Company: UHS
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000950170-25-027785
Chunk: 68

Company: UNIVERSAL HEALTH SERVICES INC
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 68
---
 processes supporting the interoperability of healthcare infrastructures. Third parties to whom we outsource certain of our functions, or with whom our systems interface and who may, in some instances, store our sensitive and confidential data, are also subject to the risks outlined above and may not have or use controls effective to protect such information. An attack, breach or other system disruption affecting any of these third parties could similarly harm our business. 

As cyber criminals continue to become more sophisticated through evolution of their tactics, techniques and procedures, we have taken, and will continue to take, additional preventive measures to strengthen the cyber defenses of our networks and data.  Although we continue to regularly review and enhance our IT systems and cybersecurity controls, we and our third-party provider have experienced, and may experience in the future, cybersecurity incidents. See “Item 1A. Risk Factors” of our Annual Report on Form 10-K for the year ended December 31, 2023 (as filed on February 27, 2024) for information regarding the 2024 cyber incident at UnitedHealth Group Incorporated and the cyber incident we experienced in 2020. While to date no incident had a material impact on our operations or financial results, we cannot guarantee that material incidents will not occur in the future. If any of our or our third-party service providers’ systems are damaged, fail to function properly or otherwise become unavailable, we may incur substantial costs to repair or replace them, and may experience loss or corruption of critical data such as protected health information or other data subject to privacy laws and proprietary business information and interruptions or disruptions and delays in our ability to perform critical functions, which could materially and adversely affect our businesses and results of operations and could result in significant penalties or fines, litigation, loss of customers, significant damage to our reputation and business, and other losses. In the event of a material breach or cyber-attack, the associated expenses and losses may exceed our current insurance coverage for such events. In addition, some adverse consequences are not insurable, such as reputational harm and third-party business interruption. In addition, our future results of operations, as well as our reputation, could be adversely impacted by theft, destruction, loss, or misappropriation of public health information, other confidential data or proprietary business information. Further, consumer confidence in the integrity, availability and confidentiality of information systems and information, including patient personal information and critical operations data, in the healthcare industry generally could be impacted to the extent there are successful cyberattacks at other healthcare services companies, which