Waystar Holding Corp. (WAY) Risk Analysis

Almost all of our revenue is derived from the healthcare industry, which is subject to changing political, legislative, regulatory, and other influences. Healthcare laws and regulations are rapidly evolving, including as a result of changes in the U.S. administration resulting in changes in federal law and enforcement, and may change significantly in the future, which could adversely affect our financial condition and results of operations. For example, in March 2010, the Patient Protection and Affordable Care Act (the "ACA") was adopted, which is a healthcare reform measure that provides healthcare insurance for millions of Americans. The ACA includes a variety of healthcare reform provisions and requirements that substantially changed the way healthcare is financed by both governmental and private insurers, which significantly impact our industry and our business. We are unable to predict the full impact of any health reform initiatives or legislative updates to current healthcare laws on our operations in light of the uncertainty regarding whether, when, and how alternative reforms, if any, may be enacted, the timing of enactment and implementation of alternative provisions and the impact of alternative provisions on various healthcare industry participants. We are also unable to predict how recent regulatory reforms regarding information blocking, algorithm transparency, interoperability, and health data will impact our business and whether the new presidential administration will continue to enforce or implement past reforms. For example, President Trump's Administration revoked President Biden's executive order on AI and it is unclear how the new Administration will implement final rules on Health Data, Technology and Interoperability (HTI-1, HTI-2, and HTI-3) that took effect in 2024. Future legislative, executive, and regulatory proposals may constitute a significant departure from previous regulations regarding patient data. While certain of these rules benefit us in that certain EHR vendors will no longer be permitted to interfere with our attempts at integration, they may also make it easier for other similar companies to enter the market, creating increased competition and reducing our market share.Changes to the legal, regulatory or political environment may require management's attention, divert resources from other areas, and expose us to potential liability. In addition, we are subject to various other laws and regulations, including, among others, anti- kickback laws, antitrust laws, and the privacy and data protection laws described below. See Part I, Item 1, "Business- Regulation-Healthcare fraud and abuse provisions."

