Our business relies on information systems to obtain, process, analyze, and manage data. To the extent IT systems are not successfully implemented or fail, our business and results of operations may be adversely affected. Further, our business relies to a significant degree upon the secure transmission, use and storage of sensitive information, including protected health information and other personally identifiable information, financial information and other confidential information and data within these systems.
To protect this information, we seek to implement commercially reasonable security measures and maintain information security policies and procedures informed by requirements under applicable law and recommended practices, in each case, as applicable to the data collected, hosted and processed. Despite our security management efforts our business is vulnerable to unauthorized access to data and/or breaches of confidential information due to criminal conduct, physical break-ins, hackers, employee or insider malfeasance and/or improper employee or contractor access, computer viruses, programming errors, denial-of-service attacks, ransomware events, phishing schemes, fraud, terrorist attacks, human error or other breaches by insiders or third parties or similar disruptive problems. It is not possible to prevent all security threats to our data. Techniques used to obtain unauthorized access, disable or degrade service or sabotage systems change frequently and may be difficult to detect for long periods of time. Further, defects in the design or manufacture of applications we develop or procure from third parties could compromise our data. These events, including unauthorized access, misappropriation, disclosure or loss of sensitive information (including financial or personal health information) or a significant disruption of our network, expose us to risks including risks to our ability to provide our solutions, management distraction and the obligation to devote significant financial and other resources to mitigate such problems and increases to our future information security costs. Moreover, unauthorized access, use or disclosure of certain sensitive information in our possession or our failure to satisfy legal requirements, including requirements relating to safeguarding protected health information under the Health Insurance Portability and Accountability Act ("HIPAA") or state data privacy laws could result in civil and criminal liability and regulatory action, which could result in potential fines and penalties, as well as costs relating to investigation of an incident or breach, corrective actions, required notifications to regulatory agencies and customers, credit monitoring services and other necessary expenses. In addition, actual or perceived breaches of our security management efforts can cause existing customers to terminate their relationship with us and deter existing or prospective customers from using or purchasing our solutions in the future. These events can have a material adverse impact on our business, results of operations, financial condition and reputation.
Because our products and services involve the storage, use and transmission of personal information of consumers, we may be the target of attempted cyber and other security threats by outside third parties, including technically sophisticated and well-resourced bad actors attempting to access or steal the data we store. Vendor, insider or employee cyber and security threats also occur and are a significant concern for all companies, including ours. There have, in the past, been a number of high-profile security breaches involving the improper dissemination of personal information of individuals both within and outside of the healthcare industry. These breaches have resulted in lawsuits and governmental enforcement actions that have sought or obtained significant fines and penalties, and have required companies to enter into agreements with government regulators that impose ongoing obligations and requirements, including internal and external (third party) monitorships for five years or more. While we maintain liability insurance coverage including coverage for cyber-liability, claims may not be covered or could exceed the amount of our applicable insurance coverage, if any, or such coverage may not continue to be available on acceptable terms or in sufficient amounts.