OMNICELL INC

Previous wording

•Strategic Risks. Our investments in new business strategies or initiatives, including our transition to selling more products and services on a subscription basis, are inherently risky and may not be successful or we may be unable to maintain our Advanced Services customers. In addition, we may be unable to realize the potential benefits of our expense containment measures or our acquired businesses, including RxInnovation Inc., operating as FDS Amplicare® (“FDS Amplicare”), ReCept Holdings, Inc., (“ReCept”), which was subsequently renamed Omnicell Specialty Pharmacy Services, Inc. (“Omnicell Specialty Pharmacy Services”), MarkeTouch Media, LLC (“MarkeTouch Media”), and Hub and Spoke Innovations, and risks related to investments in new business strategies and initiatives could disrupt ongoing business and present risks not originally contemplated.

Current wording

•Strategic Risks. Our investments in new business strategies or initiatives, including our transition to selling more products and services on a subscription basis, are inherently risky and may not be successful or we may be unable to maintain our SaaS and Expert Services customers. In addition, we may be unable to realize the potential benefits of our acquired businesses, including RxInnovation Inc., operating as FDS Amplicare® (“FDS Amplicare”), Omnicell Specialty Pharmacy Services, Inc. (“Omnicell Specialty Pharmacy Services”), MarkeTouch Media, LLC (subsequently merged into EnlivenHealth, Inc.), and Hub and Spoke Innovations, and risks related to investments in new business strategies and initiatives could disrupt ongoing business and present risks not originally contemplated.

Previous wording

•Technology Risks. We may be unable to develop new solutions or enhance existing solutions to react to changes in technology and customer requirements in a timely and cost-effective manner or we may experience errors in the provision of our Advanced Services that could expose us to liability.

Current wording

•Technology Risks. We may be unable to develop new solutions or enhance existing solutions to react to changes in technology and customer requirements in a timely and cost-effective manner or we may experience errors in the provision of our SaaS and Expert Services that could expose us to liability. In addition, we may incorporate artificial intelligence technologies into certain of our products, services, and processes or our vendors may incorporate artificial intelligence tools into their offerings that may result in enhanced governmental or regulatory scrutiny, litigation, compliance issues, ethical, confidentiality, or security concerns.

Previous wording

•Any conversion of our Notes (as defined below) may dilute the ownership interest of our stockholders, depress the price of our common stock or, if the conditional conversion feature of the Notes is triggered, adversely affect our business, operating results, cash flow, or financial condition. Also, our convertible note hedge transactions may decrease the value of our common stock.

Current wording

•Any conversion of our 2029 Notes or 2025 Notes (each as defined below) may dilute the ownership interest of our stockholders, depress the price of our common stock or, if the conditional conversion feature of the 2029 Notes or 2025 Notes is triggered, adversely affect our business, operating results, cash flow, or financial condition. Also, our convertible note hedge transactions may decrease the value of our common stock.

Previous wording

Customer demand for our products is significantly linked to the strength of the economy. From time to time, the U.S. and global economy has experienced cyclical downturns impacting economic activity, the results of which include decreased demand for goods and services, reduced government spending, rising inflation, increasing interest rates, liquidity or credit constraints, declines in corporate profitability, credit, equity, or foreign exchange market volatility, increased bankruptcies, and general economic uncertainty. If decreases in demand for capital equipment caused by weak or uncertain economic conditions and decreased corporate and government spending, any effects of fiscal budget balancing at the federal level or proposed legislative changes, or generally reduced expenditures for capital solutions occur, we will experience decreased revenues and lower revenue growth rates, and our business, operating results, cash flow, or financial condition could be materially and adversely affected. In addition, within the current macroeconomic environment, we have seen some customers defer or delay implementation of capital equipment projects, including due to customer labor shortages and increased healthcare worker turnover, along with longer timeframes both for capital equipment purchasing decisions and for entering into agreements for our products or solutions due to customer capital budget constraints or customers seeking to stagger or elongate the timeframes between the adoption of new or updated technologies, which has resulted in moderated demand, and may lead to decreased revenues and could result in our business, operating results, cash flow, or financial condition being materially and adversely affected. Furthermore, the foregoing factors may also impact the willingness or ability of our customers to pay their existing obligations or honor their contractual commitments, which could result in decreased revenue and negatively impact our business, operating results, cash flow, or financial condition.