Our current and future arrangements with our channel partners, healthcare professionals, consultants, clients, and third-party payors subject us to various federal and state fraud and abuse laws and other healthcare laws, including, without limitation, the AKS and state kickback laws, the federal civil and criminal false claims laws, civil monetary penalties laws, the Stark Law, HIPAA, and the regulations promulgated under such laws. These laws impact, among other things, proposed sales, marketing, and educational programs, and other interactions with healthcare professionals and provider clients. For more information regarding the risks related to these laws and regulations please see Part I, Item 1, "Business-Regulation-Healthcare fraud and abuse provisions." These laws are complex, may change rapidly, and the scope and enforcement and application of each of these laws to our specific services and relationships may not be clear and may be applied to our business in ways we do not anticipate. Federal and state regulatory and law enforcement authorities continue to focus on enforcement activities with respect to Medicare, Medicaid, other government and third-party payor programs, and other healthcare reimbursement laws and rules in an effort to reduce overall healthcare spending. Federal and state enforcement bodies have recently increased their scrutiny of interactions between healthcare companies and healthcare providers, which has led to a number of investigations, prosecutions, convictions, and settlements in the healthcare industry. Because of the breadth of these laws and the narrowness of their statutory or regulatory exceptions and safe harbors, some of our business activities may be subject to challenge under one or more of them. Federal government healthcare reforms, cost-cutting, efficiency, and fraud and abuse initiatives, and other proposed or future changes may also result in reductions in healthcare reimbursement, healthcare spending, and the federal workforce that oversees healthcare programs, which may have a significant adverse impact on our business. In addition, new and evolving payment structures, for example, such as accountable care organizations and other arrangements involving combinations of healthcare providers who share savings, potentially implicate anti-kickback and other fraud and abuse laws. The government has prosecuted revenue cycle management service providers for causing the submission of false or fraudulent claims in violation of the FCA, and vendors of EHR software for, among other things, misrepresenting the capabilities of their software and payment of kickbacks to certain customers in exchange for promoting their products in violation of the AKS and the FCA. Errors created by our platform and our proprietary products and solutions that relate to entry, formatting, preparation, or transmission of claims, reporting of quality or other data pursuant to value-based purchasing initiatives, or cost report information may be alleged or determined to cause the submission of false claims or otherwise be in violation of these laws. As we continue to build new and evolving technologies, such as AI, machine learning, analytics, and biometrics, into our products and solutions, our business may become subject to additional complex and evolving regulatory requirements pertaining to the sale or use of these technologies. The sale of these technologies, or their use by us or by our clients or partners, may also subject us to additional risks, including reputational harm, competitive harm, or legal liabilities. Ensuring that our internal operations and future business arrangements with third parties comply with applicable healthcare laws and regulations will involve substantial costs. Achieving and sustaining compliance requires us to implement controls across our entire organization which may prove costly and challenging to monitor and enforce. The risk of our being found in violation of healthcare laws and regulations is increased by the fact that their provisions are sometimes open to a variety of interpretations. We cannot assure you that our arrangements and activities will be deemed outside the scope of these laws or that increased enforcement activities will not directly or indirectly have a material adverse effect on our business, financial condition, or results of operations. It is possible that governmental authorities will conclude that our business practices do not comply with current or future statutes, regulations, agency guidance, or case law involving applicable fraud and abuse or other healthcare laws and regulations. If our operations are found to be in violation of any of the laws described above or any other governmental laws and regulations that may apply to us, we may be subject to significant penalties, including administrative, civil, and criminal penalties, damages, fines, disgorgement, the exclusion from participation in federal and state healthcare programs, disqualification from providing services to healthcare providers doing business with government programs, individual imprisonment, reputational harm, and the curtailment or restructuring of our operations, requirements to change or terminate some portions of our operations or business, as well as additional reporting obligations and oversight if we become subject to a corporate integrity agreement or other agreement to resolve allegations of non-compliance with these laws. If we are determined to have violated any of these laws, we may be required to give our clients the right to terminate our services agreements with them and/or required to refund portions of our base fee revenues and incentive payment revenues, any of which could have a material adverse effect on our business and results of operations. Likewise, if any of the physicians or other providers or entities with whom we expect to do business are found to not be in compliance with applicable laws, they may be subject to criminal, civil, or administrative sanctions, including exclusions from government funded healthcare programs and imprisonment as well. Any violations by, and resulting penalties or exclusions imposed upon, our clients could adversely affect their financial condition and, in turn, have a material adverse effect on our business and results of operations. Even absent an alleged violation of law by us, participants in the healthcare industry receive inquiries or subpoenas to produce documents and provide testimony in connection with government investigations. We could be required to expend significant time and resources to comply with these requests, and the attention of our management team could be diverted by these efforts. Further, defending against any such actions can be costly and time consuming, and may require significant financial and personnel resources. Therefore, even if we are successful in defending against any such actions that may be brought against us, our business may be impaired. If any of the above occur, our ability to operate our business and our results of operations could be adversely affected.

To the extent we are not otherwise permitted to use and/or disclose client information, we require our clients to provide necessary notices and obtain necessary permissions, consents, and authorizations for the use and disclosure of the information that we receive from our solutions. We then provide patient information to third parties, pursuant to patient permissions, consents, and authorizations that permit the third parties to collect such information, and such patient information may be aggregated or combined with other data sources to gain additional insights from such patient information. Such patient information may also be anonymized/de-identified and sold to or collected by a data aggregator. If our clients do not provide necessary notices or obtain necessary permissions, consents, or authorizations, then our use and disclosure of information that we receive from them or on their behalf may be limited or prohibited by federal or state privacy or other laws. Such failures by our clients could impair our functions, processes, and databases that reflect, contain, or are based upon such information. In addition, such failures by our clients could interfere with or prevent creation or use of rules, analyses, or other data-driven activities that benefit us or make our solutions less useful. Accordingly, we may be subject to claims or liability for inaccurate claims data submitted to payers, inaccurate or incomplete billing and coding claims or for use or disclosure of information by reason of lack of valid notice, permission, consent, or authorization. These claims or liabilities could damage our reputation, subject us to unexpected costs, and could have a material adverse impact on our business, results of operations, or financial condition.

