Our platform involves the storage and transmission of sensitive information which include sensitive, confidential and proprietary information. As a result, unauthorized access, security breaches, incidents, or compromises as a result of third-party action (e.g., cyber-attacks), employee error, product defect, malfeasance, or other factors could result in the loss of information, inappropriate use of or access to information, service interruption, service degradation, outages, service level credits, litigation, indemnity obligations, damage to our reputation, and other liability. Our platform also utilizes AI to provide services, and this technology may be susceptible to cybersecurity threats. While we maintain and continue to improve our security measures, we may be unable to adequately anticipate security threats or to implement adequate preventative measures, in part, because the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until they are launched against a target. Moreover, the detection, prevention, and remediation of known or unknown security vulnerabilities, including those arising from third-parties, is becoming increasingly expensive and may cause us to incur significant costs in the future. We process significant amounts of sensitive information, including protected health information, personal information, data concerning our members, and in some cases, limited amounts of data concerning the patients they treat in connection with our members' utilization of our network and related services. While we have implemented security measures to protect such data, techniques used to gain unauthorized access to data and systems, disable or degrade service, or sabotage systems are constantly evolving, and we may be unable to anticipate such techniques or implement adequate preventative measures to avoid unauthorized access or other adverse impacts to such data or our systems. We may use third-party service providers and subprocessors to help us deliver services and engage in data processing on our behalf, including, without limitation, the processing of payment card information. If we, our service providers, partners, or other relevant third parties have experienced or in the future experience any security incidents that result in any data loss, deletion or destruction, unauthorized access to, loss of, unauthorized acquisition or disclosure of, or inadvertent exposure of, sensitive information, or compromise related to the security, confidentiality, integrity, or availability of our (or their) information technology, software, services, communications, or data (collectively, a Security Breach), it may result in material harm to our business, including, without limitation, regulatory investigations or enforcement actions, litigation, indemnity obligations, negative publicity, and financial loss.
Our service is vulnerable to threat actors, software bugs, malicious code (such as computer viruses and internet worms), personnel theft or misuse, break-ins, phishing attacks, denial-of-service attacks (including credential stuffing), ransomware attacks, natural disasters, terrorism, war, telecommunication and electrical failures, server malfunction, software or hardware failures, loss of data or other computer assets, adware, or other similar issues or other attacks or similar disruptions, any of which could lead to system interruptions, delays, or shutdowns, causing loss of critical data or the unauthorized access to or acquisition of data.
We may be required to expend significant resources, fundamentally change our business activities and practices, or modify our services, software, operations, or information technology in an effort to protect against security breaches, incidents, or compromises and to mitigate, detect, and remediate actual and potential vulnerabilities. Applicable Data Protection Requirements may require us to implement specific security measures or use industry-standard or reasonable measures to protect against security breaches, incidents, or compromises. The recovery systems, security protocols, network protection mechanisms, and other security measures that we (and our third parties) have integrated into our platform, systems, networks, and physical facilities, which are designed to protect against, detect, and minimize security breaches, incidents, or compromises, may not be adequate to prevent or detect service interruption, system failure, or data loss.
Applicable Data Protection Requirements may require us to notify affected individuals, regulators, customers, credit reporting agencies, and others in the event of a security breach, incident, or compromise. Patients about whom we obtain health information, as well as the providers who share this information with us, may have statutory or contractual rights that limit our ability to use and disclose the information. We may be required to expend significant capital and other resources to ensure ongoing compliance with applicable Data Protection Requirements. Claims that we have violated individuals' privacy rights or breached any Data Protection Requirements, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business.
Although we maintain insurance for our business, the coverage under our policies may not apply to the liabilities or damages as a result of the events referenced above or be adequate to compensate us for all losses that may occur. There can also be no assurance that the limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages as a result of the events referenced above.
In addition, a substantial portion of our workforce is currently working remotely on a part- or full-time basis. This could increase our cyber security risk, create data accessibility concerns, and make us more susceptible to communication disruptions. Any of the foregoing could have a material adverse effect on us.