UNIVERSAL HEALTH SERVICES INC 10-K Cybersecurity GRC - 2026-02-25

Page last updated on February 25, 2026

UNIVERSAL HEALTH SERVICES INC reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2026-02-25 16:21:18 EST.

Filings

10-K filed on 2026-02-25

UNIVERSAL HEALTH SERVICES INC filed a 10-K at 2026-02-25 16:21:18 EST
Accession Number: 0001193125-26-071676

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C. Cybersecurity Cybersecurity risk management and strategy Protecting our data, which includes information related to our patients, members, and customers, is a primary area of our focus. Given the critical nature of this information, we have developed and implemented a robust cybersecurity risk management program to assess, identify, and manage risks associated with cybersecurity threats as identified in Item 106(a) of Regulation S-K. Our cybersecurity program is designed to support the confidentiality, integrity, availability, and resilience of our information systems and the continuity of our operations, including those supporting patient care. Cybersecurity is an important and integrated part of our risk management program that identifies, monitors and mitigates business, operational and legal risks. Our cybersecurity risk management program incorporates a multi-tiered governance and risk assessment structure, including ongoing evaluation of applicable laws and regulations, internal policies and standards, technical vulnerabilities, threat intelligence, and resource adequacy. Such risks include operational, intellectual property theft, fraud, risks that have potential unfavorable impacts on our employees and/or patients, and violation of data privacy or security laws. To address cybersecurity risks facing our organization, we have adopted a risk-informed and continuously evolving assessment process. We engage a third party to conduct a bi-annual National Institute of Technology-Cyber Security Framework assessment to determine the effectiveness of our program and related controls. The results of that assessment are reviewed by management and used to formulate prioritization of remediation efforts, strategic initiatives, and cybersecurity investments. Likewise, annual penetration tests occur to review the efficacy of our technical controls, results which are reviewed by management and resolved in a timely manner. Other factors that feed into our risk management practices are also operational events and incidents, which can lead to controls being reviewed and enhanced. Our risk management practices also incorporate lessons learned from operational events, cybersecurity incidents, near misses, and changes in the external threat landscape, including emerging risks associated with ransomware, supply-chain dependencies, and the increasing use of artificial intelligence by threat actors. We have a mature incident response and recovery program in place in the event a cybersecurity incident occurs. This program defines roles, responsibilities and action plans designed to contain and eradicate the issue and then restore systems, in the event of a major disruption, in a timely manner. Our response planning emphasizes resilience and the ability to maintain critical operations, including clinical and patient-facing services, during and following a cybersecurity event. We regularly conduct tabletop exercises to simulate responses to an incident and implement any insight gained from those exercises to improve our recovery practices. As part of these processes, we regularly engage with assessors, consultants, auditors, and other third parties to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance. We maintain a commercial cybersecurity insurance policy that provides for coverage for losses sustained from cybersecurity incidents, subject to certain deductibles and limitations. However, costs and damages associated with cybersecurity incidents could exceed our commercial insurance coverage which could have a material adverse effect on our business, financial position and results of operations. Third parties who provide services and solutions to our organization are also a source of cyber risk. Through a third-party risk management program, we review risks associated with these third parties through contractual reviews, vendor risk assessments, and continual risk reviews by monitoring the cybersecurity risk exposure these third parties pose and implementing remediation where necessary. Our program also considers risks arising from vendor concentration and systemic dependencies on third-party service providers supporting critical business and clinical functions, and we seek to implement remediation or risk mitigation measures where appropriate. Based on the information available as of the date of this Form 10-K, during our fiscal year 2025 and through the date of this filing, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (as such terms are defined in Item 106(a) of Regulation S-K), that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. In making this determination, we considered both quantitative and qualitative factors, including potential impacts to patient care, regulatory compliance, operational continuity, financial performance, and reputation. For more information on risks to us from cybersecurity threats, see " Risks Related to Information Technology - A cyber 27 security incident could cause a violation of HIPAA, breach of patient or other persons privacy, or other negative impacts ." under " Item 1A. Risk Factors ." Governance of Cybersecurity Cybersecurity is an integral part of our enterprise risk management program and is an area of focus for our Board of Directors and management. The Audit Committee of our Board of Directors is responsible for oversight of risks from cybersecurity threats. Members of the Audit Committee receive regular updates, including quarterly briefings from our Chief Information Security Officer ("CISO"), regarding cybersecurity matters such as the evolving threat landscape, significant risks, incidents, control maturity, and progress against key cybersecurity initiatives. The Audit Committee provides oversight of management's approach to mitigating cybersecurity risks and enhancing the organization's cyber resilience. Senior executive leadership also engage in periodic and ad-hoc discussions with management on cybersecurity topics, including incident response readiness, regulatory developments, and strategic initiatives. In addition, the Board of Directors receives an annual briefing on cybersecurity risks, program maturity, and related governance matters. Our cybersecurity risk management and strategy processes are overseen by our CISO along with leaders from our information security, compliance, legal and internal audit teams. These leaders collectively possess substantial experience across information security, healthcare compliance, risk management, audit, and technology operations.. They are responsible for monitoring the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including oversight of our incident response and recovery capabilities.

Company Information