IQVIA Holdings (IQV) Risk Analysis

Our Research & Development Solutions clients face increasing competition from lower cost generic products, which in turn may affect their ability to pursue research and development activities with us. In the United States, UK, EU and Japan, political pressure to reduce spending on prescription drugs has led to legislation and other measures which encourages the use of generic products. In addition, proposals emerge from time to time in the United States and other countries for legislation to further encourage the early and rapid approval of generic drugs. Loss of patent protection for a product typically is followed promptly by generic substitutes, reducing our clients' sales of that product and their overall profitability. Availability of generic substitutes for our clients' drugs may adversely affect their results of operations and cash flow, which in turn may mean that they would not have surplus capital to invest in research and development and drug commercialization, including in our services. If competition from generic products impacts our clients' finances such that they decide to curtail our services, our revenues may decline and this could have a material adverse effect on our business.

Mergers or consolidations among our clients have in the past and could in the future reduce the number of our clients and potential clients. When companies consolidate, overlapping services previously purchased separately are usually purchased only once by the combined entity, leading to loss of revenues. Other services that were previously purchased by one of the merged or consolidated entities may be deemed unnecessary or cancelled. If our clients merge with or are acquired by other entities that are not our clients, or that use fewer of our services, they may discontinue or reduce their use of our services. There can be no assurance as to the degree to which we may be able to address the revenues impact of such consolidation. Any of these developments could materially harm our operating results and financial condition.

Most of our Research & Development Solutions contracts are either fee for service contracts or fixed-fee contracts. Our past financial results have been, and our future financial results may be, adversely impacted if we initially underprice our contracts or otherwise overrun our cost estimates and are unable to successfully negotiate a change order. Change orders typically occur when the scope of work we perform needs to be modified from that originally contemplated by our contract with the client. Modifications can occur, for example, when there is a change in a key clinical trial assumption or parameter or a significant change in timing. Where we are not successful in converting out-of-scope work into change orders under our current contracts, we bear the cost of the additional work. Such underpricing, significant cost overruns or delay in documentation of change orders could have a material adverse effect on our business, results of operations, financial condition or cash flows.

The timely recruitment of investigators and patients for clinical trials is essential to our Research & Development Solutions business. Investigators are typically located at hospitals, clinics or other sites and supervise the administration of the investigational drug to patients during the course of a clinical trial. Patients generally include people from the communities in which the clinical trials are conducted. Investigators may be unwilling to participate for a variety of reasons, including the increasing complexity of clinical trials, inability to hire and retain qualified staff or perception that the fair market value for services rendered is inadequate. Our clinical development business could be adversely affected if we are unable to attract suitable and willing investigators or patients for clinical trials on a consistent basis. For example, if we are unable to engage investigators to conduct clinical trials as planned or enroll sufficient patients in clinical trials, we might need to expend additional funds to obtain access to resources or else be compelled to delay or modify the clinical trial plans, which may result in additional costs to us.

Our success depends, in part, upon our ability to develop, use and protect our proprietary methodologies, analytics, systems, technologies and other intellectual property. We rely upon a combination of trade secrets, confidentiality policies, nondisclosure, invention assignment and other contractual arrangements, and patent, copyright and trademark laws, to protect our intellectual property rights. Relevant laws are subject to change at any time and certain agreements may not be fully enforceable, which could further restrict our ability to protect our innovations. Further, these laws may not provide adequate protection for our intellectual property, particularly in countries in which the legal system provides less protection for intellectual property rights. Our intellectual property rights may not prevent competitors from independently developing services similar to or duplicative of ours. Further, the steps we take in this regard might not be adequate to prevent or deter infringement or other misappropriation of our intellectual property by competitors, former employees or other third parties, and we might not be able to detect unauthorized use of, or take appropriate and timely steps to enforce, our intellectual property rights. Our ability to obtain, protect and enforce our intellectual property rights is subject to general litigation or third-party opposition risks, as well as the uncertainty as to the scope of protection, registrability, patentability, validity and enforceability of our intellectual property rights in each applicable country. Governments may adopt regulations, and government agencies or courts may render decisions, requiring compulsory licensing of intellectual property rights. When we seek to enforce our intellectual property rights, we may be subject to claims that the intellectual property rights are invalid or unenforceable. Litigation may be necessary in the future to enforce our intellectual property rights and to protect our confidential and proprietary information. Litigation brought to protect and enforce our intellectual property rights could be costly, time consuming and distracting to management and could result in the impairment or loss of portions of our intellectual property rights. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights. Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation or diversion of our management's attention and resources, could delay further sales or the implementation of our solutions, impair the functionality of our solutions, delay introductions of new solutions, result in our substituting inferior or more costly technologies into our solutions, or injure our reputation and harm our operating results and financial condition. The theft or unauthorized use or publication of our trade secrets and other confidential business information could reduce the differentiation of our services and harm our business; the value of our investment in development or business acquisitions could be reduced; and third parties might make claims against us related to losses of their confidential or proprietary information. In addition, we may not be able to discover or determine the extent of any unauthorized use of our proprietary rights. Third parties that license our proprietary rights also may take actions that diminish the value of our proprietary rights or reputation. The protection of our intellectual property may require the expenditure of significant financial and managerial resources. Moreover, the steps we take to protect our intellectual property may not adequately protect our rights or prevent third parties from infringing or misappropriating our proprietary rights. These incidents and claims could harm our business, reduce revenues, increase expenses and harm our reputation.

