5 unchanged sentences
In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
−Removed: We generally follow the HITRUST Common Security Framework in our cybersecurity policies, standards, processes, and practices.
+Added: Our cybersecurity policies, standards, processes, and practices are generally aligned with the NIST Cybersecurity Framework 2.0 and the HITRUST Common Security Framework.
To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity risk management program that includes the identification, prioritization, and management of technical and non-technical risk to the confidentiality, integrity, or availability of patient, employee, clinical trial participant, payor, business partner, and company information.
2 unchanged sentences
We have developed policies, standards, processes, and practices designed to protect our information systems and data from unauthorized access, cybersecurity attacks, and other security incidents.
−Removed: The policies, standards, processes, and practices are implemented and enforced by dedicated IT and cybersecurity professionals.
+Added: The policies, standards, processes, and practices are implemented and enforced by dedicated information technology and cybersecurity professionals.
We utilize a variety of control measures and cybersecurity technologies that are designed to protect our availability of critical information systems and data, maintain regulatory compliance, assess, identify, and manage our material risks from cybersecurity threats, and protect against and respond to security incidents.
10 unchanged sentences
The process includes steps to identify, contain, investigate, and remediate the impacts of the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.
−Removed: The plan involves the participation of a security incident response team that includes our Chief Legal Officer, our Privacy Officer, and other senior leaders in finance, communication, human resources, and legal.
+Added: The plan involves the participation of a security incident response team that includes our Chief Legal Officer and other senior leaders in finance, information security and technology, communication, human resources, and legal.
The plan includes procedures to communicate the incident to management and customers as appropriate and to provide information as required to state and federal law enforcement and regulatory bodies.
7 unchanged sentences
In general, our Audit and Finance Committee of our Board of Directors has primary responsibility for and oversight over cybersecurity threats and our information security management program and considers specific risks, including, for example, risk associated with our strategic plan and business operations.
−Removed: The Audit and Finance Committee receives regular reports from our Chief Technology Officer and Senior Vice President, Technology - Enterprise IT and Engineering, on, among other things, material cybersecurity threat risks or incidents and developments, assessments of our security program and overall security posture, our incident response plan, and initiatives to strengthen our information security systems and mitigate cybersecurity risks.
+Added: In addition, the Audit and Finance Committee oversees the Tech Oversight Subcommittee, which is charged with monitoring the implementation and progress of key technology transformation initiatives and evaluating the effectiveness and quality of deliverables for significant technology projects, including information technology general controls, improved order management, and revenue cycle enablement, as well as other technology-related initiatives identified by the Board of Directors or the Audit and Finance Committee.
+Added: The Audit and Finance Committee receive regular reports from our Chief Technology Officer, on, among other things, material cybersecurity threat risks or incidents and developments, assessments of our security program and overall security posture, our incident response plan, and initiatives to strengthen our information security systems and mitigate cybersecurity risks.
The Audit and Finance Committee, including Rashmi Kumar, provides insights and guidance to management on cybersecurity related matters.
5 unchanged sentences
These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.
−Removed: As discussed above, our Chief Technology Officer and Senior Vice President, Technology - Enterprise IT and Engineering regularly report to our Audit and Finance Committee about cybersecurity threat risks, among other cybersecurity related matters.
+Added: As discussed above, our Chief Technology Officer regularly reports to our Audit and Finance Committee about cybersecurity threat risks, among other cybersecurity related matters.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.