Principles and Other Priorities - United Therapeutics

Our Principles and Other Priorities

Our Board of Directors
Ethics and Compliance
Data Privacy and Security
Organizational Resilience Program
Environmental, Health, & Workplace Safety

Board Diversity

We believe it is important that our Board is composed of individuals reflecting the diversity represented by our employees, our patients, and our communities. In recent years, our Nominating and Governance Committee has taken this priority to heart in its nominations process, and the diversity of our Board has grown significantly. With the addition of Linda Maxwell, M.D. in 2020, we have continued to expand the diversity of our Board, which is among the most diverse of our peers.

BOARD DIVERSITY MATRIX (AS OF APRIL 29, 2021)

Board Size:
Total Number of Directors			12
Gender:	Male	Female	Non-Binary	Gender Undisclosed
Number of directors based on gender identity	7	5	0	0
Number of directors who identify in any of the categories below:
African American or Black	1	1	0	0
Alaskan Native or American Indian	0	0	0	0
Asian	0	0	0	0
Hispanic or Latinx	0	1	0	0
Native Hawaiian or Pacific Islander	0	0	0	0
White	6	5	0	0
Two or More Races or Ethnicities	0	2	0	0
LGBTQ+			1
Undisclosed			0

Corporate Governance Best Practices

We have taken great strides over recent years to implement corporate governance best practices, often acting ahead of the curve in terms of our industry peers and the Russell 3000, and through a thoughtful and responsive shareholder engagement program.

Majority Voting

In 2015, we adopted a majority voting standard with a director resignation policy.

Board & Committee Refreshment

We added Linda Maxwell, MD as a new director in 2020, joining three new female directors added over the last seven years. As part of our Board refreshment strategy and to increase the diversity of voices on our Board committees, we refreshed our Compensation, Nominating and Governance, and Audit Committee composition in 2020.

Board Destaggering

In 2020, we began a destaggering process for director elections. Going forward, directors will be elected to one-year terms.

Overboarding

We reduced our overboarding limit to four public company boards (down from the previous limit of five), in direct response to shareholder feedback.

Proxy Access

In 2015, we adopted a market-standard form of proxy access.

Risk Oversight

We take risk oversight very seriously. Our Board committees each tackle various risks facing our company to ensure management is focused on identifying and mitigating the material risks to our company.

Board Committee	Key Risk Oversight Areas
Nominating and Governance Committee	Enterprise risk management system and corporate compliance program; CSR/ESG activities
Audit Committee	Auditing, accounting, and financial matters, as well as cybersecurity
Compensation Committee	Compensation programs, as well as diversity and other human capital priorities.

NEW

ENTERPRISE RISK MANAGEMENT

We use a variety of methods to appropriately manage our enterprise risks. Our process aligns with the 2017 Enterprise Risk Management – Integrated Framework of the Committee of Sponsoring Organizations of the Treadway Commission, as well as guidance issued by the International Organization for Standardization.

We conduct an annual risk assessment, soliciting input from over 30 business leaders across the enterprise (known as our “risk owners”). We share the assessment with our executive leadership team, Nominating and Governance Committee, and the full Board of Directors. Each quarter, we check in with each risk owner to keep apprised of any material changes.

USEFUL RESOURCES

2021 Proxy Statement

2020 Form 10-K

Corporate Governance Documents

Board of Directors

In March 2021, we established the Unither Security Council, composed of leaders from Risk Management, Corporate Security, IT and IT Security, Legal, and Compliance operations to evolve our controls over the protection of sensitive data and systems. The group will focus on educating key business leaders about internal and external risks and assist them in identifying and protecting corporate assets.

Learn more about our commitment to data security and privacy on page 49.

Ethics and Compliance

One of our strategic objectives is to achieve our goals by doing the right thing and using the highest ethical standards. This is evidenced by our commitment to a robust compliance program, ethical operations, scientific integrity, responsible sourcing, and environmental sustainability. Ethics is one of our core values, and we continue to enhance our programs across all of these areas.

