner.

Privacy and Security Requirements

The Health Insurance Portability and Accountability Act of 1996, as amended and implementing regulations, or HIPAA, require covered entities, which include most health care providers, to protect the privacy and security of individually identifiable health information, known as “protected health information” and establish individual rights related to understanding and controlling how health information is used or disclosed. In the event of breaches of unsecured protected health information, covered entities must notify affected individuals, the U.S. Department of Health and Human Services, or DHHS, and, in certain situations involving large breaches, the media. Additionally, we are subject to complex and evolving U.S. federal and state privacy laws and regulations, including those pertaining to the processing of personal data, such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act and similar laws in Colorado and Virginia.

Healthcare providers are also subject to a growing number of requirements intended to promote the interoperability and exchange of patient health information, including information blocking restrictions that prohibit practices that are likely to interfere with the access, exchange or use of electronic health information, with limited exceptions.

For additional information regarding data privacy and other risks related to our business, see Item 1A. Risk Factors—Risks Related to Our Business and Industry—The failure to comply with data privacy, security and exchange legal requirements could have a material adverse impact on our business, financial position, results of operations, cash flows and reputation.