The internal information technology networks and related systems of our Advisor and other parties that provide us with services essential to our operations (including our tenants, operators, and other third-party operators of our healthcare facilities) are vulnerable to damage from any number of sources, including computer viruses, unauthorized access, energy blackouts, natural disasters, terrorism, war and telecommunication failures. Any system failure or accident that causes interruptions in our operations could result in a material disruption to our business. We may also incur additional costs to remedy damages caused by these disruptions.
As reliance on technology has increased, so have the risks posed to those systems. Our Advisor and other parties that provide us with services essential to our operations must continuously monitor and develop their networks and information technology to prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses, and social engineering, such as phishing. Our Advisor is continuously working, including with the aid of third-party service providers, to install new, and to upgrade existing, network and information technology systems, to create processes for risk assessment, testing, prioritization, remediation, risk acceptance, and reporting, and to provide awareness training around phishing, malware and other cyber risks to ensure that our Advisor and other parties that provide us with services essential to our operations are protected against cyber risks and security breaches and that we are also therefore so protected. However, these upgrades, processes, new technology and training may not be sufficient to protect us from all risks. Even the most well protected information, networks, systems and facilities remain potentially vulnerable because the techniques and technologies used in attempted attacks and intrusions evolve and generally are not recognized until launched against a target. In some cases, attempted attacks and intrusions are designed not to be detected and, in fact, may not be detected.
The remediation costs and lost revenues experienced by a subject of an intentional cyberattack or other event which results in unauthorized third-party access to systems to disrupt operations, corrupt data or steal confidential information may be significant and significant resources may be required to repair system damage, protect against the threat of future security breaches or to alleviate problems, including reputational harm, loss of revenues and litigation, caused by any breaches. Additionally, any failure to adequately protect against unauthorized or unlawful processing of personal data, or to take appropriate action in cases of infringement may result in significant penalties under privacy law.
Furthermore, a security breach or other significant disruption involving the information technology networks and related systems of our Advisor or any other party that provides us with services essential to our operations could:
- result in misstated financial reports, violations of loan covenants, missed reporting deadlines or missed permitting deadlines;- affect our ability to properly monitor our compliance with the rules and regulations regarding our qualification as a REIT;- result in the unauthorized access to, and destruction, loss, theft, misappropriation or release of, proprietary, confidential, sensitive or otherwise valuable information (including information about our tenant operators and other third-party operators of our healthcare facilities, as well as the patients or residents at those facilities), which others could use to compete against us or for disruptive, destructive or otherwise harmful purposes and outcomes;- result in our inability to maintain the building systems relied upon by our tenants for the efficient use of their leased space;- require significant management attention and resources to remedy any damages that result;- subject us to claims for breach of contract, damages, credits, penalties or termination of leases or other agreements; or - adversely impact our reputation among our tenants, operators and investors generally.
Although our Advisor and other parties that provide us with services essential to our operations intend to continue to implement industry-standard security measures, there can be no assurance that those measures will be sufficient, and any material adverse effect experienced by our Advisor and other parties that provide us with services essential to our operations could, in turn, have an adverse impact on us.