We conduct business through various internet websites and web-based applications that are subject to accessibility requirements. Courts have ruled that the Americans with Disabilities Act ("ADA") applies to internet websites and other digital experiences and litigation related to ADA website accessibility has soared in recent years. Failing to comply with those requirements could leave us subject to claims, litigation, lawsuits, and, ultimately, substantial fines and penalties.

We rely on a variety of marketing techniques, including email and telephone marketing. These activities are regulated by legislation such as the CAN-SPAM Act and the TCPA. The CAN-SPAM Act imposes penalties for the transmission of commercial emails that do not comply with certain requirements, such as providing an opt-out mechanism for stopping future emails from the sender. The TCPA places certain restrictions on making outbound calls, faxes, and text messages to consumers. Any failure by us to comply fully with any such applicable laws or regulations may subject us to substantial fines and penalties. In addition, any future restrictions in laws such as the CAN-SPAM Act, the TCPA, and various other laws and regulations regarding marketing and solicitation activities could adversely affect the continuing effectiveness of our marketing efforts and could force changes in our marketing strategies. If this occurs, we may not be able to develop adequate alternative marketing strategies, which could have a material adverse impact on our results of operations.

We are contractually required to comply with certain anti-money laundering laws and regulations. For instance, we comply with certain provisions of the Bank Secrecy Act, as amended by the USA PATRIOT Act of 2001, and its implementing regulations (collectively, the "BSA"), which are enforced by the Financial Crimes Enforcement Network ("FinCEN"), a bureau of the U.S. Department of the Treasury and the U.S. Department of Justice. We have policies, procedures, systems, and controls designed to identify and address potentially impermissible transactions under these laws and regulations. In addition, we provide BSA/AML training to certain employees to help ensure compliance with such contractual requirements. However, any failure to comply with such contractual requirements could subject us to potential liability for breach of contract, which could adversely affect our business or financial condition.

