American International Holdings (AMIH) Risk Analysis

Numerous state and federal laws and regulations govern the collection, dissemination, use, privacy, confidentiality, security, availability and integrity of personally identifiable information, or PII, including protected health information, or PHI. These laws and regulations include the Health Information Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, and their implementing regulations (referred to collectively as HIPAA). HIPAA establishes a set of basic national privacy and security standards for the protection of PHI. HIPAA requires us to develop and maintain policies and procedures with respect to PHI that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information. HIPAA imposes mandatory penalties for certain violations. Penalties for violations of HIPAA and its implementing regulations start at $100 per violation and are not to exceed $50,000 per violation, subject to a cap of $1.5 million for violations of the same standard in a single calendar year. However, a single breach incident can result in violations of multiple standards. HIPAA also authorizes state attorneys general to file suit on behalf of their residents. Courts are able to award damages, costs and attorneys' fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. In addition, HIPAA mandates that the Secretary of Health and Human Services, or HHS, conduct periodic compliance audits of HIPAA covered entities or business associates for compliance with the HIPAA Privacy and Security Standards. It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the Civil Monetary Penalty fine paid by the violator. HIPAA further requires that patients be notified of any unauthorized acquisition, access, use or disclosure of their unsecured PHI that compromises the privacy or security of such information, with certain exceptions related to unintentional or inadvertent use or disclosure by employees or authorized individuals. HIPAA specifies that such notifications must be made "without unreasonable delay and in no case later than 60 calendar days after discovery of the breach." If a breach affects 500 patients or more, it must be reported to HHS without unreasonable delay, and HHS will post the name of the breaching entity on its public web site. Breaches affecting 500 patients or more in the same state or jurisdiction must also be reported to the local media. If a breach involves fewer than 500 people, the covered entity must record it in a log and notify HHS at least annually. Numerous other federal and state laws protect the confidentiality, privacy, availability, integrity and security of PII, including PHI. These laws in many cases are more restrictive than, and may not be preempted by, the HIPAA rules and may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and our clients and potentially exposing us to additional expense, adverse publicity and liability. Because of the extreme sensitivity of the PII we store and transmit, the security features of our technology platform are very important. If our security measures are breached or fail, unauthorized persons may be able to obtain access to sensitive client data, including HIPAA-regulated PHI. As a result, our reputation could be severely damaged, adversely affecting client confidence. In addition, we could face litigation, damages for contract breach, penalties and regulatory actions for violation of HIPAA and other applicable laws or regulations and significant costs for remediation, notification to individuals and for measures to prevent future occurrences. Any potential security breach could also result in increased costs associated with liability for stolen assets or information, repairing system damage that may have been caused by such breaches, incentives offered to clients in an effort to maintain our business relationships after a breach and implementing measures to prevent future occurrences, including organizational changes, deploying additional personnel and protection technologies, training employees and engaging third-party experts and consultants.

Risks associated with our business and operations include, but are not limited to, claims for wrongful acts committed by our officers, directors, and other representatives, the loss of intellectual property rights, the loss of key personnel, risks posed by natural disasters and risks of lawsuits from customers who are injured from or dissatisfied with our services. Any of these risks may result in significant losses. We cannot provide any assurance that our insurance coverage is sufficient to cover any losses that we may sustain, or that we will be able to successfully claim our losses under our insurance policies on a timely basis or at all. If we incur any loss not covered by our insurance policies, or the compensated amount is significantly less than our actual loss or is not timely paid, our business, financial condition and results of operations could be materially and adversely affected.

Our business and prospects depend, in part, on developing and then maintaining and strengthening our brand and reputation in the markets we serve. If problems arise with our products or services, our brand and reputation could be diminished. If we fail to develop, promote and maintain our brand and reputation successfully, our business and prospects could be materially harmed.

Current global financial conditions and recent market events have been characterized by increased volatility and the resulting tightening of the credit and capital markets has reduced the amount of available liquidity and overall economic activity. We cannot guaranty that debt or equity financing, the ability to borrow funds or cash generated by operations will be available or sufficient to meet or satisfy our initiatives, objectives or requirements. Our inability to access sufficient amounts of capital on terms acceptable to us for our operations will negatively impact our business, prospects, liquidity and financial condition.

Our success depends in part on our ability to enforce our intellectual property and other proprietary rights. We rely upon a combination of trademark and trade secret laws, as well as license and other contractual provisions, to protect our intellectual property and other proprietary rights. These laws, procedures and restrictions provide only limited protection and any of our intellectual property rights may be challenged, invalidated, circumvented, infringed or misappropriated. To the extent that our intellectual property and other proprietary rights are not adequately protected, third parties may gain access to our proprietary information, develop and market solutions similar to ours or use trademarks similar to ours, each of which could materially harm our business. The failure to adequately protect our intellectual property and other proprietary rights could have a material adverse effect on our business, financial condition and results of operations.