Company: THC
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0000070318-25-000009
Chunk: 213

Company: TENET HEALTHCARE CORP
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1C
Chunk 213
---
 from third-party systems and practices. Incidents and cybersecurity attacks at third parties can impact our operations and our obligations to patients, payers and others. We manage this risk through an information technology review and approval process that considers the anticipated use and implementation of proposed technologies, and includes cybersecurity team assessments of third-party products and systems proposed to connect to our information systems 

28

Table of Contents

environment or access our data. A subgroup of our cybersecurity team is dedicated to risk-assessment analyses of vendor security practices and protections. In certain circumstances, we enter into information security agreements with service providers to secure their commitment to maintain certain security protections.Cybersecurity Incident Response Plan—In addition to protecting our assets proactively, our cybersecurity team is tasked with detecting and defending against cybersecurity threats to our systems and data. We maintain a response plan that outlines actions to be taken with respect to cyber incidents and includes procedures, notification processes, and protocols for escalation to senior management and our board of directors. The cybersecurity incident response team is composed of a smaller, core group of our cybersecurity team, as well as a larger, extended group that includes personnel from our operations, legal, compliance, privacy, risk management, communications, incident command center, security, human resources, finance, audit and government relations teams. We also engage third parties, such as forensics consultants, external legal counsel and law enforcement, as needed and as appropriate based on the circumstances. Incidents are escalated to senior management in accordance with our plan and as otherwise appropriate based on the nature of the incident.

EXISTING AND POTENTIAL RISKS

As previously disclosed, in April 2022, we experienced a cybersecurity incident that disrupted a subset of our hospital operations and involved the exfiltration of certain confidential company and patient information. We incurred significant costs to remediate the issues, sustained lost revenues from the associated business interruption and incurred other related expenses. Following this incident, we implemented certain changes to our information systems and processes meant to provide additional protections to our environment, including enhancements to our Security Operations Center, system backups, training practices, detection tools and capabilities, and implementation of new tools and processes, among others. However, we continue to face a heightened risk of cybersecurity threats targeting healthcare providers, including ransomware attacks, which may materially impact our business, financial condition or results of operations. Additional information on cybersecurity‑related risks is included in Item 1A, Risk Factors, of Part I of this report.

GOVERNANCE

Board Oversight—Our board of directors has identified the oversight of cybersecurity