Numerous complex federal and state laws and regulations govern the Processing of personal information, including PHI, personal health records, and payment card data. State laws may be even more restrictive and not preempted by HIPAA and may be subject to varying interpretations by the courts and government agencies. These laws and regulations, including their interpretation by governmental agencies, are subject to frequent change and could have a negative impact on our business. Further, these varying interpretations could create complex compliance issues for us and our partners and potentially expose us to additional expense, liability, penalties, negatively impact our client relationships, and lead to adverse publicity, and these risks could adversely affect our business in the short and long term. See Part I, Item 1, "Business- Regulation-Federal and state health information privacy and security laws." We are a "covered entity" as defined under HIPAA when we provide our clearinghouse services, and we also are a "business associate" as defined under HIPAA for other covered entities when we provide revenue cycle management and other solutions. HHS OCR may impose civil penalties on both covered entities and business associates for their failure to comply with HIPAA requirements. These requirements are subject to change. In December 2024, HHS OCR issued a notice of proposed rulemaking on the HIPAA Security Rule, which is specifically aimed at strengthening cybersecurity of electronic PHI, and we are monitoring this proposed rulemaking. The U.S. Department of Justice is responsible for criminal prosecutions under HIPAA. Penalties can vary significantly depending on a number of factors, such as whether the covered entity's or business associate's failure to comply was due to willful neglect. Violations of HIPAA could result in substantial criminal and civil penalties, including up to 10 years in prison for each violation. HIPAA also authorizes state attorneys general to file suit on behalf of the residents of their states. While HIPAA does not create a private right of action that would allow individuals to sue in civil court for HIPAA violations, its standards have been used as the basis for the duty of care in state civil suits, such as those for recklessness in misusing individuals' health information. If we are subject to investigation or litigation related to an alleged violation of HIPAA, then we may elect to resolve the matter through additional reporting and oversight obligations through a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. Such settlement could require payment of a civil penalty or damages, corrective action, and/or monitoring of our business by a third party. The security measures that we and our third-party vendors and subcontractors have in place designed to comply with privacy and data protection laws may not protect our facilities and systems from security breaches or incidents, including acts of vandalism or theft, computer viruses, misplaced or lost data, malfeasance, programming, and human errors or other similar events. We may also be liable for privacy and security breaches and failures of our business associates and subcontractors. Even though we provide for certain protections through our agreements with our subcontractors, we still have limited control over their actions and practices. A breach of privacy or security of individually identifiable health information by a subcontractor may result in an enforcement action, including criminal and civil liability, against us. We are not able to predict the extent of the impact such incidents may have on our business. Our failure to comply with HIPAA and other health privacy laws may also result in criminal and civil liability. Enforcement actions against us could be costly and could interrupt regular operations, which may adversely affect our business. While we have not received any notices of violation of the applicable privacy and data protection laws and believe we are in compliance with such laws, there can be no assurance that we will not receive such notices in the future. Our AI platform and the data it uses may also subject us to additional risks. We use de-identified claims data to train our revenue cycle management AI. In order to de-identify PHI for our AI, we must have explicit rights and permissions to do so from our clients. If we do not de-identify PHI in accordance with HIPAA's safe harbor method or if we do not have rights or permissions to de-identify PHI, but de-identify PHI for such purposes, a regulator or client may consider such actions to be a breach of HIPAA's requirements or of contractual requirements, and we may be subject to criminal and civil liability or other actions and our clients may not renew or terminate their contracts with us. Many states are also enacting legislation on the use, creation, and deployment of AI. For example, in March 2024, Utah enacted the Artificial Intelligence Policy Act, which requires disclosures to consumers about the use of AI in certain circumstances, including advance AI use disclosures by physicians and individuals in other regulated occupations. In Colorado, the Colorado AI Act will regulate the development, deployment, and use of certain AI systems, including with respect to algorithmic discrimination and decisions with respect to healthcare services. Developers of generative AI systems would be required to complete impact assessments and disclose measures the developer has taken to mitigate any known or reasonably foreseeable risks of algorithmic discrimination that may arise from deployment of certain "high-risk" AI systems that are developed and marketed to make consequential decisions, such as decisions that have a material legal or similarly significant effect on consumer access to certain services, including healthcare and financial services. Other states have introduced similar bills. Even when HIPAA does not apply, according to the Federal Trade Commission (the "FTC"), failing to take appropriate steps to keep consumers' personal information secure constitutes unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act (the "FTCA") 15 U.S.C. § 45(a). The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. The FTC's current guidance for appropriately securing consumers' personal information is similar to what is required by the HIPAA security regulations, but this guidance may change in the future, resulting in increased complexity and the need to expend additional resources to ensure we are complying with the FTCA. For information that is not subject to HIPAA and deemed to be "personal health records," the FTC may also impose penalties for violations of the Health Breach Notification Rule ("HBNR") to the extent we are considered a "personal health record- related entity" or "third party service provider." The FTC has taken several enforcement actions under HBNR this year and indicated that the FTC will continue to protect consumer privacy through greater use of the agency's enforcement authorities. As a result, we expect even greater scrutiny by federal and state regulators, partners, and consumers of our Processing of health information, particularly with our AI-enabled solutions. Additionally, federal and state consumer protection laws are increasingly being applied by the FTC and states' attorneys general to regulate the Processing of personal information, through websites or otherwise, and to regulate the presentation of website content. Other federal and state laws that restrict the use and protect the privacy and security of personally identifiable information are, in many cases, not preempted by HIPAA and may be subject to varying interpretations by the courts and government agencies. These varying interpretations can create complex compliance issues for us and our partners and potentially expose us to additional expense, adverse publicity, and liability, any of which could adversely affect our business. Recently, several states have enacted consumer health data laws, which generally require consent for the collection, use, or sharing of any "consumer health data," which is typically defined as personal information that is linked or reasonably linkable to a consumer and that identifies a consumer's past, present, or future physical or mental health. Future laws, regulations, standards, obligations, amendments, and changes in the interpretation of existing laws, regulations, standards, and obligations could impair our or our clients' ability to Process information relating to consumers, which could decrease demand for our platform, increase our costs, and impair our ability to maintain and grow our client base, and increase our revenue. New laws, amendments to or re-interpretations of existing laws and regulations, industry standards, and contractual obligations could impair our or our clients' ability to collect, use, or disclose information relating to patients or consumers, which could decrease demand for our platform offerings, increase our costs, and impair our ability to maintain and grow our client base, and increase our revenue. Accordingly, we may find it necessary or desirable to fundamentally change our business activities and practices or to expend significant resources to modify our software or platform and otherwise adapt to these changes. We are also subject to self-regulatory standards and industry certifications that may legally or contractually apply to us. These include the Payment Card Industry Data Security Standards ("PCI-DSS") and AICPA Systems and Organization Controls 2 ("SOC 2"), with which we are currently compliant, and HITRUST certification, which we currently maintain. In the event we fail to comply with the PCI-DSS or fail to maintain our SOC 2 or HITRUST certification, we could be in breach of our obligations under client and other contracts, fines, and other penalties could result, and we may suffer reputational harm and damage to our business. Further, our clients may expect us to comply with more stringent privacy, data storage, and data security requirements than those imposed by laws, regulations or self-regulatory requirements, and we may be obligated contractually to comply with additional or different standards relating to our handling or protection of data. Any failure or perceived failure by us to comply with domestic laws or regulations, industry standards, or other legal obligations, or any actual or suspected breach or privacy or security incident, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personally identifiable information or other data, may result in governmental enforcement actions and prosecutions, private litigation (including class actions), fines, and penalties or adverse publicity and could cause our clients to lose trust in us, which could have an adverse effect on our reputation and business. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new products and features could be limited. Any of these developments could harm our business, financial condition, and results of operations. Privacy and data security concerns, whether valid or not valid, may inhibit retention of our platform or services by existing clients or adoption of our platform or services by new clients.

