Company: THC
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0000070318-25-000009
Chunk: 196

Company: TENET HEALTHCARE CORP
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1A
Chunk 196
---
 patients across our care network.

19

Table of Contents

Our business could be significantly and negatively impacted by security threats, catastrophic events and other disruptions affecting our information technology and related information systems and confidential business data.

Our information technology systems are critical to the day‑to‑day operation of our business. We rely on our information technology to process, transmit and store clinical, financial and operational data that includes PHI, PII, and proprietary and confidential business data. We utilize electronic health records (“EHRs”) and other information technology in connection with all of our operations, including our billing and other financial systems, supply chain and labor management tools. Our systems, in turn, interface with and rely on third‑party systems that store and transmit information integral to patient care and that we do not control, including medical devices and other processes supporting the interoperability of healthcare infrastructures. We rely on these third‑party providers to have appropriate controls to protect our systems, confidential information and other sensitive or regulated data. While we seek to obtain assurances that third parties will protect our information and business operations, there is a risk the security of data held by such third parties could be breached or that systems are rendered unavailable, causing direct impacts to our business operations.

The information technology and infrastructure we use, the third‑party systems we interact with and the suppliers we use, have been, and continue to be, subject to cyber-attacks, computer viruses or breaches due to malfeasance or employee error. In April 2022, we experienced a cybersecurity incident that disrupted a subset of our hospital operations and involved the exfiltration of certain confidential company and patient information. Threat actors continue to proliferate, adapt and devote significant effort to attacking the information systems and electronically transmitted and stored data of healthcare providers and related entities. The risk of cyber-attack (including ransomware attack), breach or other disruption to healthcare systems, including ours, remains elevated in the current environment.

Attacks on, or breaches or other disruptions to, our information technology assets or those of third parties that we rely upon could impact the integrity, security or availability of data we process, transmit or store and could impact our operations, as well as PHI and PII, and result in potential harm to our patients and clients. The preventive actions we take to reduce the risk of such incidents and protect our information technology and data may not be sufficient. As cybersecurity threats continue to evolve, we may not be able to anticipate certain attack methods in order to implement effective protective measures. We continue to be required to expend