Company: TEM
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000950170-25-025603
Chunk: 185

Company: Tempus AI, Inc.
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1
Chunk 185
---
. 

We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents. Certain data privacy and security obligations have required us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information.

Applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services. For example, notice of HIPAA breaches must be made to affected individuals, the Secretary of the Department of Health and Human Services or other state, federal or foreign regulators, including State Attorneys General, and for extensive breaches, notice may need to be made to the media. Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences. If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience material adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant material consequences may prevent or cause customers to stop using our products and services, deter new customers from using our products and services, and negatively impact our ability to grow and operate our business. We have contingency plans and insurance coverage for certain potential claims, liabilities, and costs relating to security incidents that may arise from our business or operations; however, the coverage may not be sufficient to cover all claims, liabilities, and costs arising from the incidents, including fines and penalties. In addition, we cannot be certain that insurance for cybersecurity incidents will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. It could be difficult to predict the ultimate 

113

resolution of any