We face an implementation cycle that is dependent on our clients' timing, which may pose scheduling challenges, and our clients' resources, which may be constrained or significantly diverted to larger projects, each of which can impact timing of implementation of our solutions. Providers are faced with labor-intensive, manual tasks as well as disconnected systems and tools, compounded by broad workforce shortages and high staff turnover rates, which can further limit their resources and ability to implement our solutions. Implementation of our solutions may also require other technology implementation or process changes by the client. If implementation periods are delayed or extended, our ability to generate revenue from these solutions would also be delayed even though we have expended time and resources in the implementation of such solutions. Even if implementation has begun, there can be no assurance that we will recognize revenue on a timely basis or at all from our efforts, and any revenue may not be recognized during the same period in which we incur implementation expenses.

As a payments facilitator, we handle payments from payers and from patients for many of our provider clients and are in possession of payment card information and banking account information. Even when we do not facilitate payments, our solutions also involve the use and disclosure of personal and business information that could be used to impersonate third parties or otherwise gain access to their data or funds. If any of our employees or vendors or other bad actors does not comply with the law or engages in unethical conduct, such as taking, converting, or misusing funds, documents, or information, or if we experience a data breach creating a risk of identity theft, we could be liable for damages, and our reputation could be damaged or destroyed. In addition, we could be perceived to have facilitated or participated in illegal misappropriation of funds, documents, or data and, therefore, be subject to civil or criminal liability. Federal and state regulators may take the position that a data breach or misdirection of data constitutes an unfair or deceptive act or trade practice. We also may be required to notify individuals affected by any data breaches. Further, a data breach or similar incident could impact the ability of our clients that are creditors to comply with the federal "red flags" rules, which require the implementation of identity theft prevention programs to detect, prevent, and mitigate identity theft in connection with client accounts. Any such data breach could have an adverse impact on our business, results of operations, and reputation.