Due to the global nature of our business and our reliance on information systems to provide our services, we intend to increase our use of cloud-based platforms and other integrated information systems in delivering our services. We also provide access to similar information systems to certain of our clients in connection with the services we provide them. As the breadth and complexity of our information systems continue to grow, we will increasingly be exposed to the risks inherent in the development, integration and ongoing operation of evolving information systems, including: - disruption, impairment or failure of cloud-based platforms, data centers, telecommunications facilities or other key infrastructure platforms;- security breaches of, cyberattacks on and other failures or malfunctions in our critical application systems or their associated hardware; and - excessive costs, excessive delays or other deficiencies in systems development and deployment. The materialization of any of these risks may impede the processing of data, the delivery of databases and services, and the day-to-day management of our business and could result in the corruption, loss or unauthorized disclosure of proprietary, confidential or other data. While we have disaster recovery plans in place, they might not adequately protect us in the event of a system failure. While many of our operations have disaster recovery plans in place, we currently do not have excess or standby computer processing or network capacity everywhere in the world to avoid disruption in the receipt, processing and delivery of data in the event of a system failure. Despite any precautions we take, damage from fire, floods, hurricanes, power loss, telecommunications failures, computer viruses, break-ins and similar events at our various computer facilities could result in interruptions in the flow of data to our servers and from our servers to our clients. Corruption or loss of data may result in the need to repeat a clinical trial at no cost to the client, but at significant cost to us, the termination of a contract or damage to our reputation. In addition, any failure by the computer environments we use to provide sufficient processing or network capacity to transfer data could result in interruptions in our service. In the event of a delay in the delivery of data, we could be required to transfer our data collection operations to an alternative provider of server hosting services. Such a transfer could result in significant delays in our ability to deliver services to our clients and increase our costs. Additionally, significant delays in system enhancements or inadequate performance of new or upgraded systems once completed could damage our reputation and harm our business. Finally, long-term disruptions in the infrastructure caused by events such as natural disasters, the outbreak of war, the escalation of hostilities and acts of terrorism, particularly involving cities in which we have offices, could adversely affect our businesses. Although we carry property and business interruption insurance, our coverage might not be adequate to compensate us for all losses that may occur. We have continued to undertake significant programs to optimize business processes with respect to our services. Our inability to effectively manage the implementation and adapt to new processes designed into new or upgraded systems in a timely and cost-effective manner may result in disruption to our business and negatively affect our operations. We have entered into agreements with certain vendors to provide systems development, integration services and hosting of IT platform(s) for programs to optimize our business processes. If such vendors fail to perform as required or if there are substantial delays in developing, implementing and updating the IT platform, our client delivery may be impaired, and we may have to make substantial further investments, internally or with third parties, to achieve our objectives. Additionally, our progress may be limited by parties with existing or claimed patents who seek to enjoin us from using preferred technology or seek license payments from us. Meeting our objectives is dependent on a number of factors which may not take place as we anticipate, including obtaining adequate technology-enabled services, creating IT-enabled services that our clients will find desirable and implementing our business model with respect to these services. Also, increased IT-related expenditures may negatively impact our profitability.

