Company: AMWL
Filing Date: 2025-02-12
Form Type: 10-K
Source: 0000950170-25-019024
Chunk: 133

Company: American Well Corp
Filing Date: 2025-02-12
Form: 10-K
Item: Item 1A
Chunk 133
---
 of the foregoing could harm our competitive position, business, financial condition, results of operations and prospects. 

Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation. 

Because of the extreme sensitivity of the PII and PHI we store and transmit, the security features of our enterprise platform and software as a service are very important. If our security measures, some of which are managed by third parties, are breached or fail, unauthorized persons may be able to obtain access to sensitive client and member data, including PHI. As a result, our reputation could be severely damaged, adversely affecting client and member confidence. Consumers may curtail their use of or stop using our services or our client base could decrease, which would cause our business to suffer. In addition, we could face litigation, damages for contract breach, penalties and regulatory actions for violation of HIPAA and other applicable laws or regulations and significant costs for remediation, notification to individuals and for measures to prevent future occurrences. Any potential security breach could also result in increased costs associated with liability for stolen assets or information, repairing system damage that may have been caused by such breaches, incentives offered to clients or other business partners in an effort to maintain our business relationships after a breach and implementing measures to prevent future occurrences, including organizational changes, deploying additional personnel and protection technologies, training employees and engaging third-party experts and consultants. While we maintain insurance covering certain security and privacy damages and claim expenses, we may not carry insurance or maintain coverage sufficient to compensate for all liability and in any event, insurance coverage would not address the reputational damage that could result from a security incident. 

We outsource important aspects of the storage and transmission of client and member information, and thus rely on third parties to manage functions that have material cyber-security risks. We attempt to address these risks by requiring outsourcing subcontractors who handle client and member information to sign agreements contractually requiring those subcontractors to adequately safeguard PII and PHI to the same extent that applies to us and in some cases by requiring such outsourcing subcontractors to undergo third-party security examinations. In addition, we periodically hire third-party security experts to assess and test our security posture. However, we cannot assure you that these contractual measures and other safeguards will adequately protect us from the risks associated with the storage and transmission of client and consumers’ proprietary and protected health information. 

Due to applicable laws and regulations or contractual obligations, we may be held