Our products and solutions are used to help simplify the payment process for healthcare providers. If our products and solutions fail to provide accurate and timely information or are associated with errors or malfunctions, then our clients could assert claims against us that could result in substantial costs to us, harm our reputation in the industry, and cause demand for our products and solutions to decline. Although we attempt to limit by contract our liability for damages, the allocations of responsibility and limitations of liability set forth in our contracts may not be enforceable or may not otherwise sufficiently protect us from liability for damages. In certain circumstances, we may also be liable for the acts or omissions of others, such as our vendors or suppliers. On occasion, we enter into standard indemnification arrangements in the ordinary course of business. Pursuant to these arrangements, we indemnify, hold harmless, and agree to reimburse the indemnified parties for losses suffered or incurred by the indemnified party, in connection with any trade secret, copyright, patent, or other intellectual property infringement claim by any third party with respect to its technology. The terms of these indemnification agreements are generally perpetual. See Part I, Item 1, "Business-Indemnification and Insurance." Moreover, our products and solutions may contain defects, errors, bugs, vulnerabilities, or failures that are not detected until after the software is introduced or updates and new versions are released. From time to time we have discovered defects, errors, bugs, vulnerabilities, or failures in our software, and such defects, errors, bugs, vulnerabilities, or failures can be expected to occur in the future. Defects, errors, bugs, vulnerabilities, or failures that are not timely detected and remedied could expose us to risk of liability to our clients and cause delays in introduction of new solutions, result in increased costs and diversion of development resources, require design modifications, decrease market acceptance or client satisfaction with our solutions, and harm our brand and reputation. In addition, we create rules within our products and solutions based on payers' authorization policy documents, and which may be used for financial recovery by our clients. These policies and related legal requirements can be complex and are subject to frequent changes. If such rules are inaccurate or contain errors, or if we fail to timely update our rules to reflect any changes in policies or requirements, then we may be subject to liability. If any of these risks occur, they could materially adversely affect our business, financial condition, or results of operations.

We have in the past incorporated and may in the future incorporate certain open source software into our products and solutions. Open source software is licensed by its authors or owners under open source licenses, which in some instances may subject us to certain unfavorable conditions, including requirements that we offer our products and solutions that incorporate such open source software for no cost, that we make publicly available the source code for any modifications or derivative works we create based upon, incorporating or using the open source software, or that we license such modifications or derivative works under the terms of the particular open source license. In addition, the use of third-party open source software could expose us to greater risks than the use of third-party commercial software to the extent open-source licensors do not provide warranties or controls on the functionality or origin of the software equivalent to those provided by third-party commercial software providers. Further, the public availability of open source software may make it easier for attackers to target and compromise our platform through cyber-attacks. Open sourcing such software requires us to make the source code publicly available, and therefore can limit our ability to protect our intellectual property rights with respect to that software. From time to time, companies that use open source software have faced claims challenging the use of open source software or compliance with open source license terms. Furthermore, there is an increasing number of open source software license types, many of which have not been tested in a court of law. We could be subject to suits by parties claiming copyright infringement or noncompliance with open source licensing terms. While we monitor the use of open source software and try to ensure that none is used in a manner that would require us to disclose our proprietary source code or that would otherwise breach the terms of an open source license, such use could inadvertently occur, in part because open source license terms are often ambiguous. Any requirement to disclose our proprietary source code or pay damages for breach of contract could have a material adverse effect on our business, financial condition, and results of operations and could help our competitors develop products and solutions that are similar to or better than ours.