Government regulators have the authority, after approving a drug, to regulate or limit its scope of prescription or withdraw it from the market completely based on safety concerns. Similarly, clients may act to voluntarily limit the scope of prescription of drugs or withdraw them from the market. In the past, we have provided services with respect to drugs that have been limited and/or withdrawn. If we are providing services to clients for drugs that are limited or withdrawn, we may be required to narrow the scope of or terminate our services with respect to such drugs, which would prevent earning the full amount of revenues anticipated under the related service contracts with negative impacts to our financial results.

We both own a facility and subcontract into a network of facilities where Phase I clinical trials are conducted, which ordinarily involve testing an investigational drug on a limited number of healthy individuals, typically 20 to 80 persons, to determine such drug's basic safety. Failure to operate such a facility in accordance with applicable regulations could result in that facility being shut down, which could disrupt our operations. Additionally, we face risks associated with adverse events resulting from the administration of such drugs to healthy volunteers and the professional malpractice of medical care providers. Any professional malpractice or negligence by such investigators, nurses or other subcontracted employees could potentially result in liability to us in the event of personal injury to or death of a healthy volunteer in clinical trials, and could also cause us reputational harm. This liability, particularly if it were to exceed the limits of any indemnification agreements and insurance coverage we may have, may adversely affect our financial condition, results of operations and reputation.

The confidentiality, collection, use, retention, security, transfer and disclosure of personal information is subject to governmental regulation in the countries where the personal information was collected or processed. For example, United States federal regulations under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") create specific requirements for the protection of the privacy and security of certain individually-identifiable health information, specifically protected health information (PHI). These provisions apply to both "covered entities" (health care providers, health care plans, and clearinghouses) and their "business associates" (service providers who process PHI on behalf of the covered entity). When acting as a HIPAA covered entity or as a business associate of a covered entity, there can be liability for improper processing of PHI. Under HIPAA's enforcement scheme, overseen by the US Department of Health and Human Services, covered entities and business associates may be subject to significant penalties and fines in connection with HIPAA violations, along with the potential for significant other expenditures related to these activities. Privacy laws and regulations in all regions of the world are designed to ensure that information about an individual is properly protected from inappropriate access, use and disclosure. Such laws and regulations also include the European Union's ("EU") General Data Protection Regulation (GDPR), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Brazil's General Data Protection Law (LGPR), India's Digital Personal Data Protection Act (DPDP Act), Japan's Act on the Protection of Personal Information (APPI), China's Personal Information Protection Law (PIPL) and many other data protection and privacy laws at the national, state/provincial and local level. Under most laws and regulations around the world, any information that relates to an identifiable natural person is considered "personal information". In general, health information related to an identifiable person is considered "sensitive personal information" and is highly regulated. Processing health information carries additional obligations under these laws and regulations, often including the need to obtain the explicit consent of the individual for collection, use or disclosure of the information. In many countries, there are restrictions related to the cross-border transfer of personal information to other countries, including the need to put measures in place to allow the data transfer to occur. For example, registration with the EU-US Data Protection Framework (DPF) allows the transfer of data from the EU to US. For companies not registering with the DPF, another means of legalizing the transfer is the use of standard contractual clauses. In addition, in several countries around the world there are requirements to maintain personal information or sensitive personal information within that particular country under their data localization laws. We have established frameworks, models, processes and technologies to manage privacy, data protection and security for many data types, from a variety of sources, and under a myriad of privacy and data protection laws. In addition, we rely on our data suppliers to deliver information to us in a form and in a manner that complies with applicable privacy laws and regulations. These laws and regulations are complex, and there is no assurance that the safeguards and controls employed by us or our data suppliers will be sufficient to prevent a breach of these laws or regulations, or that claims will not be filed against us or our data suppliers despite such safeguards and controls. Failure to comply with such laws, certain certification/registration and annual re-certification/registration provisions associated with these data protection and privacy regulations, and similar rules in various jurisdictions, or to resolve any serious privacy complaints, may result in, among other things, regulatory sanctions, criminal prosecution, civil liability, negative publicity, damage to our reputation, or data being blocked from use or liability under contractual provisions. Laws and expectations relating to privacy continue to evolve, and we continue to adapt to changing needs. For example, the definition of "personally identifiable information" and "personal data" continues to evolve and broaden and many new laws and regulations are being enacted. In addition, certain established programs have been (or are at risk of being) declared invalid (such as the EU-U.S. Privacy Shield framework that operated for several years but was struck down by the European Court of Justice in July, 2020). While the replacement for the EU-U.S. Privacy Shield (the EU-U.S. Data Privacy Framework or "DPF") has been approved for the transfer of personal data from the EU to certified companies in the U.S., the DPF is also subject to legal challenges and potential invalidation, thereby rendering data transfers from the EU to the US legally uncertain and keeping the area of data transfers in a state of flux. Changes to these programs may adversely impact our ability to provide services to our clients or develop new products or services. Federal, state and foreign governments are contemplating or have proposed or adopted new privacy laws and regulations or modifications to existing privacy laws and regulations, including by amendment, replacement or interpretation through judicial or administrative decisions. New or modified privacy laws or regulations might, among other things, require us to implement new security measures and processes or bring within the scope of the privacy law or regulation other data not currently regulated, each of which may require substantial expenditures or limit our ability to offer some of our services. Additionally, changes in privacy laws and regulations may limit our data access, use and disclosure, and may require increased expenditures by us or may dictate that we not offer certain types of services. Any of the foregoing may have a material adverse impact on our ability to provide services to our clients or maintain our profitability. There is ongoing concern from privacy advocates, regulators and others regarding data protection and privacy issues, and the number of jurisdictions with privacy laws and regulations has been increasing. Also, there are ongoing public policy discussions and legal challenges regarding whether the standards for de-identified, anonymous or pseudonymized health information are sufficient, and the risk of re-identification sufficiently small, to adequately protect patient privacy. These discussions may lead to further restrictions on the use of such information. There can be no assurance that these initiatives or future initiatives will not adversely affect our ability to access and use data or to develop or market current or future services. Many privacy laws and regulations protect more than patient information, and although they vary by jurisdiction, these laws can extend to employee information, business contact information, provider information and other information relating to identifiable individuals. Failure to comply with these laws may result in, among other things, civil and criminal liability, negative publicity, damage to our reputation and liability under contractual provisions. In addition, compliance with such laws may require increased costs to us or may dictate that we not offer certain types of services. The occurrence of any of the foregoing could impact our ability to provide the same level of service to our clients, require us to modify our offerings or increase our costs, which could materially and adversely affect our operating results and financial condition.