One important aspect of our approach to business ethics is a well-defined set of Compliance Principles that outlines how we behave, and clear leadership attributes that we expect from all Unitherians. Our Compliance Principles revolve around the overarching tenet that We do the right thing. Other principles include:

We are Passionate for Patients

We get the right products, to the right patients, for the right reasons
We manufacture with the highest quality standards
We promptly report adverse events and product complaints

We Don't Pay to Play

We operate with the highest standards
of integrity
We don't use money or favors to inappropriately advance business objectives
We ensure all of our interactions have an appropriate and legitimate purpose

We Respect Privacy

We protect the privacy of our patients, caregivers, customers, and employees
We use and share information carefully
and sensibly
We avoid or disclose conflicts of interest

We Communicate Ethically & Honestly

We communicate at the right time, to the right people, with the right message
We communicate in an honest, transparent, and accurate way
We document our books, records, and actions with integrity and attention to detail

Code of Conduct

Our Code of Conduct serves as the foundational tool to ensure employees do the right thing in their day-to-day operations. The biotechnology industry is dynamic and ever-changing, and no one can assume that the right course of action is always clear. Our Code, with support of our existing principles, policies, and procedures, described in more detail below, provides guidance for our decisions and actions.

Our Compliance policies and procedures include, but are not limited to:

Advisory Boards SOP
Business Engagements with Healthcare Professionals Policy
Business Meals Policy
Charitable Contributions Policy
Consultant and Fee-For-Service SOP
Fair Competition (Antitrust) Policy
Global Anti-Bribery & Corruption Policy
Grant Review Committee SOP
Interactions with Healthcare Professionals Policy
Medical Education Grants Policy
Patient Assistance Program Policy
Promotional Communications Policy
Promotional Speaker Program SOP
Sponsorships Promotional Exhibits and Non-Promotional Medical Information Booths Policy
Support for Independent Third-Party Patient Assistance Programs Policy

In 2020, we updated our Code of Conduct to continuously improve this foundational tool. We also rolled out new interactive training with the goal of making learning more engaging and interesting and with an emphasis on real-world and role-specific training

Data Privacy & Security

One of our core values is “We respect privacy.” Gathering and using certain personal information from various sources, including patients, clinical trial subjects, customers, health care providers, and our employees, is essential to what we do as a business. We are committed to protecting the privacy and integrity of this information. We do this through a robust data privacy program and by driving training and awareness for our Unitherians.

Data Privacy Program

We established a Data Privacy Office (DPO) to manage our approach to privacy-related matters. We follow all applicable General Data Protection Regulations (GDPR) and other privacy laws, leveraging input from outside legal counsel and operational advisors to help us administer our program and navigate key issues.

We have an external privacy notice, as well as an internal policy and related standard operating procedures
Our DPO collaborates across the business to ensure that any data shared internally is with the right people and for the right reasons
Before we use software programs or applications, Information Technology and the DPO determine whether any personal information will be transmitted
- If so, the DPO partners with the business owner to conduct a Data Privacy Impact Assessment (DPIA) to ensure data is handled in line with the GDPR and other applicable laws
- The DPIA assessment is conducted for all new software programs or applications with privacy considerations, and we are undergoing a retroactive assessment of our existing critical applications as per UT’s Critical Applications and Systems List
We have a standardized process for responding to data subject requests from our patients, clinical trial subjects, customers, health care providers, and employees

Training and Awareness

Privacy is a key pillar of our Compliance program. All Unitherians are trained on privacy as part of our annual Code of Conduct training
Prior to COVID-19, the Compliance team conducted “road shows” with our main business functions highlighting relevant data privacy protection aspects
In October 2020, we rolled out data privacy training to all relevant UT functions
Our DPIA and data subject request processes provide real-time and real-world training opportunities and help drive awareness on data privacy issues

Cybersecurity

Our approach to cybersecurity is organized around the following key pillars:

Focus Area	Key Risk Oversight Areas
Governance	Board level oversight assigned to the Audit Committee; the Audit Committee is 100% comprised of independent directors Led by our head of Information Security, Risk & Compliance, who reports directly to our Chief Information Officer (CIO) Provides written reports to the Chair of the Audit Committee of the UT Board of Directors each quarter, and the CIO leads discussion with the full Audit Committee each year Leverage the National Institute of Standards and Technology Cybersecurity Framework Consult with our Data Privacy Office and IT operations teams on implementing proper controls for data protection and data use All members of IT security team have industry-leading security certifications such as CISSP, CRISC, CIPM, CISA, and HITRUST
Continuous Monitoring	Use of a 24/7/365 managed security service provider to monitor our cyber environment and alert us of any suspicious activity Ongoing managed vulnerability scanning and patching through our vulnerability management program Targeted audits and penetration tests conducted throughout the year by internal and external entities
Training and Awareness	IT security training provided at hiring and annually to all employees Ongoing training around “phishing,” with frequent changes and differing levels of difficulty to improve awareness; Rewards for Unitherians that recognize and report phishing exercises Additional training for employees identified as high risk
Business Resilience	Collaborate with Enterprise Risk Management to ensure organizational business resilience Incident Response Program in place Disaster Recovery Program to identify critical business systems, real-time replication, and periodic recovery testing Cyber insurance coverage in place that covers data privacy and data security events
Identifying and Mitigating Cyber Risk	Leverage the ISO 27005 model, CoBIT, and Coso frameworks to manage cyber risk Ensure systems are built to comply, and remain in compliance, with regulatory requirements including SOX and GxP programs

United Therapeutics is not aware of any information security breaches during 2018, 2019, and 2020.

