Company: THC
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0000070318-25-000009
Chunk: 197

Company: TENET HEALTHCARE CORP
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1A
Chunk 197
---
 significant additional resources to modify and strengthen our security measures, investigate and respond to cybersecurity incidents, remediate any vulnerabilities in our information systems and infrastructure, and invest in new technology designed to mitigate security risks. Our insurance against cybersecurity risks and cyber-attacks may not provide the coverage we anticipate or offset the financial impact of a material loss event. In addition, the occurrence of cybersecurity incidents and the continued and elevated risk of attacks (including ransomware), system and data breaches, and other disruptions to information technology systems in the current environment has caused increases in our cyber insurance premiums and lower coverage limits.

Third parties to whom we outsource certain of our functions, with whom we share data for interoperability purposes or from whom we obtain or to whom we provide products and related services, including those that are part of our revenue cycle processes or supply chain, or other third parties with whom our systems interface (such as clients and their vendors, among others), in some instances, store our sensitive and confidential data; these third parties are also subject to the risks outlined above and may not have or use controls effective to protect such information. An attack, breach or other system disruption affecting any of these third parties could similarly harm our business, impact payment of claims, and potentially harm our patients and clients. Further, successful cyber-attacks at other healthcare services companies, whether or not we are impacted, could lead to a general loss of consumer confidence in our industry that could negatively affect us, including harming the market perception of the effectiveness of our security measures or of the healthcare industry in general, which could result in reduced use of our services.

Our networks and technology systems have also experienced disruption due to planned events, such as system implementations, upgrades, and other maintenance and improvements, and they are subject to disruption in the future for similar events, as well as catastrophic events, including a major earthquake, fire, hurricane, telecommunications failure, terrorist attack or the like.

Any ransomware attack, breach, system interruption or unavailability of our information systems or of third-party systems with access to our data could result in: the unauthorized disclosure, misuse, loss or corruption of such data; interruptions and delays in our normal business operations (including the collection of revenues); patient or client harm; potential liability under privacy, security, consumer protection or other applicable laws; regulatory penalties; ransomware payments; and negative publicity and damage to our reputation. Any of these could have a material adverse effect on our business, financial condition, results of operations or cash flows.

20

Table of Contents

We are subject to