2 unchanged sentences
Cybersecurity Risk Management Program
−Removed: The Company’s cybersecurity risk management program, aligned with the National Institute of Standards and Technology Cybersecurity Framework (CSF) domains and HITRUST CSF, is designed to employ industry best practices, including ongoing enhancement of governance, risk, and compliance management, regular updates to our response planning and protocols, security policy and standards maintenance, and new technology implementation to proactively monitor vulnerabilities and reduce risk, including processes designed to identify material cybersecurity risks associated with our use of third -party service providers.
+Added: The Company’s cybersecurity risk management program, aligned with the National Institute of Standards and Technology Cybersecurity Framework (CSF) domains and HITRUST CSF, is designed to employ industry best practices, including ongoing review and enhancement of governance, risk, and compliance management, regular updates to our response planning and protocols, security policy and standards maintenance, and new technology implementation, including with respect to AI/ML technologies, designed to proactively monitor vulnerabilities and reduce risk, including processes designed to identify material cybersecurity risks associated with our use of third-party service providers.
This program includes the engagement of consulting firms and other third parties.
A key component of our cybersecurity risk management program is our incident response policy, which provides for evaluation, response, and reporting procedures in connection with a cybersecurity incident.
−Removed: Under this policy, we have established an incident response team (IRT), a multi-disciplinary management-level team led by the Company’s Chief Technology Officer (CTO) and comprised of the Company’s Chief Executive Officer (CEO), General Counsel/Compliance Officer, Chief Financial Officer, and EVP, Corporate Strategy.
+Added: Under this policy, we have established an incident response team (IRT), a multi-disciplinary management-level team led by the Company’s Chief Technology Officer (CTO) and comprised of the Company’s Chief Executive Officer (CEO), General Counsel/Compliance Officer, Chief Financial Officer, and EVP, Corporate Strategy, Development, and Operations.
The policy provides that the IRT will conduct an initial assessment in the event of a cybersecurity incident meeting certain criteria elevated for the review of the IRT.
1 unchanged sentence
The Company maintains cyber liability insurance to help mitigate potential liabilities resulting from cybersecurity matters.
−Removed: While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.
+Added: While we maintain cybersecurity insurance, such insurance may not adequately compensate us for losses that may occur and may exclude certain types of claims or otherwise be insufficient to cover all losses.
We do not believe that any risks we have identified to date, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.
5 unchanged sentences
Additionally, the Audit Committee makes periodic reports to the Board regarding briefing and reports provided by management and advisors regarding various risk oversight matters as well as the Audit Committee’s own analysis and conclusions regarding the adequacy of the Company’s risk management program.
−Removed: As part of its board-level risk oversight responsibilities, the Audit Committee provides oversight of the Company’s privacy, data, cyber security, and information security risk exposures.
−Removed: Further, at a management level, the Company’s cybersecurity risk management program is led by our CTO, who reports to the Company’s CEO.
+Added: As part of its board-level risk oversight responsibilities, the Audit Committee provides oversight of the Company’s privacy, data, cyber security, and information security risk exposures, including risks associated with the use of artificial intelligence (“AI”).
+Added: The Company evaluates AI-related initiatives within its existing risk management, information security, and data governance processes, applying controls and review procedures designed to promote responsible use, protect sensitive information, and support compliance with applicable laws, regulations, and contractual obligations.
+Added: At a management level, the Company’s cybersecurity risk management program is led by our CTO, who reports to the Company’s CEO.
Our CTO was appointed as the Company’s senior vice president and chief technology officer in July 2017.
2 unchanged sentences
The CTO also reports to the Audit Committee on a quarterly basis regarding remediation activities, if any, along with related security metrics, in connection with any areas where cybersecurity threats have been identified.
−Removed: Our principal office is located in Nashville, Tennessee, which is primarily used to support our corporate functions.
−Removed: Our lease for approximately 92,000 square feet at this location will end in October 2031.
−Removed: As of December 31, 2024, we leased other facilities in Nashville, Tennessee;
−Removed: and San Diego, California.
−Removed: Legal Proceedings
−Removed: Mine Safety Disclosures
−Removed: Not applicable.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.