Principles and Other Priorities

Data Privacy and Security

One of our core values is “We respect privacy.” Gathering and using certain personal information from various sources, including patients, clinical trial subjects, customers, health care providers, and our employees, is essential to what we do as a business. We are committed to protecting the privacy and integrity of this information. We do this through a robust data privacy program and by driving training and awareness for our Unitherians.

Data Privacy Program

We established a Data Privacy Office (DPO) to manage our approach to privacy-related matters. We follow all applicable General Data Protection Regulations (GDPR) and other privacy laws, leveraging input from outside legal counsel and operational advisors to help us administer our program and navigate key issues.

• We have an external privacy notice, as well as an internal policy and related standard operating procedures
  
• Our DPO collaborates across the business to ensure that any data shared internally is with the right people and for the right reasons
  
• Before we use software programs or applications, Information Technology and the DPO determine whether any personal information will be transmitted
  
  • If so, the DPO partners with the business owner to conduct a Data Privacy Impact Assessment (DPIA) to ensure data is handled in line with the GDPR and other applicable laws
  • The DPIA assessment is conducted for all new software programs or applications with privacy considerations, and we are undergoing a retroactive assessment of our existing critical applications as per our Critical Applications and Systems List
• We have a standardized process for responding to data subject requests from our patients, clinical trial subjects, customers, health care providers, and employees
  

Training and Awareness

• Privacy is a key pillar of our Compliance program. All Unitherians receive periodic training on privacy as part of our annual Code of Conduct training
  
• Our DPIA and data subject request processes provide real-time and real-world training opportunities and help drive awareness on data privacy issues
  
• We ran several data privacy protection awareness campaigns via email, our internal UT-Facebook platform, and text messaging 
  
• We procured and implemented a state-of-the-art Data Privacy Protection management tool to streamline our processes and demonstrate accountability to our stakeholders and data protection agencies 

Cybersecurity

Our approach to cybersecurity is organized around the following key pillars:

Governance

• Board-level oversight assigned to our Audit Committee; our Audit Committee is 100% comprised of independent directors
  
• Led by our head of Information Security, Risk and Compliance, who reports directly to our Chief Information Officer (CIO)
  
• Provides written reports to the Chair of the Audit Committee each quarter, and the head of Information Security, Risk and Compliance leads discussion with the full Audit Committee each year
  
• Leverage the National Institute of Standards and Technology Cybersecurity Framework
  
• Consult with our Data Privacy Office and IT operations teams on implementing proper controls for data protection and data use
• All members of IT security team have industry-leading security certifications such as CISSP, CRISC, CIPM, CISA, and HITRUST

In March 2021, we established the Unither Security Council, composed of leaders from Risk Management, Corporate Security, IT and IT Security, Legal, and Compliance operations to evolve our controls over the protection of sensitive data and systems. The group will focus on educating key business leaders about internal and external risks and assist them in identifying and protecting corporate assets.

Continuous Monitoring

• Use of a 24/7/365 managed security service provider to monitor our cyber environment and alert us of any suspicious activity
  
• Ongoing managed vulnerability scanning and patching through our vulnerability management program
  
• Targeted audits and penetration tests conducted throughout the year by internal and external entities

In 2021, we conducted quarterly threat hunts to identify potential threats and dubious patterns in our environment and completed SSL decryption to inspect encrypted traffic for security threats.

Training and Awareness

• IT security training provided at hiring and annually to all employees
  
• Ongoing training around “phishing,” with frequent changes and differing levels of difficulty to improve awareness; Rewards for Unitherians that recognize and report phishing exercises
  
• Additional training for employees identified as high risk

Business Resilience

• Collaborate with Enterprise Risk Management to ensure organizational business resilience Incident Response Program in place
  
• Disaster Recovery Program to identify critical business systems, real-time replication, and periodic recovery testing
  
• Cyber insurance coverage in place that covers data privacy and data security events

Identifying and Mitigating Cyber Risk

• Leverage the ISO 27005 model, CoBIT, and Coso frameworks to manage cyber risk
  
• Ensure systems are built to comply, and remain in compliance, with regulatory requirements including SOX and GxP programs
  

Organizational Resilience

The Organizational Resilience (OR) Program is a central component of our risk management strategy and is an integrated framework designed to assess, mitigate, and respond to key operational risks throughout the enterprise. Our program provides a comprehensive approach that aims to reduce the impact of unplanned business disruptions and protect employee life and safety, critical business processes, and key applications and systems. 

Under the OR Program umbrella, we have developed a comprehensive set of safety, security, and risk management plans, processes, and procedures to assess, mitigate, and respond to risks and recover from crises. These resources, and the dedicated Unitherians that execute and support OR, facilitate the rapid, efficient, and cost-effective recovery of our critical operations and enable us to react quickly, decisively, and cooperatively to any crisis or emergency.

The United Therapeutics OR framework includes four key components: