XML 52 R34.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Mar. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Risk Management and Security
As a diversified healthcare services leader that is dedicated to advancing health outcomes for patients everywhere, cybersecurity risk management is integral to our enterprise risk management strategy. Our management, with involvement and input from external consultants and oversight from our Board of Directors (“Board”), performs an annual enterprise-wide risk assessment (“ERA”) to identify key existing and emerging risks. One of the principal risks identified and assessed through this process is cybersecurity, which remains a key focus for the Company, management, and our Board.
Our Cybersecurity Risk Management Program (“RM Program”) is aligned with the National Institute of Standards and Technology Cybersecurity Framework and other industry best practices. The RM Program is designed to identify, assess and mitigate material cybersecurity risks.
We have implemented cybersecurity controls designed to protect our systems, data and operations from cybersecurity risks. Enterprise-wide cybersecurity and privacy training continue to serve an important role in risk reduction and protection of the Company and our stakeholders. We require periodic access-based and role-based privacy and cybersecurity training, which is updated to reflect changes in the threat environment, audit findings, laws, and regulations. We also engage and educate employees through cybersecurity and privacy awareness programs and communication campaigns. Our Cybersecurity Incident Response Plan (“Response Plan”) provides a framework for responding to cybersecurity incidents. The Response Plan governs activities such as preparation, detection, coordination, eradication, recovery, and appropriate escalations to the Company’s senior management, disclosure committee, Board, and relevant Board committees. The Response Plan is routinely tested, reviewed and updated as appropriate under the leadership of our Chief Information Officer and Chief Technology Officer (“CIO/CTO”) with the assistance of the Company’s Chief Information Security Officer (“CISO”).
We also engage internal and external assessors, consultants, auditors, and other third parties, to assess our RM Program . We manage cybersecurity risks associated with third parties, including vendors, service providers, and external users of our systems. This includes conducting due diligence on the third parties we use, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems, and by using contracts to reinforce their cybersecurity obligations.
Although we believe that we maintain reasonable cybersecurity measures, we recognize that cyber threats continue to evolve, and no system is immune to risk.
Both intentional and unintentional occurrences have caused, and could cause in the future, a variety of adverse business impacts to our information systems and data. For a discussion of whether and how any risks from cybersecurity threats have affected or, if realized, are reasonably likely to materially affect the Company, see “Risk Factors” in Item 1A of Part I above for additional information on risks related to our business, including for example, risks related to privacy and data protection, cybersecurity incidents, third-party relationships, and continuity of our information systems and networks, operational technology, and technology products or services.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
As a diversified healthcare services leader that is dedicated to advancing health outcomes for patients everywhere, cybersecurity risk management is integral to our enterprise risk management strategy. Our management, with involvement and input from external consultants and oversight from our Board of Directors (“Board”), performs an annual enterprise-wide risk assessment (“ERA”) to identify key existing and emerging risks. One of the principal risks identified and assessed through this process is cybersecurity, which remains a key focus for the Company, management, and our Board.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Governance
Our CIO/CTO leads management’s assessment and management of cybersecurity risk with the assistance of the Company’s CISO who reports to the CIO/CTO. The CIO/CTO reports to our CFO, is a member of the Executive Operating Team, and provides updates to that group about cybersecurity matters. Our CIO/CTO has more than 29 years of experience managing technology and risks, and advising on cybersecurity issues and our CISO has more than 21 years of relevant experience, is a Certified Information System Security Professional (CISSP), and a Certified Information Systems Auditor (CISA).
Cybersecurity is among the risks identified by our ERA for Board-level oversight. The Audit Committee of the Board has oversight of information technology controls related to financial reporting, while the Compliance Committee of the Board has oversight of technology-related risk, including privacy and cybersecurity. The Audit Committee and Compliance Committee meet jointly at least annually to review cybersecurity risks and programs, and they are updated as needed on cybersecurity threats, incidents, or new developments in our cybersecurity risk profile. The chairs of the Audit Committee and Compliance Committee provide updates to the Board after each committee meeting. The CIO/CTO and CISO provide regular updates to the Board, Audit Committee, or Compliance Committee about material risks from cybersecurity threats. The CIO/CTO or CISO also provide regular updates to the Board, Audit Committee or Compliance Committee about cybersecurity trends and regulatory updates, data governance and usage, technology infrastructure, our training and compliance efforts, and implications for our business strategy. In addition to the information provided in these meetings, members of our Board have access to continuing education, which includes topics relating to cybersecurity risks.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee of the Board has oversight of information technology controls related to financial reporting, while the Compliance Committee of the Board has oversight of technology-related risk, including privacy and cybersecurity.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee and Compliance Committee meet jointly at least annually to review cybersecurity risks and programs, and they are updated as needed on cybersecurity threats, incidents, or new developments in our cybersecurity risk profile. The chairs of the Audit Committee and Compliance Committee provide updates to the Board after each committee meeting.
Cybersecurity Risk Role of Management [Text Block] Our CIO/CTO leads management’s assessment and management of cybersecurity risk with the assistance of the Company’s CISO who reports to the CIO/CTO. The CIO/CTO reports to our CFO, is a member of the Executive Operating Team, and provides updates to that group about cybersecurity matters.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The CIO/CTO and CISO provide regular updates to the Board, Audit Committee, or Compliance Committee about material risks from cybersecurity threats. The CIO/CTO or CISO also provide regular updates to the Board, Audit Committee or Compliance Committee about cybersecurity trends and regulatory updates, data governance and usage, technology infrastructure, our training and compliance efforts, and implications for our business strategy. In addition to the information provided in these meetings, members of our Board have access to continuing education, which includes topics relating to cybersecurity risks.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CIO/CTO has more than 29 years of experience managing technology and risks, and advising on cybersecurity issues and our CISO has more than 21 years of relevant experience, is a Certified Information System Security Professional (CISSP), and a Certified Information Systems Auditor (CISA).
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The CIO/CTO and CISO provide regular updates to the Board, Audit Committee, or Compliance Committee about material risks from cybersecurity threats. The CIO/CTO or CISO also provide regular updates to the Board, Audit Committee or Compliance Committee about cybersecurity trends and regulatory updates, data governance and usage, technology infrastructure, our training and compliance efforts, and implications for our business strategy. In addition to the information provided in these meetings, members of our Board have access to continuing education, which includes topics relating to cybersecurity risks.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true