XML 53 R32.htm IDEA: XBRL DOCUMENT
v3.25.0.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | We utilize information technology that enables our operational leaders to access and share with their peers, both clinical and financial performance data in real time. Armed with relevant and current information, our operation leaders and their management teams can share best practices and the latest information, adjust to challenges and opportunities on a timely basis, improve quality of care, mitigate risk and improve both clinical outcomes and financial performance. We have also invested in specialized healthcare technology systems to assist our nursing and support staff. We have installed software and touch-screen interface systems in each operation to enable our clinical staff to monitor and deliver patient care and record patient information more efficiently. We believe these systems have improved the quality of our medical and billing records, while improving the productivity of our staff. Such uses of information systems give rise to cybersecurity risks, including system disruption, security breach, ransomware, theft, espionage and inadvertent release of information. RISK MANAGEMENT AND STRATEGY Risk Management We assess and identify security risk to the organization by: •conducting risk assessments to determine the likelihood and magnitude of an attack from unauthorized access, use, disclosure, disruption, modification or destruction of information systems and the related information processes, stored, or transmitted; •performing penetration testing assessments annually and producing security assessment reports that document the results of the assessment for use and review by information technology (IT) senior leadership, including the Service Center's Chief Information Officer; •ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended and producing the desired outcome; •continuously scanning for vulnerabilities and remediating vulnerabilities within their service level agreements in accordance with the associated risk level; and •reviewing third party and vendor risks to our organization through an internal interdisciplinary Technology Advisory Committee that includes members from our IT, Information Security Office (ISO), legal, compliance, clinical, finance and billing departments. Monitoring We have established a continuous monitoring strategy and program, which includes: •a set of defined security metrics to be monitored; •performance of security control assessments on an ongoing basis; •addressing results of analysis and reporting security status to the executive team; •monitoring information systems to detect attacks and indicators of potential attacks or compromises; •identification of unauthorized use of the information system resources; •deployment of monitoring systems and agents strategically within the information system environment; and •require that third party service providers who store, process or transmit data with access to electronic Protected Health Information (ePHI) undergo an independent third-party audit to achieve system organization controls certification annually. Data Protection We have implemented an Information Security Management System Program to secure sensitive data protected by us. This program includes: •establishing policies governing data security; •monitoring data access throughout the organization’s independent subsidiaries; •providing continuous security training and awareness; •establishing controls over devices on the network which are actively tracked, monitored and evaluated for new, missing, or updated software needed to strengthen security on the device, patch known vulnerabilities, or stabilize software or operating system issues; •protecting sensitive data through encryption techniques; and •designing and implementing systems to include backup and recoverability principles, such as periodic data backups and safeguards in the case of a disaster. Incident Management Plan Our cybersecurity incident management plan comprises the following six-step process: •The Service Center's Chief Information Officer and Director of Information Security lead its ISO team in the development, documentation, review and testing of security procedures and incident management procedures. Beyond initial creation, procedures are continually re-assessed, updated and tested on an ongoing basis. •The ISO team works with the Executive Team on the identification, assessment, verification and classification of incidents to determine affected stakeholders and appropriate parties for contact. •The Service Center's Chief Information Officer and Director of Information Security are responsible for launching the Incident Response Team (IRT) if necessary and for notification to the Executive Team, who in turn will contact the Board of Directors and the Audit Committee to validate that the response is being addressed appropriately. •The IRT, in consultation with outside experts if needed, is responsible for the following: •Initial containment by making tactical changes to the computing environment to mitigate active threats based on currently known information. •Analysis to establish the root cause of incidents, identification and evidence collection from all affected machines and log sources, threat intelligence and other information sources. Once all appropriate information has been collected, we perform a careful analysis using forensically-sound tools and methods to prevent any contamination of evidence. •Incident containment by further analyzing additional information and further identifying any additional compromised machines or resources not previously identified. •Incident eradication by re-assessing the root cause of incidents where solutions are then implemented to solve underlying problems and prevent re-occurrence. •Recovery and restoring normal business functionality, which includes the reversal of any damage caused by the incident and responding as necessary. •Review after closure of each incident and conducting a lessons learned analysis to improve prevention and help to make incident response processes more efficient and effective. Also, the IRT evaluates competency and any additional training requirements needed. A final incident report will then be provided to key stakeholders and IRT members, which includes, but is not limited to the summary of the incident and its impact, a timeline of events, a detailed description of the incident, an evaluation of the organizational response and an assessment of the damages. We have not experienced a material cybersecurity breach in the past five years and, as a result, there have been no charges related to a breach in the past five years. Moreover, risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition. While we have implemented processes and procedures that we believe are tailored to address and mitigate the cybersecurity threats that our company faces, there can be no assurances that such an incident will not occur despite our efforts, as more fully described in Item 1A. Risk Factors.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | We utilize information technology that enables our operational leaders to access and share with their peers, both clinical and financial performance data in real time. Armed with relevant and current information, our operation leaders and their management teams can share best practices and the latest information, adjust to challenges and opportunities on a timely basis, improve quality of care, mitigate risk and improve both clinical outcomes and financial performance. We have also invested in specialized healthcare technology systems to assist our nursing and support staff. We have installed software and touch-screen interface systems in each operation to enable our clinical staff to monitor and deliver patient care and record patient information more efficiently. We believe these systems have improved the quality of our medical and billing records, while improving the productivity of our staff. Such uses of information systems give rise to cybersecurity risks, including system disruption, security breach, ransomware, theft, espionage and inadvertent release of information.