Health Catalyst, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025

Item 1C. Cybersecurity

Cybersecurity Risk Management and Strategy

We believe cybersecurity is critical to advancing our company's mission to be the catalyst for massive, measurable, data-informed healthcare improvement. We face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized groups and challenges specific to the healthcare industry. Our clients and suppliers face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations.

We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information .

Our cybersecurity program incorporates industry-standard frameworks (including third-party certification), policies, and practices designed to protect the privacy and security of our sensitive information. Our third-party certifications for certain Solutions include a HITRUST Common Security Framework certification (which includes standards from frameworks such as HIPAA, ISO, EU, GDPR, NIST, and PCI to provide risk-based certification for companies in the healthcare supply chain) and a Statement on Standards for Attestation Engagements 18 (SSAE 18) System and Organization Control (SOC) 2 report that evaluates our security program, and a HIPAA security risk assessment. Additionally, for certain offerings we maintain ISO 27001 and 9001 certifications.

Assessing, identifying and managing cybersecurity related risks are integrated into our overall risk management process. Cybersecurity related risks are included in the risk universe that the enterprise risk management function evaluates to assess top risks to the enterprise on an annual basis. To the extent the enterprise risk management process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The enterprise risk management's annual risk assessment is presented to the board of directors.

Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across our risk management program to other legal, compliance, strategic, operational, and financial risk areas. Key elements of our cybersecurity risk management program include but are not limited to the following:

• risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information;

• an information security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents;

• the use of external service providers , where appropriate, to assess, test or otherwise assist with aspects of our security processes;

• cybersecurity awareness training of our employees, including incident response personnel, and senior management;

• a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and

• a third-party risk management process for key service providers, suppliers, and vendors based upon our assessment of their criticality to our operations and respective risk profile.

We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors—Risks Related to Data and Intellectual Property" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

Cybersecurity Governance

Our board of directors (Board) oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our cybersecurity program is led by our Chief Information Security Officer (CISO) and includes a team of cybersecurity and security compliance professionals. The cybersecurity program is further strengthened through support of our General Counsel and Chief Compliance and Data Privacy Officer. Our legal and cybersecurity teams work closely together to support and bolster our cybersecurity program. Our cybersecurity team reports to our Audit Committee quarterly on information security and cybersecurity matters, or where it deems appropriate, including with respect to any cybersecurity incidents it considers to be significant or potentially significant. Our Audit Committee has oversight responsibility for our data security practices, including oversight of management's implementation of our cybersecurity risk management program, and we believe the Audit Committee has the requisite skills and visibility into the design and operation of our data security practices to fulfill this responsibility effectively. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity, as appropriate. The full Board also receives briefings from management on our cyber risk management program. From time to time, Board members receive presentations on cybersecurity topics from our CISO, internal cybersecurity team or external experts as part of the Board's continuing education on topics that impact public companies.

The company's current CISO has more than two decades of IT leadership experience and holds several relevant IT and healthcare specific certifications including CISSP, CISM, CICISO, CRISC, CISA, CCSK and CCSP, and has a Bachelor of Applied Arts in Computer Information Systems and a Master of Science in Medical Informatics. Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Information Security team's experience includes more than 75 years of combined IT experience, 35 of which are focused specifically on Information Security. The broader Information Security team's accredited industry certifications include Certified Information Systems Security Professional (CISSP), Certified Chief Information Security Officer,Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), Certificate of Cloud Security Knowledge (CCSK), Certified Cloud Security Professional (CCSP), and Blue Team Level II, Certified CyberDefender, GIAC Certified Incident Handler, GIAC Certified Forensic Analyst, GIAC Web Application Penetration Tester, CompTIA CySA+, Comptia PenTest+, Comptia Secuirty+, Certified Ethical Hacker.

Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.