In the ordinary course of our business, we create, receive, maintain, transmit, collect, store, use, disclose, share and process (collectively, "Process") sensitive data, including individually identifiable health information ("IIHI") and other types of personal data or personally identifiable information (collectively, "PII" and, together with IIHI, "IIHI/PII") relating to our employees, patients, and others. We also Process and contract with third-party service providers to Process sensitive information, including IIHI/PII, confidential information, and other proprietary business information.
We are highly dependent on information technology networks and systems, including the internet, to securely Process IIHI/PII and other sensitive data and information. Security breaches of this infrastructure, whether ours or of our third-party service providers, including physical or electronic break-ins, computer viruses, ransomware, attacks by hackers and similar breaches, and employee or contractor error, negligence or malfeasance, could create system disruptions, shutdowns or unauthorized access, acquisition, use, disclosure or modifications of such data or information, and could cause IIHI/PII to be accessed, acquired, used, disclosed or modified without authorization, to be made publicly available, or to be further accessed, acquired, used or disclosed.
We use third-party service providers for important aspects of the Processing of employee and patient IIHI/PII and other confidential and sensitive data and information, and therefore rely on third parties to manage functions that have material cybersecurity risks. Because of the sensitivity of the IIHI/PII and other sensitive data and information that we and our service providers Process, the security of our technology platform and other aspects of our services, including those provided or facilitated by our third-party service providers, are important to our operations and business strategy. We have implemented certain administrative, physical and technological safeguards to address these risks; however, such policies and procedures may not adequately address certain legal requirements, certain situations that could lead to increased privacy or security risks, and certain risks related to contractors and other third-party service providers who handle this IIHI/PII and other sensitive data and information for us. The training that we provide to our workforce and measures taken to protect our systems, the systems of our contractors or third-party service providers, or more generally the IIHI/PII or other sensitive data or information that we or our contractors or third-party service providers Process may not adequately protect us from the risks associated with Processing sensitive data and information. We may be required to expend significant capital and other resources to protect against security breaches, to safeguard the privacy, security, and confidentiality of IIHI/PII and other sensitive data and information, to investigate, contain, remediate, and mitigate actual or potential security breaches, and/or to report security breaches to patients, employees, regulators, media, credit bureaus, and other third parties in accordance with applicable law and to offer complimentary credit monitoring, identity theft protection, and similar services to patients and/or employees where required by law or otherwise appropriate. Despite our implementation of security measures, cyber-attacks are becoming more sophisticated and frequent, and we or our third-party service providers may be unable to anticipate these techniques or to implement adequate protective measures against them or to prevent additional attacks. Our information technology networks and systems used in our business, as well as those of our service providers, may experience an increase in attempted cyber-attacks, seeking to take advantage of shifts to employees working remotely using their household or personal internet networks. The success of any of these attempts could substantially impact our platform and the privacy, security, or confidentiality of the IIHI/PII and other sensitive data and information contained therein or otherwise processed in the ordinary course of our business operations, and could ultimately harm our reputation and our business. In addition, any actual or perceived security incident or breach may cause us to incur increased expenses to improve our security controls and to remediate security vulnerabilities. We exercise limited control over our third-party service providers and, in the case of some third-party service providers, may not have evaluated the adequacy of their security measures, which increases our vulnerability to problems with services they provide.
A security breach, security incident, or privacy violation that leads to unauthorized use, disclosure, access, acquisition, loss or modification of, or that prevents access to or otherwise impacts the confidentiality, security, or integrity of, patient or employee information, including IIHI/PII that we or our third-party service providers Process, could harm our reputation, compel us to comply with breach notification laws, cause us to incur significant costs for investigation, containment, remediation, mitigation, fines, penalties, settlements, notification to individuals, regulators, media, credit bureaus, and other third parties, complimentary credit monitoring, identity theft protection, training and similar services to patients and/or employees where required by law or otherwise appropriate, for measures intended to repair or replace systems or technology and to prevent future occurrences. We may also be subject to potential increases in insurance premiums, resulting in increased costs or loss of revenue.
If we or our third-party service providers are unable to prevent or mitigate security breaches, security incidents or privacy violations in the future, or if we or our third-party service providers are unable to implement satisfactory remedial measures with respect to known or future security incidents, or if it is perceived that we have been unable to do so, our operations could be disrupted, we may be unable to provide access to our systems, and we could suffer a loss of patients, loss of reputation, adverse impacts on patient and investor confidence, financial loss, governmental investigations or other actions, regulatory or contractual penalties, and other claims and liability. In addition, security breaches and incidents and other compromise or inappropriate access to, or acquisition or processing of, IIHI/PII or other sensitive data or information can be difficult to detect, and any delay in identifying such breaches or incidents or in providing timely notification of such incidents may lead to increased harm and increased penalties.
Any such security breach or incident or interruption of our systems or those of any of our third-party service providers could compromise our networks or data security processes, and IIHI/PII or other sensitive data and information could be made inaccessible or could be compromised, used, accessed, or acquired by unauthorized parties, publicly disclosed, lost or stolen. Any such interruption in access, compromise, use, improper access, acquisition, disclosure or other loss of information could result in legal claims or proceedings and/or liability or penalties under laws and regulations that protect the privacy, confidentiality, or security of IIHI/PII, including, without limitation, the Federal Trade Commission Act ("FTC Act"), the California Consumer Privacy Act ("CCPA"), other state IIHI/PII privacy, security, or consumer protection laws, and state breach notification laws. Unauthorized access, loss or dissemination of IIHI/PII could also disrupt our operations, including our ability to perform our services, access, collect, process, and prepare company financial information, provide information about our current and future services and engage in other patient and clinician education and outreach efforts.