Company: EHC
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000785161-25-000009
Chunk: 125

Company: Encompass Health Corp
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 125
---
Item 1C.Cybersecurity

Process for Assessing, Identifying and Managing Material Cybersecurity Risks

The proper function, availability, and security of our and third-party information systems are critical to our business. We have attempted to structure our cybersecurity program and its incident response policies and procedures, including an incident response plan (the “IRP”), around the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework, which provides best practices to identify, protect from, respond to, and recover from cyber attacks. The cybersecurity program, led by our chief security officer (“CSO”), consists of dedicated internal IT security employees, including the staff of a security operations center, and long-term third-party security service providers. Our IT security staff, led by our CSO, is responsible for our overall information security strategy, policy, security engineering, operations, and cyber threat detection and response. In furtherance of our cybersecurity program, members of our internal security staff participate in industry and governmental cybersecurity cooperative groups, including the Health Information Sharing and Analysis Center (“H-ISAC”) and the FBI’s InfraGard.Our CSO, who assumed his current role in 2022, has over 11 years of cybersecurity experience with us and over 28 total years of cybersecurity and IT experience across various industries, including telecom, engineering, and finance. He also holds several cybersecurity certifications: GIAC Certified Incident Handler, GIAC Certified Penetration Tester, and Certified Healthcare Information Security Leader. Our CSO reports directly to our chief information officer (“CIO”). Our CIO, who assumed his current role in 2011, has 35 total years of cybersecurity and IT experience. Prior to assuming the role of CIO, he served in senior IT and security roles for us beginning in 2001. As a highly decorated United States Air Force officer, he served as a CIO, regional CIO, and chief technology officer responsible for the USAF health system’s IT worldwide operations. He also served as a senior staff advisor to various levels of the United States Department of Defense’s military health system on strategic matters related to IT policy, procedures, procurement, solutions, and is a subject matter expert on cybersecurity. He has numerous professional certifications and affiliations, including a CERT Certificate in Cybersecurity Oversight from National Association of Corporate Directors’ Cyber-Risk Oversight Program; Certified Information Systems Security Professional; lifetime member, fellow, and previous board member of the College of Health Information Management Executives.We maintain an inter-departmental privacy and security committee that