of private or state-sponsored cybercrimes, terrorism, war, malware, ransomware, human error, system malfunction, telecommunication and electrical failures, natural disaster, fire, misplaced or lost data, socially engineered breaches or other similar events.
In addition, during the normal course of our business operations, including through the use of information technology systems and infrastructure, we are involved in the collection, transmission, use, retention and other processing of sensitive, confidential, non-public or personal data and information in Canada, the United States and abroad.
Cyber-attacks are increasing in frequency, sophistication and intensity and are made by groups and individuals with a wide range of motives and expertise. Cyber-attacks could include the deployment of harmful malware, ransomware, denial-of-service attacks, worms, social engineering, improper modification of information, fraudulent “phishing” e-mails and other means to affect service reliability or threaten data confidentiality, integrity or availability. Techniques used in these attacks are often highly sophisticated, change frequently and may be difficult to detect for long periods of time.
We have established (i) physical, electronic and organizational measures intended to safeguard and secure our systems to prevent a compromise and (ii) policies and procedures designed to provide for the timely investigation of cybersecurity incidents and the timely disclosure of cybersecurity incidents consistent with our legal and contractual obligations. We also rely on commercially available systems, software, tools and monitoring to provide security for the processing, transmission and storage of digital information.
We and our suppliers, partners, customers and vendors have experienced, and may continue to experience cybersecurity incidents, although to our knowledge we have not experienced any material incident or interruption to date. While we attempt to take appropriate security and cybersecurity measures to protect our information technology systems and infrastructure (including any trade secrets, confidential or other sensitive information) and to prevent and detect breakdowns, unauthorized breaches and cyber-attacks, we cannot guarantee that such measures will be successful and that breakdowns and breaches of, or attacks on, our systems and data, or those of third parties upon which we rely, will be prevented. Such breakdowns and breaches of, or attacks on, our systems and infrastructure, or the public perception that we or any third party upon which we rely have suffered a cybersecurity incident or breakdown, may cause business interruption and could have a material adverse effect on our business, financial condition, cash flows and results of operations, damage our reputation with customers, employees and third parties with whom we do business and cause the market value of our common shares and/or debt securities to decline, and we may suffer financial damage or other loss, including fines or criminal penalties or may be subject to litigation, including potentially class action lawsuits because of lost or misappropriated information.
While we maintain insurance against some of these risks, this insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from a breakdown, breach, cyber-attack or other compromise of or interruption to our information technology systems and infrastructure or confidential and other sensitive information.
In addition, we provide confidential and other sensitive information to third parties when necessary to pursue our business objectives. While we obtain assurances that these third parties will protect this information and, where appropriate, monitor the protections employed by these third parties, there is a risk that the confidentiality of information held by third parties, including trade secrets and sensitive personal information, may be compromised, including as a result of cybersecurity breaches, breakdowns or other incidents. If personal information of our customers or employees is misappropriated, our reputation with our customers and employees may be injured, resulting in loss of business and/or morale. Any such incidents could require us to incur costs to remediate possible injury to our customers and employees, to further improve our protective measures or to pay fines or take other action with respect to litigation, judicial or regulatory actions arising out of such incidents, which may be significant. We also cannot ensure that any limitation of liability or indemnity provisions in our contracts, including with vendors and service providers, for a security lapse or breach or other security incident would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim.
Any of the foregoing could have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares and/or debt securities to decline.
Risks Relating to Specific Legislation and Regulations
We are subject to various laws and regulations, including “fraud and abuse” laws, anti-bribery laws, environmental laws and privacy and security laws, and a failure to comply with such laws and related regulations or prevail in any litigation related to noncompliance could have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares and/or debt securities to decline.
Pharmaceutical and medical device companies have faced lawsuits and investigations pertaining to violations of health care “fraud and abuse” laws, such as the federal False Claims Act, the federal Anti-Kickback Statute (“AKS”) and other state and federal laws and regulations. The AKS prohibits, among other things, knowingly and willfully offering, paying, soliciting
