DocGo is highly dependent on information technology networks and systems, including on-site systems, managed data center systems and cloud-based computing center systems, to securely process, transmit and store sensitive data and information, such as PHI and other types of personal data or PII relating to its employees, customers, patients and other confidential or proprietary business information. Computer malware, viruses, spamming and phishing attacks and attempts to gain unauthorized access have become more prevalent, have occurred on DocGo's systems in the past and may occur on DocGo's systems in the future. Various other factors may also cause system failures, including power outages, catastrophic events, inadequate or ineffective redundancy, issues with upgrading or creating new systems or platforms, flaws in third-party software or services, errors or intentional acts by DocGo's employees or third-party service providers, breaches in the security of these systems or platforms or other cybersecurity incidents. These and other issues can create system disruptions, shutdowns or unauthorized access to, or disclosure, exfiltration, manipulation, corruption, loss or modifications of, such sensitive data or information, including PHI or PII. DocGo also utilizes third-party service providers for important aspects of the collection, storage, processing and transmission of this sensitive information and therefore is dependent on these third parties to similarly manage cybersecurity risks.
Because of the sensitivity of PHI, other PII and other sensitive information that DocGo and its service providers collect, store, transmit, and otherwise process, the security of DocGo's technology platform and other aspects of its services, including those provided or facilitated by DocGo's third-party service providers, are important to DocGo's operations and business strategy. DocGo takes certain administrative, physical and technological safeguards to address these risks, such as requiring contractors and other third-party service providers who handle this PHI, other PII and other sensitive information to enter into agreements that contractually obligate them to use reasonable efforts to safeguard such information. DocGo attained ISO 27001 certification for its subsidiary Dara Technologies, LLC ("Dara") in November 2021 and is also in the process of upgrading the entire Company's systems to be Service Organization Controls ("SOC") 2 compliant. Measures taken to protect DocGo's systems, those of its contractors or third-party service providers, or the PHI, other PII, or other sensitive information DocGo or its contractors or third-party service providers process or maintain, may not adequately protect DocGo from the risks associated with the collection, storage, processing and transmission of such sensitive information. Additionally, updates or upgrades to systems, including those currently underway with respect to SOC 2 compliance, are time-consuming and costly, may not be effective in preventing data breaches or operate as designed and could create new inefficiencies or vulnerabilities. DocGo may also be required to expend significant capital and other resources to address problems caused by security breaches or other cybersecurity incidents. Despite DocGo's implementation of security measures, cyberattacks are becoming more sophisticated and frequent. As a result, DocGo or its third-party service providers may be unable to anticipate these techniques or to implement adequate protective measures. If DocGo is unable to earn and/or maintain necessary certifications, including ISO 27001 certification for Dara and SOC 2 compliance for the entire Company, it could result in reputational harm and customer churn and adversely affect DocGo's ability to provide its services. As a result, DocGo's revenue may decline and its business, financial condition and results of operations may be adversely affected.
A security breach or privacy violation that leads to disclosure or unauthorized use or modification of, or that prevents access to or otherwise impacts the confidentiality, security, or integrity of, patient information, including PHI, other PII or other sensitive information that DocGo or its contractors or third-party service providers maintain or otherwise process, could harm DocGo's reputation; compel it to comply with breach notification laws; cause it to incur significant costs for remediation, fines, penalties, notification to individuals or measures intended to repair or replace systems or technology and to prevent future occurrences; cause potential increases in insurance premiums; and require DocGo to verify the accuracy of database contents, resulting in increased costs or loss of revenue. If DocGo is unable to prevent or mitigate such security breaches or privacy violations or implement satisfactory remedial measures, or if it is perceived that DocGo has been unable to do so, its operations or the functionality of its technology could be disrupted; it may be unable to provide access to its systems; it could lose customers; it could see negative repercussions to its reputation, adverse impacts on customers, loss of customer and investor confidence, and financial loss; and it could be subject to governmental investigations or other actions, regulatory or contractual penalties, and other claims and liabilities. In addition, security breaches and other inappropriate access to, or acquisition or processing of, information can be difficult to detect, and any delay in identifying such incidents or in providing any notification of such incidents may lead to increased harms. Further, disclosure or media reports of actual or perceived security vulnerabilities to DocGo's systems or those of its third-party service providers, even if no breach has been attempted or occurred, could lead to reputational harm, loss of customers and revenue, or increased regulatory actions, oversight, and scrutiny.
Any such cybersecurity incident or interruption of DocGo's systems or those of any of its third-party service providers could compromise DocGo's networks or data security processes, and sensitive information could be made inaccessible or could be accessed by unauthorized parties, publicly disclosed, lost or stolen. Any such cybersecurity incident, interruption in access, improper access, disclosure or other loss of information could result in legal claims or proceedings, liability under laws and regulations that protect the privacy of member information or other personal information, such as HIPAA, and regulatory penalties. A cybersecurity incident, unauthorized access, loss or dissemination could also disrupt DocGo's operations, including its ability to perform its services; access customer and patient health information; collect, process, and prepare company financial information; and provide information about DocGo's current and future services. Any such cybersecurity incident could also compromise DocGo's trade secrets and other proprietary information, which could adversely affect DocGo's business and competitive position. While DocGo maintains insurance covering certain data security and privacy damages and claim expenses, such insurance coverage may not be sufficient to compensate for all costs and liabilities, and even if covered, it would not address the reputational damage that could result from a security incident.
As of the date of this filing, DocGo has not been materially impacted by any security breaches to its technology platform, including its on-site systems, managed data center systems and cloud-based computing center systems.