Organizational Resilience Program

We have an Organizational Resilience (OR) Program designed to provide a comprehensive approach to ensuring continuity in the event of a severe business disruption. This program is built upon four key pillars that provide the foundation for enterprise-wide resiliency:

Crisis Management: coordinates crisis response at the executive level
Business Continuity: ensures that business processes can be continued
Disaster Recovery: recovers critical information technology systems
Emergency Management: addresses life, health, and safety issues

Our OR Program is supported by executive leadership and led by dedicated recovery teams company-wide and across all United Therapeutics facilities. We use the following core components to maintain our comprehensive OR Program:

The Governance Model defines and supports the OR Program
Business Process Inputs integrate OR with the business and Information Technology to determine and evaluate criticality of processes and systems
People, Plans, and Technology are components essential to recovery operations
Sustainability activities and strategies test, maintain, and continuously improve the program

Environmental, Health & Workplace Safety

United Therapeutics is safe place to work. Our Environmental, Health, Safety, and Sustainability (EHSS) team oversees our environmental, health, and workplace safety program. Our EHSS team is committed to work with internal and external stakeholders to promote a culture of safety with a focus on environmental stewardship and sustainability, and to ensure UT’s global operations meet regulatory requirements and compliance obligations. We empower our people to promote a strong safety culture and build community trust.

2020 Safety Focus Areas

People Empowerment + Safety Culture

As part of a broader safety outreach initiative with the goal of promoting a strong safety culture, EHSS established regular safety meetings with various groups. A new collaboration with the Organ Manufacturing Group in Manchester, NH. has resulted in several safety enhancements including industrial hygiene assessments, enhanced engineering controls, and improved hazard communications of materials used in emerging technologies. The longstanding Regenerative Medicine Laboratory Safety Committee was formed by employees with representation from each department that meets routinely to encourage, assess, and contribute to the positive safety culture. Although the pandemic restricted in-person meetings, we continued our collaborative safety efforts by meeting virtually.

Occupational Health and Safety

We had eight work-related injuries (with one being OSHA recordable) for our U.S. operations in 2020. This resulted in a recordable injury incidence rate of 0.1, significantly below the incidence rate of 1.7 per 100 full-time workers for our industry.

2020 INITIATIVES

Hazardous Energy Control: We initiated a comprehensive review of the Hazardous Energy Control program across the enterprise to include Electrical Arc Flash Safety (NFPA 70e) and Lockout/Tagout programs. EHSS partnered with experts to review programs, perform a hazard risk assessment, and develop a written Electrical and Arc Flash Safety plan as well as 500+ equipment specific lockout/tagout procedures for affected equipment. Qualified-level Arc Flash and LOTO training was also conducted for affected staff members.

Fall Protection: We took industry and OSHA best practices and implemented them as requirements for preventing workers from falls during routine and non-routine tasks performed at heights. A collaborative effort with key stakeholders was pivotal in the implementation of the enhanced Fall Prevention and Protection SOP that had stronger emphasis on hazard elimination, fall prevention, and fall arrest.

Chemical Inventory: To ensure chemical safety at United Therapeutics, we make information about the identities and hazards of the chemicals used available and understandable. In 2020, we conducted audits to verify that Safety Data Sheets (SDS) are immediately available for the current chemical inventory. UT’s SDS and Chemical Management Tool is now even more accessible via a mobile app for easy access to site-specific chemical inventories.

Aligning with Business Strategy Site Expansion

The EHSS team aligns with our Corporate Real Estate team by joining design and construction project teams to ensure new facilities are a safe place to work and meet EHSS regulatory, compliance, and sustainable obligations. EHSS team members were active on various projects including the expansions of research and development facilities at Manchester NH, and La Jolla CA, the build out of the Scaffolding Center at Research Triangle Park NC, and warehouse and distribution spaces in Beltsville MD and Research Triangle Park, NC.

Patients

People

Planet and
Communities