Company: THC
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0000070318-25-000009
Chunk: 83

Company: TENET HEALTHCARE CORP
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1
Chunk 83
---
 in the action and prevails, the defendant may be required to pay three times the damages sustained by the government, plus mandatory civil penalties for each false claim submitted to the government. As part of the resolution of a qui tam case, the qui tam plaintiff may share in a portion of any settlement or judgment. If the government does not intervene in the action, the qui tam plaintiff may continue to pursue the action independently. Qui tam actions can also be filed under certain state false claims laws if the fraud involves Medicaid funds or funding from state and local agencies.

We have paid significant amounts to resolve government investigations and qui tam matters brought against us in the past, and we are unable to predict the impact of any future actions on our business, financial condition, results of operations or cash flows.

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT

The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) requires administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of protected health information (“PHI”) and sets forth the rights of patients to understand and control how their information is used and disclosed. We have developed an expansive set of policies and procedures in our efforts to comply with HIPAA, and similar state privacy laws, under the guidance of our ethics and compliance department. Our compliance officers and information security officers are responsible for implementing and monitoring enterprise‑wide compliance with our HIPAA privacy and security policies and procedures. We have also created an internal web‑based HIPAA training program, which is mandatory for all employees.

Under HIPAA, we are required to report breaches of unsecured PHI to affected individuals without unreasonable delay, but not longer than 60 days following discovery of the breach. We are also required to notify HHS and, in certain situations involving large breaches, the media. All non-permitted uses or disclosures of unsecured PHI are presumed to be breaches unless it can be established that there is a low probability the information has been compromised. Various state laws 

10

Table of Contents

and regulations may also require us to notify the applicable state agency and affected individuals in the event of a data breach involving personally identifiable information (“PII”).

Violations of the HIPAA privacy and security regulations may result in criminal penalties and in substantial civil penalties per violation. In addition to enforcement by HHS, state attorneys general are authorized to bring civil actions seeking either injunction or damages in response to violations of HIPAA privacy and security regulations that threaten the privacy of state residents. HHS may resolve HIPAA violations through