2 unchanged sentences
Risk Management and Strategy
−Removed: At eHealth, information security is everyone’s responsibility, and we value the trust our customers and business partners place in us to protect their sensitive information.
+Added: At eHealth, information security is everyone’s responsibility, and we value the trust consumers and business partners place in us to protect their sensitive information.
We have established policies and processes for assessing, identifying, and managing risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes.
21 unchanged sentences
• Regular critical security assessments such as advanced attack simulations and vulnerability scans.
−Removed: • A System Development Life Cycle (SDLC) framework to assess applications and related infrastructure before implementation to ensure our security standards are met.
+Added: • A Software Development Life Cycle (SDLC) framework to assess applications and related infrastructure before implementation to ensure our security standards are met.
• Use of a Role Based Access Control (RBAC) methodology, which defines the access a user receives to eHealth’s information systems based on job function.
1 unchanged sentence
• Monitoring of security event data and the security industry to flag anomalies and be aware of potential threats.
−Removed: • Dedicated domestic and international liaisons who help ensure that business and functional area employees have easy access to experts for guidance and assistance mitigating privacy and information protection risks.
−Removed: • Encryption of customer data both in transit and at rest.
+Added: • Dedicated domestic and international liaisons who help ensure that business and functional area employees have easy access to experts for guidance and assistance in mitigating privacy and information protection risks.
+Added: • Encryption of consumer data both in transit and at rest.
• A broad spectrum of technical controls, including data loss prevention, role-based access, application/desktop logging, and data encryption as well as multi-factor authentication and enhanced web application firewall controls.
We, like any technology company, have experienced cybersecurity incidents in the past.
−Removed: However, as of the date of this Annual Report on Form 10-K, we have not experienced any cybersecurity incidents which have been determined to be material.
−Removed: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business, operating results and financial condition, please refer to Part I, Item 1A, Risk Factors, in this Annual Report on Form 10-K.
+Added: However, as of the date of this Annual Report on Form 10-K, we have not experienced any cybersecurity incidents that have been determined to be material.
+Added: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business, operating results and financial condition, please refer to Part I, Item 1A, Risk Factors , of this Annual Report on Form 10-K.
eHealth’s Board of Directors oversees our enterprise risk management process, including cybersecurity, information security, governance, risk management, and compliance programs and strategies.
−Removed: The Board is responsible for monitoring and assessing strategic risk exposure, and our senior leadership team are responsible for the day-to-day management of the risks that we face.
+Added: The Board is responsible for monitoring and assessing strategic risk exposure, and our senior leadership team is responsible for the day-to-day management of the risks that we face.
The Board administers its cybersecurity risk oversight both directly and through its Audit Committee.
2 unchanged sentences
Management briefs the Audit Committee periodically about eHealth’s protection programs, focusing on current trends in the environment, incident preparedness, business continuity management, program governance, and program components, including updates on security processes, external testing, and employee training and awareness initiatives.
−Removed: eHealth maintains an Office of the Chief Information Security Officer (“CISO”), who reports to our Chief Digital Officer (“CDO”).
−Removed: Our CISO focuses on information and systems technology, corporate governance, and behaviors to drive security best practices and safeguard information from unauthorized or inappropriate access, use, or disclosure.
−Removed: eHealth also has a Privacy Officer who advises the company on privacy-related laws and regulations, provides guidance on privacy compliance, drives privacy policy, creates, and oversees the privacy program.
−Removed: Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in our information security team and through the use of technological tools and software and results from third party audits.
−Removed: Our CISO and CDO have extensive experience
−Removed: assessing and managing cybersecurity programs and risks.
−Removed: Our CISO has served in that position since 2019 and, before eHealth, was the Chief Information Security Officer and Vice President IT at Castlight Health where he led the company’s overall security program.
−Removed: Before that, our CISO was the Chief Information Security Officer and Director Global Infrastructure Operations at Ooyala with similar responsibilities during rapid growth.
−Removed: His security experience also includes a 21-year career in the U.S.
−Removed: Navy where he served as a Cryptologic Officer.
+Added: eHealth’s Head of Information Security reports to our Chief Digital Officer (“CDO”) and, with respect to cybersecurity risks, to the Audit Committee of the Board of Directors.
+Added: Our Head of Information Security focuses on information and systems technology, corporate governance, and behaviors to drive security best practices and safeguard information from unauthorized or inappropriate access, use, or disclosure.
+Added: eHealth also has a Privacy Officer who advises the company on privacy-related laws and regulations, provides guidance on privacy compliance, drives privacy policy, and creates and oversees the privacy program.
+Added: Our Head of Information Security is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in our information security team and through the use of technological tools and software and results from third-party audits.
+Added: Our Head of Information Security and CDO have extensive experience assessing and managing cybersecurity programs and risks.
+Added: Our Head of Information Security has served in that position since 2024 and, before eHealth, was the interim Chief Information Security Officer at Castlight Health where he led the company’s overall security program.
+Added: Before that, our Head of Information Security was Senior Manager of Cyber Security at Secureworks.
+Added: His security experience also includes a 12-year career at Banc of America Securities and subsequently at Merrill Lynch on their information security teams as Senior Consultant, Systems Engineering & Architecture.
Our CDO joined eHealth in 2023 and was previously Chief Product Officer at M1 Finance, responsible for defining the company’s product vision, strategy and roadmap to drive growth and profitability, Prior to M1 Finance, our CDO was the Chief Product Officer at Roofstock, Head of Product at LifeLock (acquired by Symantec) and Sr.
Director and Head of Product, D3 Incubation Unit at Capital One.
−Removed: Our CISO reports directly to the Audit Committee of the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues at least once annually or more frequently as determined to be necessary or advisable.
−Removed: In addition, we have an escalation process in place to inform senior management and the Board of Directors when it is appropriate under the circumstances.
+Added: Our Head of Information Security reports directly to the Audit Committee of the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues at least once annually or more frequently as determined to be necessary or advisable.
+Added: In addition, we have an escalation process in place to inform senior management and the Board of Directors when it is appropriate to do so under the circumstances.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.