We contract with biopharmaceutical companies to perform a wide range of services to assist them in bringing new drugs to market. Our services include monitoring clinical trials, data and laboratory analysis, electronic data capture, patient recruitment and other related services, and we perform these services in a number of ways, including through physical and technology-enabled efforts. Such services are complex and subject to contractual requirements, regulatory standards and ethical considerations. For example, we must adhere to applicable regulatory requirements such as those required by the FDA, the EMA and the competent authorities of the member states of the EU, and the MHRA in the UK, and Good Laboratory Practice and GCP requirements, which govern, among other things, the design, conduct, performance, monitoring, auditing, recording, analysis, and reporting of clinical trials. Once initiated, clinical trials must be conducted pursuant to and in accordance with the applicable investigational new drug/device application or clinical trial application, the requirements of the relevant institutional review boards or ethics committees, and GCP requirements. For studies involving controlled substances, we are also typically subject to enhanced regulations, such as those required by the U.S. Drug Enforcement Administration ("DEA") which regulates the distribution, recordkeeping, handling, security, and disposal of controlled substances. If we fail to perform our services in accordance with these requirements, regulatory agencies may take action against us for failure to comply with applicable regulations governing clinical trials or sales and marketing practices. Such actions may include sanctions, such as injunctions or failure of such regulatory authorities to grant marketing approval of products, delay, suspension or withdrawal of approvals, license revocation, product seizures or recalls, operational restrictions, civil or criminal penalties or prosecutions, damages or fines. Clients may also bring claims against us for breach of our contractual obligations and patients in the clinical trials and patients taking drugs approved on the basis of those clinical trials may bring personal injury claims against us for negligence. Any such action could have a material adverse effect on our results of operations, financial condition and reputation. Such consequences could arise if, among other things, the following occur: Improper performance of our services. The performance of clinical development services is complex and time-consuming. For example, we may make mistakes in conducting a clinical trial that could negatively impact or obviate the usefulness of the clinical trial or cause the results of the clinical trial to be reported improperly. If the clinical trial results are compromised, we could be subject to significant costs or liability, which could have an adverse impact on our ability to perform our services. As examples: - non-compliance generally could result in the termination of ongoing clinical trials or sales and marketing projects or the disqualification of data for submission to regulatory authorities;- compromise of data from a particular clinical trial, such as failure to verify that informed consent was obtained from patients, could require us to repeat the clinical trial under the terms of our contract at no further cost to our client, but at a substantial cost to us; and - breach of a contractual term could result in liability for damages or termination of the contract. Large clinical trials can cost up to hundreds of millions of dollars, and while we endeavor to contractually limit our exposure to such risks, improper performance of our services could have an adverse effect on our financial condition, damage our reputation and result in the cancellation of current contracts by or failure to obtain future contracts from the affected client or other clients. Investigation of clients. From time to time, one or more of our clients are audited or investigated by regulatory authorities or enforcement agencies with respect to regulatory compliance of their clinical trials, programs or the marketing and sale of their drugs. In these situations, we have often provided services to our clients with respect to the clinical trials, programs or activities being audited or investigated, and we are called upon to respond to requests for information by the authorities and agencies. There is a risk that either our clients or regulatory authorities could claim that we performed our services improperly or that we are responsible for clinical trial or program compliance. If our clients or regulatory authorities make such claims against us and prove them, we could be subject to damages, fines or penalties. In addition, negative publicity regarding regulatory compliance of our clients' clinical trials, programs or drugs could have an adverse effect on our business and reputation. Insufficient client funding to complete a clinical trial. As noted above, clinical trials can cost hundreds of millions of dollars. There is a risk that we may initiate a clinical trial for a client, and then the client becomes unwilling or unable to fund the completion of the clinical trial. This risk is heightened in a recessionary or weak funding environment for our customers, who may be unable to raise or expend funds necessary to complete a trial. In such a situation, notwithstanding the client's ability or willingness to pay for or otherwise facilitate the completion of the clinical trial, we may be ethically bound to complete or wind down the clinical trial at our own expense. Failure of vendors to perform contractual obligations. In the course of a clinical trial, we regularly contract with third party providers on behalf of our clients to support execution of the trial. If these third parties fail to perform their contractual obligations, we may incur additional costs or responsibilities in order to provide our clients with our contractually obligated deliverables, despite the failure of such third parties.