We have integrated AI and machine learning technologies into our products and solutions, and our future success will depend, in part, on our ability to leverage these technologies responsibly and effectively. The development and use of AI subjects us to risks that could adversely affect our business, financial condition and results of operations, and use of such technologies may not enhance our products or solutions, allow us to keep pace with competitors or benefit our business as intended. As these technologies are rapidly developing, it is not possible to predict all of the legal, operational, competitive, security, technological and other risks that may arise relating to the use of such technologies. Our AI-enabled solutions depend on the quality and completeness of training data, and deficiencies could result in inaccurate, misleading, unreliable, or biased outputs that could harm our clients or expose us to liability. AI technologies are inherently complex, and our AI systems may not perform as intended, or may degrade in performance over time due to changes in underlying data, payer requirements, market conditions or for other reasons. Validating AI outputs requires substantial resources and consistent, reliable performance across diverse client environments and use cases is difficult. Any actual or perceived failures of our AI-enabled solutions could result in client dissatisfaction, claims against us, regulatory scrutiny, or reputational harm. Our clients may impose contractual restrictions on our use of AI, or seek indemnification for AI-related errors, any of which could limit the value of our AI-enabled solutions or expose us to liability. Client reluctance to adopt AI features due to accuracy, liability, or regulatory concerns could also slow our ability to realize returns on our AI investments. Moreover, AI is subject to a dynamic and rapidly evolving legal and regulatory environment, and our efforts, including the introduction of new products or changes to existing products, may result in new or enhanced governmental or regulatory scrutiny, litigation, ethical concerns, or other complications and liabilities. We may not be able to successfully respond to these rapidly evolving frameworks, laws, regulations and other requirements, and we may need to expend significant resources to adjust our operations or offerings in response. The rapid advancement of generative and agentic AI also poses competitive risks. Large technology companies with significantly greater resources are deploying AI tools that could commoditize revenue cycle management functions core to our platform, and competitors may also adopt or deploy AI more quickly or effectively than we do. Agentic AI systems could automate workflows our clients currently rely on us to perform, and EHR and PM vendors may integrate AI capabilities directly into their platforms, reducing demand for our solutions. Generative AI may also lower barriers to entry, enabling new competitors to emerge more quickly. If we fail to keep pace with AI advancements or our AI-enabled solutions do not achieve market acceptance, our competitive position could be materially harmed.

We depend upon licenses from third parties for some of the technology and data used in our products and solutions, and for some of the technology platforms upon which these products and solutions are built and operate. We expect that we may need to obtain additional licenses from third parties in the future in connection with the development of our products and solutions. In addition, we obtain a portion of the data that we use from government entities and public records for specific client engagements. We believe that we have all rights necessary to use the data that is incorporated into, or used to develop and improve, our products and solutions. However, we cannot assure you that our licenses for information will allow us to use that information for all potential or contemplated products and solutions. In addition, our ability to use data to support and improve existing products and solutions and to develop new products and solutions is largely dependent upon the contractual rights we secure. For example, certain of our products depend on maintaining our data and analytics platform, which is populated with data disclosed to us by healthcare providers and payers with their consent. If these providers and/or payers revoke their consent for us to maintain, use, de-identify, and share this data, consistent with applicable law, our data assets could be degraded. In the future, data providers could withdraw their data from us or restrict our usage for any reason, including if there is a competitive reason to do so, if legislation is passed restricting the use of the data, or if judicial interpretations are issued restricting use of the data that we currently use in or for development and maintenance of our products and solutions. In addition, data providers could fail to adhere to our quality control standards in the future, causing us to incur additional expense to appropriately utilize the data. If a substantial number of data providers were to withdraw or restrict their data, or if they fail to adhere to our quality control standards, and if we are unable to identify and contract with suitable alternative data suppliers and integrate these data sources into our offerings, our ability to provide products and solutions to our partners would be materially adversely impacted, which could have a material adverse effect on our business, financial condition, and results of operations. We also integrate into our proprietary products and solutions and use third-party software to maintain and enhance, among other things, content generation and delivery, and to support our technology infrastructure. Some of this software is proprietary and some is open source software. Our use of third-party technologies and open source software exposes us to increased risks, including, but not limited to, risks associated with the integration of new technology into our platform, the diversion of our resources from development of our own proprietary technology and our inability to generate revenue from licensed technology sufficient to offset associated acquisition and maintenance costs. These technologies may not be available to us in the future on commercially reasonable terms or at all and could be difficult to replace once integrated into our own proprietary products and solutions. Most of these licenses can be renewed only by mutual consent and may be terminated if we breach the terms of the license and fail to cure the breach within a specified period of time. Our inability to obtain, maintain, or comply with any of these licenses could delay development until equivalent technology can be identified, licensed, and integrated, which would harm our business, financial condition, and results of operations. Most of our third-party licenses are non-exclusive and our competitors may obtain the right to use any of the technology covered by these licenses to compete directly with us. If our data suppliers choose to discontinue support of the licensed technology in the future, we might not be able to modify or adapt our own solutions.

