We utilize many information systems and other software that are critical to our business, some of which are managed by third parties. We regularly use these information systems or software to collect and store sensitive data, including legally protected patient health and personally identifiable information, intellectual property information, and proprietary business information. We may be unable to maintain or improve our information systems and software or experience unanticipated delays, complications, or expenses in implementing, integrating, and operating our systems or incur substantial expenditures or interruptions in operations in connection with system improvements or implementations. The failure of our information systems or software or those of our business partners or third-party service providers to perform properly could disrupt our business and harm our reputation, which may result in decreased sales, increased overhead costs, excess or obsolete inventory, and product shortages, causing our business, reputation, financial condition, and operating results to suffer.
The secure processing, storage, maintenance and transmission of this critical information is vital to our operations and business strategy, and we devote significant resources to protecting such information. Although we take measures to protect sensitive information from unauthorized access or disclosure, our information technology and infrastructure may be vulnerable to theft, loss, damage, and interruption from a number of potential sources and events, including unauthorized access or security breaches, data privacy breaches, natural or man-made disasters, cyber attacks, computer viruses, malware, phishing, denial of service attacks, power loss, or other disruptive events. Any such security incidents could compromise our networks and the information stored there could be accessed by unauthorized parties, disclosed, lost or stolen. Any such security incidents could also result in legal claims or proceedings, liability under laws that protect the privacy of personal information, government enforcement actions and regulatory penalties. Unauthorized access, loss or disclosure could also interrupt our operations and result in damage to our reputation, each of which could adversely affect our business. As a result of new SEC rules and regulations, we are required to disclose, on a current basis pursuant to new Item 1.05 of SEC Form 8-K, any cybersecurity incident that we determine to be material and describe the material aspects of the nature, scope, and timing of the incident, as well as the material impact or reasonably likely material impact of the incident on us, including our financial condition and results of operations. We will also be required to describe, on a periodic basis, our processes, if any, for the assessment, identification, and management of material risks from cybersecurity threats, and describe whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, our board's oversight of risks from cybersecurity threats and management's role in assessing and managing material risks from cybersecurity threats. We have incurred significant costs in an effort to detect and prevent security breaches and incidents, and we may face increased costs and requirements to expend substantial resources in the event of an actual or perceived security breach or incident and to comply with this new SEC cybersecurity rule. Additionally, our insurance policies may not be adequate to compensate us for the potential damages arising from any such disruption, failure or security breach or incident. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all claims made against us and could have high deductibles in any event, and defending a suit, regardless of its merit, could be costly and divert management attention.