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Our Audit Committee receives quarterly reports on our information security and cyber fraud prevention programs from the Service Center's Chief Information Officer and Director of Information Security, who each have over 24 years of experience in IT, including various leadership roles at other large corporations. One of the three members of our Audit Committee is a cybersecurity expert.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our Audit Committee receives quarterly reports on our information security and cyber fraud prevention programs from the Service Center's Chief Information Officer and Director of Information Security, who each have over 24 years of experience in IT, including various leadership roles at other large corporations. One of the three members of our Audit Committee is a cybersecurity expert. The ISO has been established by the Service Center's Chief Information Officer, with dedicated cyber security staff focusing on security monitoring, vulnerability management, incident response, risk assessments, employee training, security engineering and management of cyber security policies, standards and regulatory compliance. Like many organizations, we align to a Cyber Security Framework and take a risk-based approach during control assessment and implementation. We align to the National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 4, a globally recognized cyber security framework of Policies, Standards and Controls is comprised of five categories of defense – Identify, Protect, Detect, Respond and Recover. We are committed to the protection of our data, systems, network and continually invest in enhancements to mitigate or reduce the impact from a cyber security threat. We conduct periodic tests to maintain readiness and resiliency while regularly reviewing policies in the interest of protecting data security. External companies or agencies may be called upon to provide consulting, guidance, assistance, or some other form of support in response to a cybersecurity incident. The regular training of employees, at least annually, on the ever-present threat of cybersecurity helps maintain data security.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Service Center's Chief Information Officer and Director of Information Security are responsible for launching the Incident Response Team (IRT) if necessary and for notification to the Executive Team, who in turn will contact the Board of Directors and the Audit Committee to validate that the response is being addressed appropriately.
Cybersecurity Risk Role of Management [Text Block] | Our cybersecurity incident management plan comprises the following six-step process: •The Service Center's Chief Information Officer and Director of Information Security lead its ISO team in the development, documentation, review and testing of security procedures and incident management procedures. Beyond initial creation, procedures are continually re-assessed, updated and tested on an ongoing basis. •The ISO team works with the Executive Team on the identification, assessment, verification and classification of incidents to determine affected stakeholders and appropriate parties for contact. •The Service Center's Chief Information Officer and Director of Information Security are responsible for launching the Incident Response Team (IRT) if necessary and for notification to the Executive Team, who in turn will contact the Board of Directors and the Audit Committee to validate that the response is being addressed appropriately. •The IRT, in consultation with outside experts if needed, is responsible for the following: •Initial containment by making tactical changes to the computing environment to mitigate active threats based on currently known information. •Analysis to establish the root cause of incidents, identification and evidence collection from all affected machines and log sources, threat intelligence and other information sources. Once all appropriate information has been collected, we perform a careful analysis using forensically-sound tools and methods to prevent any contamination of evidence. •Incident containment by further analyzing additional information and further identifying any additional compromised machines or resources not previously identified. •Incident eradication by re-assessing the root cause of incidents where solutions are then implemented to solve underlying problems and prevent re-occurrence. •Recovery and restoring normal business functionality, which includes the reversal of any damage caused by the incident and responding as necessary. •Review after closure of each incident and conducting a lessons learned analysis to improve prevention and help to make incident response processes more efficient and effective. Also, the IRT evaluates competency and any additional training requirements needed. A final incident report will then be provided to key stakeholders and IRT members, which includes, but is not limited to the summary of the incident and its impact, a timeline of events, a detailed description of the incident, an evaluation of the organizational response and an assessment of the damages. We have not experienced a material cybersecurity breach in the past five years and, as a result, there have been no charges related to a breach in the past five years. Moreover, risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition. While we have implemented processes and procedures that we believe are tailored to address and mitigate the cybersecurity threats that our company faces, there can be no assurances that such an incident will not occur despite our efforts, as more fully described in Item 1A. Risk Factors.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Service Center's Chief Information Officer and Director of Information Security
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Service Center's Chief Information Officer and Director of Information Security, who each have over 24 years of experience in IT, including various leadership roles at other large corporations.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The ISO has been established by the Service Center's Chief Information Officer, with dedicated cyber security staff focusing on security monitoring, vulnerability management, incident response, risk assessments, employee training, security engineering and management of cyber security policies, standards and regulatory compliance. Like many organizations, we align to a Cyber Security Framework and take a risk-based approach during control assessment and implementation. We align to the National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 4, a globally recognized cyber security framework of Policies, Standards and Controls is comprised of five categories of defense – Identify, Protect, Detect, Respond and Recover. We are committed to the protection of our data, systems, network and continually invest in enhancements to mitigate or reduce the impact from a cyber security threat. We conduct periodic tests to maintain readiness and resiliency while regularly reviewing policies in the interest of protecting data security. External companies or agencies may be called upon to provide consulting, guidance, assistance, or some other form of support in response to a cybersecurity incident. The regular training of employees, at least annually, on the ever-present threat of cybersecurity helps maintain data security.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration