Company: EHC
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000785161-25-000009
Chunk: 129

Company: Encompass Health Corp
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 129
---
ics on our systems based on the shared information regarding this Change Healthcare incident and did not identify any compromise or unauthorized access of our systems or networks. However, the incident did affect our ability to submit any claims for payment for a period of time until we implemented alternative modes for submissions. We have not identified any compromise or unauthorized access of our systems or networks, and the temporary disruption to our submission of claims did not materially affect our business strategy, results of operation or financial condition.Given the increasing cybersecurity threats in the healthcare industry, there can be no assurance we will not experience business interruptions; data loss, ransom, misappropriation or corruption, theft, or misuse of proprietary data, patient or other personally identifiable information; or litigation, investigation, or regulatory action related to any of those, any of which could have a material adverse effect on our patient care, ability to admit patients and to bill and collect for services provided on a timely basis, financial position, and results of operations and could harm our business reputation. 

We expend significant capital to protect against cybersecurity threats, including denial of service attacks, email phishing schemes, hacking, advanced persistent threats, malware, and ransomware. Substantial additional expenditures may be required to respond to and remediate any problems caused by cybersecurity incidents, including the unauthorized access to or theft of patient data and protected health information stored in our information systems, the inoperability of our electronic clinical and business systems, and the infiltration or disruption of the information systems of our business vendors and partners. In the case of a material cybersecurity incident, the associated expenses and losses and lost revenue may exceed our current insurance coverage for such events. Some adverse consequences may not be insurable, such as reputational harm and third-party business interruption. For further discussion of the risks associated with cyber threats, see Item 1A, Risk Factors, “Other Operational Risks.”