Item 1B. Unresolved Staff Comments
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.
ITEM 1C. CYBERSECURITY
Cybersecurity Risk Management and Strategy
The Company operates within the dental and healthcare services sector and recognizes that cybersecurity risks may affect business operations, patient data, financial systems, and overall enterprise resilience. The Company maintains a cybersecurity risk-management program designed to assess, identify, and manage material risks arising from cybersecurity threats, consistent with the standards reported by peer companies in the dental and medical device industries, which commonly leverage the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework as a basis for security posture measurement and risk management.
41
Table of Contents
The Company's cybersecurity processes are integrated into its broader enterprise risk-management framework, a practice aligned with industry disclosures indicating that cybersecurity is increasingly managed as an enterprise-level risk rather than solely an Information Technology function. Key elements of the Company’s cyber risk-management program include:
Risk Assessment and Threat Monitoring
● Regular risk assessments using a threat-intelligence–driven approach.
● Continuous monitoring of Company information systems, with tools designed to detect anomalous activity, potential intrusions, and integrity risks.
Security Controls and Preventive Measures
Aligned with the NIST Cybersecurity Framework categories—Identify, Protect, Detect, Respond, and Recover—the Company maintains:
● Multi-factor authentication on critical systems
● Encryption of sensitive information
● Network firewalls, intrusion detection, and prevention systems
● Vulnerability management and periodic penetration testing
Third-Party and Supply-Chain Risk
Given the Company’s reliance on third-party vendors, practice-management technology providers, specialty labs, and cloud-based platforms, vendor risks are assessed using due-diligence processes consistent with enterprise security standards.
Incident Response
The Company has implemented a written incident-response plan documenting roles, responsibilities, communication requirements, and escalation paths. This plan supports coordinated response activities among Information Security, Legal, Operations, Internal Audit, and Executive Management. The Company conducts periodic tabletop exercises, simulated attack scenarios, and post-incident reviews to enhance response readiness and strengthen overall resilience.
Cybersecurity Governance
Board Oversight
The Board of Directors, through its designated committee, provides oversight of material cybersecurity risks. Cybersecurity is addressed at Board and committee meetings, and management provides periodic updates on threats, incidents, program maturity, and remediation efforts.
Audit Committee
The Committee serves and functions as the board’s primary oversight body to monitor the Company’s cybersecurity and related information technology risks. The Committee receives periodic updates from the Company’s management on the Company’s policies, processes, procedures, and any significant development related to the identification, mitigation and remediation of cybersecurity risks. The Committee also ensures that the Company’s management provides an annual cyber and information security update to the full Board of Directors.
42
Table of Contents
Management’s Role and Expertise
The Company’s cybersecurity program is led by the senior director of information technology who reports directly to the chief executive officer. The senior director has spent over 30 years in information technology leadership roles, including 25 years of cybersecurity experience and is responsible for enterprise-wide cybersecurity strategy, policy, and operations. In addition, the company also leverages a virtual chief information security officer consulting resource.
The Senior Director of Information Technology regularly briefs executive leadership and the Board’s oversight committee on cyber threats, ongoing risk-management activities, industry developments, and notable security events.
Cross-Functional Coordination
The Company coordinates cybersecurity risk management across information technology, compliance, clinical operations, finance, and human resources to ensure comprehensive coverage of technology, privacy, regulatory, and operational risks.
Integration With Business Strategy and Operations
The Company emphasizes the integration of cybersecurity with strategic planning, operational continuity, digital transformation initiatives, and patient-care workflows.
The Company’s use of the NIST Cybersecurity Framework helps guide investment decisions, control prioritization, workforce training, and process improvements to support secure, reliable delivery of healthcare services.
Cybersecurity Incidents
On January 23, 2024, we became aware of unauthorized activity for a limited number of employee email accounts. In response, we immediately took steps to secure the email accounts, with the assistance of third-party cyber security specialists, we undertook an investigation into the nature and scope of the event. We worked with third-party specialists to conduct a thorough review of the potentially impacted files to determine whether they may contain personal information and to whom it related. It was determined that certain patient’s personal information may have been impacted. Upon discovering this event, we promptly took steps to investigate the incident, assess the security of our systems, and notify potentially affected individuals.
We reported this event to government regulators where required. The litigation related to these events is inherently unpredictable, but we believe we have substantial defenses to the claims and we intend to vigorously defend ourselves against all claims.
Since the 2024 cybersecurity incident, the Company has not experienced any material information security breaches. The Company maintains cybersecurity insurance, and as part of management oversight we regularly review our policy and levels of coverage based on current risks.
As part of our ongoing commitment to protecting the privacy of personal information in our care and mitigating cybersecurity risk, we maintain safeguards designed to protect data, continuously review and enhance those protections to address evolving threats and lessons learned from prior incidents, and provide recurring cybersecurity awareness training and testing for all employees to help prevent future incidents.
43
Table of Contents