Company: AMWL
Filing Date: 2025-02-12
Form Type: 10-K
Source: 0000950170-25-019024
Chunk: 106

Company: American Well Corp
Filing Date: 2025-02-12
Form: 10-K
Item: Item 1A
Chunk 106
---
 or investor confidence in us, and reduce the demand for our services from existing and potential clients. In addition, we could face litigation, damages for contract breach, monetary penalties, or regulatory actions for violation of applicable laws or regulations, and incur significant costs for remedial measures to prevent future occurrences and mitigate past violations. Although we maintain insurance covering certain security and privacy damages and claim expenses, we may not carry insurance or maintain coverage sufficient to compensate for all liability and in any event, insurance coverage would not address the reputational damage that could result from a security incident. Additionally, we cannot be certain that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim.

Data privacy is also subject to frequently changing laws, rules, regulations and standards in the various jurisdictions in which we operate. Such initiatives around the country could increase the cost of developing, implementing or securing our servers and require us to allocate more resources to improved technologies, adding to our IT and compliance costs. Our Board is briefed periodically on cybersecurity and risk management issues by our Chief Information Officer and General Counsel and we have implemented a number of processes to avoid cyber threats and to protect privacy. However, the processes we have implemented in connection with such initiatives may be insufficient to prevent or detect improper access to confidential, proprietary or sensitive data, including personal data. In addition, the competition for talent in the data privacy and cybersecurity space is intense, and we may be unable to hire, develop or retain suitable talent capable of adequately detecting, mitigating or remediating these risks. Our failure to adhere to, or successfully implement processes in response to, changing legal or regulatory requirements in this area could result in legal liability or damage to our reputation in the marketplace. 

Should an attacker gain access to our network, including by way of example, using compromised credentials of an authorized user, we are at risk that the attacker might successfully leverage that access to compromise additional systems and data. Certain measures that could increase the security of our systems, such as data encryption (including data at rest encryption), heightened monitoring and logging, scanning for source code errors or deployment of multi-factor authentication, take significant time and resources to deploy broadly, and such measures may not be deployed in a timely manner or be effective against an attack. As cybersecurity threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. The inability to implement, maintain and