9 unchanged sentences
We understand that our customers, patients, and stakeholders entrust us with sensitive data, including Protected Health Information, and we take this responsibility seriously.
−Removed: Our board of directors has an important role in the oversight of the Company’s cybersecurity risk management and strategy and has delegated certain components of such oversight related to the security of and risks related to computerized information and technology systems across the company, as well as by risk area (including privacy, data security, and cybersecurity matters), to the audit committee, which regularly interacts with our Vice President of Cybersecurity (“VP of Cybersecurity”) and Chief Risk Officer (“CRO”).
+Added: Our board of directors has an important role in the oversight of the Company’s cybersecurity risk management and strategy and has delegated certain components of such oversight related to the security of and risks related to computerized information and technology systems across the company, as well as by risk area (including privacy, data security, and cybersecurity matters), to the audit committee, which regularly interacts with our Chief Information Security Officer (“CISO") and Chief Risk Officer (“CRO”).
We also regularly engage external parties to assist in the review of our cybersecurity risk oversight processes.
We have established policies to govern the security of our systems and the protection of customer and patient data, which include regular system updates and patches, employee training on cybersecurity and HIPAA best practices, incident reporting, and the use of encryption to secure sensitive information.
−Removed: Our Cybersecurity department, which reports to our VP of Cybersecurity, is responsible for our cybersecurity program and our Global Risk & Integrity department, which reports to our CRO, is responsible for our privacy program as further discussed below.
+Added: Our Cybersecurity department, which reports to our CISO, is responsible for our cybersecurity program and our Global Risk & Integrity department, which reports to our CRO, is responsible for our privacy program as further discussed below .
To identify, assess, and manage material cybersecurity risks, our Cybersecurity team uses a cybersecurity risk assessment process aligned with leading frameworks such as the National Institute of Standards and Technology’s (“NIST”) Cybersecurity Framework and HIPAA.
10 unchanged sentences
In addition to the assessment of internal cybersecurity risks, we have implemented processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers that have access to our data and systems, including payors and IDTFs.
−Removed: These processes include vetting of all service providers for security, reliability, and availability;
+Added: These processes include vetting of service providers for security, reliability, and availability;
execution of a Business Associate Agreement with each provider for compliant management, storage, or processing of PHI;
and confirmation by each service provider that its SOC-2 reports, or equivalent reports, are current and available, where applicable.
−Removed: In the event a service provider does not have a current and available SOC-2 or equivalent report, we complete an in-depth review of the service provider’s cybersecurity risk management and advise relevant business stakeholders of any significant identified risks.
+Added: In the event a service provider does not have a current and available SOC-2 or equivalent report, we complete a risk-based review of the service provider’s cybersecurity risk management and advise relevant business stakeholders of any significant identified risks.
Based on our board of directors’ and management’s review of risks associated with cybersecurity threats, we have concluded that, to date, there have been no cybersecurity threats which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.
2 unchanged sentences
As described above, our board of directors has an important role in the oversight of the Company’s cybersecurity risk management and strategy, with certain components of such oversight, including matters related to the security of and risks related to computerized information and technology systems, delegated to the audit committee.
−Removed: At the management level, our Cyber Security and Risk departments work together to monitor our cybersecurity and risk programs, reporting to our VP of Cybersecurity and CRO, respectively.
−Removed: Our VP of Cybersecurity currently leads a team of cybersecurity professionals, has held leadership roles in the Cybersecurity team since joining us in 2019, and has over fifteen years of management experience within cybersecurity teams.
+Added: At the management level, our Cyber Security and Risk departments work together to monitor our cybersecurity and risk programs, reporting to our CISO and CRO, respectively.
+Added: Our CISO currently leads a team of cybersecurity professionals, has held leadership roles in the Cybersecurity team since joining us in 2019, and has over fifteen years of management experience within cybersecurity teams.
Our CRO has held leadership roles in internal audit and risk for over a decade, including most recently as CRO of another public company.
Individuals in our Cybersecurity and Global Risk & Integrity departments regularly monitor the prevention, detection, mitigation and remediation of cybersecurity incidents.
−Removed: We have implemented procedures by which any identified or potential cybersecurity risk is communicated to the VP of Cybersecurity promptly and discussed in regular team meetings generally held several times per week.
+Added: We have implemented procedures by which any identified or potential cybersecurity risk is communicated to the CISO promptly and discussed in regular team meetings generally held several times per week.
Risks are escalated to the CRO and other members of management in accordance with our incident response and reporting policy.
−Removed: Our VP of Cybersecurity reports cybersecurity-related matters twice annually to the audit committee, and promptly reports any significant cybersecurity developments or incidents to our management, who may similarly escalate to the audit committee.
+Added: Our CISO reports cybersecurity-related matters twice annually to the audit committee, and promptly reports any significant cybersecurity developments or incidents to our management, who may similarly escalate to the audit committee.
These periodic updates include updates on our cybersecurity risk posture, including material risk assessments, the status of any projects to improve our information security systems, and the emerging cybersecurity threat landscape.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.