We rely on information technology systems to process, transmit and store electronic information including legally-protected personal information, such as diagnostic image results and other patient health information, credit card and other financial information, insurance information, and personally identifiable information. A significant portion of the communication between our personnel, patients, business partners, and suppliers depends on information technology. We rely on our information systems to perform functions critical to our ability to operate, including patient scheduling, billing, collections, image storage and image transmission. We also use information technology systems and networks in our operations and supporting departments such as research and development, marketing, accounting, finance, and human resources. The future success and growth of our business depends on streamlined processes made available through information systems, global communications, internet activity and other network processes.
Our information technology system is vulnerable to damage or interruption from:
- Cybersecurity attacks and breaches, ransomware and computer viruses, coordinated attacks by hackers, activist entities, organized criminal threat actors, and nation-state sponsored actors, seeking to disrupt operations or misappropriate information;- technology service provider outages and technology supply chain cyber-security weaknesses;- power losses, computer systems failures, internet and telecommunications or data network failures, operator negligence, improper operation by or supervision of employees, physical and electronic losses of data and similar events;- earthquakes, fires, floods and other natural disasters; and - acts of vandalism or theft, misplaced or lost data, programming or human errors and similar events.
Cybersecurity threats are constantly changing, increasing the difficulty of successfully defending against them or implementing adequate preventive measures. While we maintain multiple layers of security measures and are continuously enhancing our security technologies to address new threats, emerging and advanced cybersecurity threats, including coordinated attacks, require additional layers of security which may disrupt or impact efficiency of operations. We have in the past experienced unauthorized access to our network and could again face attempts by others to gain unauthorized access to information or to introduce malicious software to disrupt the operation of our information technology systems. While management is not aware of a cybersecurity incident that has had a material effect on our operations, there can be no assurances that a cybersecurity incident that could have a material impact on us will not occur in the future.
In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of sensitive data and income, reputational harm, and diversion of funds. A successful ransomware or similar attack could disrupt or limit our ability to operate and generate revenue for an extended period of time including our ability to retrieve patient records, schedule imaging procedures, store and transmit diagnostic images, bill payors or patients, provide customer assistance services, conduct research and development activities, collect, process and prepare company financial information, and manage the administrative aspects of our business, any of which could materially adversely affect our business. Extortion payments may alleviate the negative impact of a ransomware attack, but there is the risk that the threat actor may not destroy the stolen information and we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.
Any such interruption in access, improper access, disclosure, modification, or other loss of information could result in legal claims or proceedings, liability or penalties under laws and regulations that protect the privacy of personal information, such as HIPAA, European data privacy regulations, such as the General Data Protection Regulation, or GDPR, or state privacy regulations, such as the California Consumer Privacy Act. We may be required to comply with state breach notification laws or become subject to mandatory corrective action.
Responding to such incidents could require us to incur significant costs related to rebuilding internal systems, defending against litigation, responding to regulatory inquiries or actions, paying damages, complying with consumer protection laws or taking other remedial steps with respect to third parties. If our data storage system was compromised, it could also give rise to unwanted media attention, materially damage our payor and physician relationships, and harm our business reputation. While we maintain cyber liability insurance, our insurance may not be sufficient to protect against all losses we may incur if we suffer significant or multiple attacks.