20 unchanged sentences
Oversight of Third-Party Risks
−Removed: Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could impact Bioventus in certain circumstances.
+Added: Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could impact us in certain circumstances.
We have implemented processes for overseeing and managing these risks.
−Removed: Those processes include assessing the third parties’ information security practices before allowing them to access our information systems or data, requiring the third parties to implement appropriate cybersecurity controls and otherwise agree to contractual requirements designed to address cybersecurity risks in our agreements with them, and conducting ongoing monitoring of their compliance with those requirements.
+Added: Those processes include assessing the third party’s information security practices before allowing them to access our information systems or data, requiring the third parties to implement appropriate cybersecurity controls and otherwise agree to contractual requirements designed to address cybersecurity risks in our agreements with them, and conducting ongoing monitoring of their compliance with those requirements.
+Added: Table of C o ntents
Risks from Cybersecurity Threats
1 unchanged sentence
However, incidents impacting data processed and systems maintained or operated by us or on our behalf, and incidents otherwise impacting our operations, can and do occur.
−Removed: For example, Change Healthcare, a subsidiary of UnitedHealth Group that acts as an intermediary for processing certain of our claims for reimbursement related to our EXOGEN device to commercial payers experienced an incident in which a cybersecurity threat actor gained access to some of its information technology systems.
+Added: For example, Change Healthcare, a subsidiary of UnitedHealth Group that acts as an intermediary for processing certain of our claims for reimbursement related to our EXOGEN device to commercial payers experienced an incident in 2024 in which a cybersecurity threat actor gained access to some of its information technology systems.
As a result of the Change Healthcare incident, certain of our patient billing and collections processes were disrupted.
−Removed: We have identified an alternative claim processing intermediary and have resumed claims submissions, but this incident caused delays in a portion of our claims submissions to some commercial payers thereby delaying the related cash remittances to us.
−Removed: As of the date of this Annual Report, UnitedHealth Group is still investigating this incident, including any potential impact on claims and patient data.
−Removed: We do not presently believe that the Change Healthcare incident has materially affected, or is reasonably likely to materially affect the Company, including with respect to our claims collection and cash flows.
−Removed: We continue to evaluate the impact of the Change Healthcare incident on our Company.
+Added: We identified an alternative claim processing intermediary and have resumed claims submissions, but this incident caused delays in a portion of our claims submissions to some commercial payers thereby delaying the related cash remittances to us.
The oversight of Bioventus’ Cybersecurity Program falls under the purview of the Company’s Director of IT Security, Risk and Compliance, who has over 25 years of combined technical and leadership experience, with the past 19 years focused on information security and technology risk management, and holds Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM) certifications .
6 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.