Honest & Fair Business

Surgery Partners has a regulatory compliance program that includes a mechanism for employees to report suspected legal or ethical violations without fear of retaliation, utilizing a compliance hotline or direct reporting to the corporate compliance office.

The company's financial statements do not reflect the correction of an error to previously issued financial statements, nor are there error corrections that are restatements requiring a recovery analysis of incentive-based compensation. For the year ended December 31, 2024, Midwest Orthopedic Specialty Hospital, LLC, which contributed 2.0% of total revenues and 3.8% of total assets, was excluded from the assessment of internal control over financial reporting. The company's code of conduct promotes integrity, accountability, and transparency, and its regulatory compliance program focuses on all areas of regulatory compliance, including billing, reimbursement, cost reporting practices, and contractual arrangements. This program provides initial and periodic legal compliance and ethics training to every employee and certain contractors. The company engages various third parties to assist in program development, risk evaluation, and testing for cyber and information security threats and risks.

No War, No Weapons

The company, Surgery Partners, Inc., operates exclusively in the healthcare services sector, managing surgical facilities.

The provided articles detail its corporate governance, financial performance, and compliance with healthcare regulations. There is no explicit evidence within the articles regarding any involvement in arms manufacturing, military contracts, dual-use technologies, sales to embargoed regimes, peacebuilding investments, or any other activities directly related to the 'No War, No Weapons' ethical value. Consequently, no KPIs could be scored based on the strict evidence requirements.

Planet-Friendly Business

Surgery Partners, Inc. has no mentioned regulatory actions, violations, fines, or compliance issues.

The company lacks publicly available data on carbon emissions, reduction targets, climate pledges, and is not participating in any tracked climate initiatives. No specific company-wide data was provided for other environmental metrics.

Safe & Smart Tech

Surgery Partners experienced an immaterial cybersecurity incident in May 2023 that temporarily disrupted certain facilities in its Idaho market, with an estimated adverse pre-tax impact of $8 million as of December 31, 2023.

Separately, a breach at Covenant Surgical Partners (acquired by United Surgical Partners International, a Surgery Partners subsidiary, in July 2024) affected 88,609 individuals and was reported on May 28, 2025. The company maintains cyber insurance and has a Chief Information Security Officer (CISO) who is a Certified Information Security Manager (CISM). A cybersecurity and privacy governance committee, including the CISO and Privacy Officer, meets quarterly to discuss threats and budgetary considerations. The Board of Directors, through its Audit Committee, oversees cybersecurity risks and reviews policies and programs. All team members are required to participate in ongoing cybersecurity training and awareness programs that include periodic assessments. The company utilizes risk assessment tools, technologies, and third parties for program development, risk evaluation, and testing, including an annual third-party risk assessment for critical vendors. The Code of Conduct, revised May 24, 2021, requires safeguarding user IDs, passwords, and other authentication devices, stating they must never be shared or disclosed. The company's 2012 compliance plan indicates that patients have rights to inspect and copy their records, amend erroneous information, and request restrictions on use and disclosure. The data privacy policy, effective September 1, 2020, limits California residents' data requests to twice within a twelve-month period and allows 45 days to respond to verifiable consumer requests, with a possible 45-day extension. The 2012 document retention policy states medical records are retained for a minimum of seven years, unless state law requires longer. The company is subject to HIPAA and other federal and state privacy laws, with potential penalties up to $50,000 per violation and a maximum civil penalty of $1.5 million annually for violations of the same requirement.