The United States Congress continues to consider healthcare reform legislation and impose health industry cost containment measures, which may significantly impact the biopharmaceutical industry. In addition, numerous government bodies are considering or have adopted various healthcare reforms and may undertake, or are in the process of undertaking, efforts to control growing healthcare costs through legislation, regulation and voluntary agreements with medical care providers and biopharmaceutical companies. We are uncertain as to the effects of these recent reforms on our business and are unable to predict what legislative proposals, if any, will be adopted in the future. If regulatory cost containment efforts limit the profitability of new drugs by, for example, continuing to place downward pressure on pharmaceutical pricing and/or increasing regulatory burdens and operating costs of the biopharmaceutical industry, our clients may reduce their research and development spending or promotional, marketing and sales expenditures, which could reduce the business they outsource to us. Any significant change in regulations, such as the Inflation Reduction Act of 2022 (IRA), which contains drug price negotiation provisions, or change in the interpretation of existing regulations, could reduce demand for our offerings or increase our expenses. For example, in May 2025, the Trump administration issued an executive order entitled "Delivering Most-Favored-Nation Prescription Drug Pricing to American Patients," which, among other things, directs the HHS and other agencies to communicate most-favored-nation price targets to pharmaceutical manufacturers to bring prices for U.S. patients in line with comparably developed nations and to facilitate direct-to-consumer purchasing programs. It is currently unclear whether and to what extent these measures will be implemented and what impact any such implementation would have on our business. In addition, changes to the Medicaid program or the federal 340B drug pricing program, which imposes ceilings on prices that drug manufacturers can charge for medications sold to certain health care facilities, could have a material impact on our customers, which could reduce demand for our services. Similarly, if regulatory requirements are relaxed or simplified drug approval procedures are adopted, the demand for our services could decrease. Foreign and domestic government bodies have adopted and may continue to adopt new healthcare legislation or regulations that are more burdensome than existing regulations. For example, product safety concerns and recommendations by the Drug Safety Oversight Board could change the regulatory environment for drug products, and new or heightened regulatory and licensing requirements may increase our expenses or limit or delay our ability to offer some of our services. We might have to incur additional costs to comply with these or other new regulations, and failure to comply could harm our financial condition, results of operations, cash flows, and reputation, and result in adverse legal action(s). Additionally, new or heightened regulatory requirements may have a negative impact on the ability of our clients to conduct industry-sponsored clinical trials, which could reduce the need for our services.