We face a selling cycle of variable length, which can span from weeks to 18 months or longer, to secure a new agreement with a client. We invest a substantial amount of time and resources on our sales efforts without any assurance that our efforts will produce sales. Even if we succeed at completing a sale, we may be unable to predict the size of the initial arrangement until very late in the sales cycle. We expend time and resources as part of our sales effort, and we may not recognize any revenue to offset such expenditures in the same period, particularly for longer sales cycles. We cannot accurately predict the timing of entering into agreements with new clients due to the complex procurement decision processes of many healthcare providers, which often involves high-level management or board committee approvals that can be delayed due to factors beyond our and their control. Due to our variable selling cycle length, we have only a limited ability to predict the timing of specific new client relationships, which affects our ability to predict future revenues and cash flows.

Our business substantially depends on our ability to retain our existing clients and attract new clients. We expect to derive a significant portion of our revenue from renewal of existing clients' contracts and sales of additional products and solutions to existing clients. As a result, achieving a high client retention rate, expanding within existing clients, and selling additional products and solutions are critical to our revenue. In addition, our ability to increase our client base will be critical to our future growth. In order to retain existing clients and attract new clients, we must provide solutions that enable our existing and prospective clients to simplify and improve the payment process, increase speed and efficiencies, and deliver exceptional client service. Factors that may affect our client satisfaction, our ability to sell additional products and solutions to existing clients, and expand our client base include, but are not limited to, the following: - the performance and functionality of our platform;- our ability to deliver a high-quality client experience;- our ability to develop and sell complementary products and solutions;- the stability, performance, and security of our hosting infrastructure;- our ability to attract, retain, and effectively train sales and marketing personnel;- the delivery of products that are easy to use and deliver tangible value to clients;- changes in healthcare laws, regulations, or trends, and our ability to quickly adapt;- the business environment of our clients, including healthcare staffing shortages and headcount reductions by our clients;- the price of our products and solutions relative to our competitors;- our ability to integrate with EHR or PM systems; and - our ability to maintain and enhance our reputation and brand recognition. Our clients have no obligation to renew their subscriptions for our platform solutions after the initial term expires, which is typically a two to three-year term. Our contracts generally provide for the automatic renewal for one-year subsequent terms, with the ability for our clients to terminate the contract with limited notice to us. Our clients' renewal rates may fluctuate or decline because of several factors, including their satisfaction or dissatisfaction with our solutions and support, the prices of our solutions as compared to our competitors' pricing, or reductions in our clients' spending levels due to the macroeconomic environment or other factors. In addition, our clients may negotiate terms less advantageous to us upon renewal, which may reduce our revenue from these clients and may decrease our annual revenue. If our clients notify us of intent not to renew, renew their contracts upon less favorable terms, or at lower fee levels or fail to purchase new products and solutions from us, our revenue may decline, or our future revenue growth may be constrained.