Security breaches, loss of data, and other disruptions could compromise sensitive information related to our business, or information of our customers, users of our products, healthcare stakeholders or others, or prevent us or our customers, users of our products, healthcare providers, healthcare payors or others from accessing critical information, all of which could result in a material adverse effect, including without limitation, a material operational or service interruption, harm to our reputation, significant fines, penalties and liability, breach or triggering of Data Protection Laws, Privacy Policies and Data Protection Obligations, loss of customers or sales, or customers curtailing or ceasing their use of our services.
In the ordinary course of our business, we and our third-party service providers will collect, use, generate, transfer, and disclose, or Process, sensitive data, including legally protected health information, or PHI, and medical information, personally identifiable information, intellectual property and proprietary business information owned or controlled by us or our customers. In addition, we offer online customer-facing portals accessible through private and web portals. It is critical that we Process sensitive data in a secure manner to maintain the confidentiality and integrity of such confidential information. We manage and maintain our applications and data utilizing a combination of on-site systems, managed data center systems, and cloud-based data center systems. These applications and related data encompass a wide variety of business-critical information including research and development information, commercial and financial information.
Although we take measures designed to protect such information from unauthorized access, use or disclosure, our information technology and infrastructure, and that of our third-party service providers may be vulnerable to natural disasters, war, terrorism, telecommunications and electrical failures, ransomware, nation-state attacks, social engineering, denial-of-service attacks, phishing attacks, cyber-criminals, cyber-attacks by hackers or viruses, or breaches due to employee error, malfeasance or other disruptions. We also face the ongoing challenge of managing access controls to our information technology systems. If we do not successfully manage these access controls it further exposes us to risk of security breaches or disruptions. Any such security breaches or disruptions could compromise the security or integrity of our networks or result in the loss, misappropriation, and/or unauthorized access, use, modification or disclosure of, or the prevention of access to, sensitive data or confidential information (including trade secrets or other intellectual property, proprietary business information, and personal information). For example, any such event that leads to unauthorized access, use, or disclosure of personal information, including personal information regarding our customers or employees, could harm our reputation directly, compel us to comply with federal and/or state breach notification laws and foreign law equivalents, subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information. If our or our vendors’ information systems are breached, sensitive data are compromised, surreptitiously modified, rendered inaccessible for any period of time or maliciously made public, or if we fail to make adequate or timely disclosures to affected individuals, appropriate state and federal regulatory authorities or law enforcement agencies, if appropriate, following any such event, whether due to delayed discovery or a failure to follow existing protocols, it could result in significant fines, penalties, orders, sanctions and proceedings or actions against us by governmental bodies or other regulatory authorities, customers or third parties. Any of the foregoing could result in significant legal and financial exposure and reputational damages that could potentially have a material adverse effect on our business, financial condition, results of operations and prospects.
Cyber-attacks are increasing in frequency and evolving in nature, and this activity has increased even further during the COVID-19 pandemic. We are at risk of attack by a variety of adversaries, including state-sponsored organizations, organized crime, hackers or “hactivists” (activist hackers), through the use of increasingly sophisticated methods of attack, including long-term, persistent attacks referred to as advanced persistent threats. The techniques used to obtain unauthorized access or sabotage systems include, among other things, computer viruses, malicious or destructive code, ransomware, social engineering attacks (including phishing and impersonation), hacking and denial-of-service attacks. Our systems are also subject to compromise from internal threats, such as theft, misuse, unauthorized access or other improper actions by employees, vendors and other third parties with otherwise legitimate access to our systems. Third parties may also attempt to fraudulently induce our employees and contractors into disclosing sensitive information such as user names, passwords, or other information or otherwise compromise the security of our electronic systems, networks, and/or physical facilities in order to gain access to our data. Additionally, due to the COVID-19 pandemic, our employees are temporarily working remotely, which may pose additional data security risks. Given the unpredictability of the timing, nature and scope of information technology disruptions, there can be no assurance that any security procedures and controls that we or our third-party service providers have implemented will be sufficient to prevent cyber-attacks from occurring. The latency of a compromise is often measured in months, but could be years, and we may not be able to detect a compromise in a timely