We rely on IT systems, some of which are provided and/or managed by third-parties, to collect, use, store, transfer and otherwise process electronic information (including sensitive data such as confidential business information and personal data relating to employees, customers, other business partners and patients), and to manage or support a variety of critical business processes and activities (such as receiving and fulfilling orders, billing, collecting and making payments, shipping products, providing services and support to customers and fulfilling contractual obligations). Errors, defects, security issues or other vulnerabilities in third-party technology or in the integration of third-party technology with our systems or products could result in errors that could harm our business. In addition, some of our products and services, including those related to remote monitoring, incorporate software and IT that house personal data and some products or software we sell to customers connect to our systems for maintenance or other purposes. We also have products and systems that connect to the internet, hospital networks, electronic medical record systems or electronic health record systems. Our systems, products and services (including those we acquire through business acquisitions) are susceptible to being damaged, disrupted or shut down due to attacks by computer hackers, computer viruses, ransomware, human error or malfeasance (including by employees), power outages, hardware failures, telecommunication or utility failures, catastrophes, war, conflicts or other unforeseen events, and in any such circumstances our system redundancy and other disaster recovery planning may be ineffective or inadequate. Certain attacks also target hardware, software and information installed, stored or transmitted in our products after such products have been purchased and incorporated into third-party products, facilities or infrastructure. Security breaches of systems provided or enabled by us, regardless of whether the breach is attributable to a vulnerability in our products or services, or security breaches of third-party suppliers we rely on to process, store or transmit electronic information, can result in the misappropriation, destruction or unauthorized disclosure of confidential information or personal data belonging to us or to our employees, partners, customers, patients or suppliers. In some cases, we may address software and hardware vulnerabilities through security updates and patches we make available to customers, and such vulnerabilities may persist if customers do not promptly install (or promptly schedule service in connection with) such updates and patches. Like most multinational corporations, our IT systems and data have been subject to computer viruses, malicious codes, unauthorized access and other cyber-attacks and we expect the sophistication and frequency of such attacks to continue to increase. Unauthorized tampering, adulteration or interference with our products may also adversely affect product functionality and result in loss of data, risk to patient safety and product recalls or field actions. In addition, the rapid evolution and increased adoption of AI, including adopted by computer hackers or other malicious actors, may intensify our cybersecurity risks. The attacks, breaches, misappropriations and other disruptions and damage described above have the ability to interrupt our operations or the operations of our customers and partners, delay production and shipments, result in theft of our and our customers' intellectual property and trade secrets, result in disclosure of personal data, damage customer, patient, business partner and employee relationships and our reputation and result in defective products or services, legal claims and proceedings, liability and penalties under privacy and other laws and increased costs for security and remediation, in each case resulting in an adverse effect on our business and financial statements. Our liability insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.
In addition, any businesses or technologies that we acquire may exacerbate the risks set forth above, for example due to acquired vulnerabilities or threats that were unknown or were ineffectively managed.
Our IT systems require an ongoing commitment of significant resources to maintain and enhance existing systems and develop new systems to keep pace with continuing rapid changes in information processing technology, evolving legal and regulatory standards, evolving customer expectations, changes in the techniques used to obtain unauthorized access to data and information systems, and the IT needs associated with our changing products and services. These risks are exacerbated by the increasing importance of AI and the increasing incorporation of AI in our business. There can be no assurance that we will be able to successfully maintain, enhance and upgrade our systems as necessary to effectively address these requirements.
Any inability to maintain reliable IT systems and appropriate controls with respect to global data privacy and security requirements and prevent data breaches can result in adverse regulatory and business consequences and litigation. As a global organization, we are subject to data privacy and security laws, regulations and customer-imposed controls in numerous jurisdictions as a result of having access to and processing confidential, personal and/or sensitive data in the course of our business. For example, entities that are found to be in violation of HIPAA as the result of a breach of unsecured patient health information, a complaint about privacy practices or an audit by HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations.
In addition, a significant number of countries where we operate have enacted privacy or data protection laws, rules and regulations, many of which have extraterritorial scope, with significant penalties for non-compliance. For example, failure to comply with the requirements of the GDPR and the applicable national data protection laws of the EU member states and other states subject to the GDPR may result in fines of up to €20 million or up to 4% of total worldwide annual turnover for the preceding financial year, whichever is higher, and other administrative penalties. Please see "Item 1. Business-Regulatory Matters" for additional information. Data privacy regulation and enforcement continues to evolve, with recent, increased focus on topics such as the use of AI, biometrics and surveillance technologies.
Government investigations and enforcement actions can be costly and interrupt the regular operation of our business, and data breaches or violations of data privacy laws can result in civil and criminal, monetary and non-monetary penalties and damage to customer, patient, business partner and employee relationships and to our reputation, any of which may adversely affect our business and financial statements. In addition, compliance with the varying data privacy regulations across the U.S. and around the world has required significant expenditures and may require additional expenditures, and may require further changes in our products or business models that increase expenses or reduce revenue.