Company: UHS
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000950170-25-027785
Chunk: 260

Company: UNIVERSAL HEALTH SERVICES INC
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 260
---
Cybersecurity risk management and strategy

Protecting our data, which includes information related to our patients, members, and customers, is a primary area of our focus.  Given the critical nature of this information, we have developed and implemented a robust cybersecurity risk management program to assess, identify, and manage risks associated with cybersecurity threats as identified in Item 106(a) of Regulation S-K. Cybersecurity is an important and integrated part of our risk management program that identifies, monitors and mitigates business, operational and legal risks. 

 This program has a multi-tier risk management structure that includes regular reviews of laws, policies, vulnerabilities, and resource levels to address risks facing our organization.  Such risks include operational, intellectual property theft, fraud, risks that have potential unfavorable impacts on our employees and/or patients, and violation of data privacy or security laws. 

To address cybersecurity risks facing our organization, we have adopted a “continuous risk assessment” process. We engage a third party to conduct a bi-annual National Institute of Technology-Cyber Security Framework assessment to determine the effectiveness of our program and related controls.  The results of that assessment are shared with management, which drives prioritization and investment in resources to address those risks.  Likewise, annual penetration tests occur to review the efficacy of our technical controls, results which are reviewed by management and resolved in a timely manner. Other factors that feed into our risk management practices are also operational events and incidents, which can lead to controls being reviewed and enhanced.

 We also have a mature incident response process in place in the event a cybersecurity incident occurs.  This process defines roles, responsibilities and action plans designed to contain and eradicate the issue and then restore systems in the event of a major disruption. Regularly, we conduct tabletop exercises to simulate responses to an incident and implement any insight gained from those exercises to improve our recovery practices. As part of these processes, we regularly engage with assessors, consultants, auditors, and other third parties to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.

We have a commercial cybersecurity insurance policy that provides for coverage for losses sustained from cybersecurity incidents, subject to certain deductibles and limitations. However, costs and damages associated with cybersecurity incidents could exceed our commercial insurance coverage which could have a material adverse effect on our business, financial position and results of operations.    

Third parties who provide services and solutions to our organization are also a source of cyber risk. Through a third-party risk management program, we review risks associated with these third parties through contractual