Current wording

Customer demand for our products is significantly linked to the strength of the economy. From time to time, the U.S. and global economy has experienced cyclical downturns impacting economic activity, the results of which include decreased demand for goods and services, reduced government spending, rising inflation, increasing interest rates, liquidity or credit constraints, declines in corporate profitability, credit, equity, or foreign exchange market volatility, increased bankruptcies, and general economic uncertainty. If decreases in demand for capital equipment caused by weak or uncertain economic conditions and decreased corporate and government spending, any effects of fiscal budget balancing at the federal level or proposed legislative changes, or generally reduced expenditures for capital solutions occur, we will experience decreased revenues and lower revenue growth rates, and our business, operating results, cash flow, or financial condition could be materially and adversely affected. In addition, we have seen some customers defer or delay implementation of capital equipment projects, along with longer timeframes both for capital equipment purchasing decisions and for entering into agreements for our products or solutions due to customer capital budget constraints or customers seeking to stagger or elongate the timeframes between the adoption of new or updated technologies, which has resulted in moderated demand, and may lead to decreased revenues and could result in our business, operating results, cash flow, or financial condition being materially and adversely affected. Furthermore, the foregoing factors may also impact the willingness or ability of our customers to pay their existing obligations or honor their contractual commitments, which could result in decreased revenue and negatively impact our business, operating results, cash flow, or financial condition.

Previous wording

The broader U.S. and global economy has experienced elevated inflationary pressures as well as continued supply chain disruptions, labor shortages and geopolitical instability. We are unable to predict future changes in the state of the U.S. or global economy or whether inflationary pressures will continue to intensify or subside. If the current inflationary trends continue, or fail to improve, it could adversely affect our profits, margins or operating results as a result of increasing costs.

Current wording

The broader U.S. and global economy has continued to experience elevated inflationary pressures as well as continued supply chain disruptions, labor shortages and geopolitical instability. We are unable to predict future changes in the state of the U.S. or global economy or whether inflationary pressures will continue to intensify or subside. If the current inflationary trends remain elevated, or fail to improve, it could adversely affect our profits, margins or operating results as a result of increasing costs.

Previous wording

New product and service developments or enhancements may be delayed, have technical problems (including software defects or errors), fail to meet customer or market specifications, regulatory requirements, or industry standards, which could result in increased or unexpected expenses related to further developments or modifications. In addition, they also may not be competitive with other products using new or alternative technologies that offer comparable performance and functionality, may not be accepted in new or existing markets, or may not achieve expected return on investment. Any of the foregoing could make our existing and future solutions obsolete and unmarketable, or result in loss of market share or a determination to exit a particular business or product line, damage our reputation or otherwise harm our business, operating results, cash flow, or financial condition.

Current wording

New product and service developments or enhancements may be delayed, have technical problems (including software defects or errors), fail to meet customer or market specifications, regulatory requirements, or industry standards, which could result in increased or unexpected expenses related to further developments or modifications. In addition, they also may not be competitive with, or rendered obsolete by, other products using new or alternative technologies that offer comparable performance and functionality, such as AI, machine-learning, and generative AI capabilities, may not be accepted in new or existing markets, or may not achieve expected return on investment. Any of the foregoing could make our existing and future solutions obsolete and unmarketable, or result in loss of market share or a determination to exit a particular business or product line, damage our reputation or otherwise harm our business, operating results, cash flow, or financial condition.

Previous wording

Our ability to execute successfully on the industry vision of the Autonomous Pharmacy depends on our ability to continue to develop and introduce new products and services or product and service enhancements, and integrate new products and services with existing offerings, in furtherance of this vision in a timely manner and on a cost-effective basis. If we fail to do so, we may be unable to achieve the industry vision of the Autonomous Pharmacy or we may not realize the anticipated benefits of our investments in support of this vision, either of which could have a material adverse effect on our business, operating results, cash flow, or financial condition.

Current wording

Our ability to execute successfully on the industry-defined vision of the Autonomous Pharmacy depends on our ability to continue to develop and introduce new products and services or product and service enhancements, and integrate new products and services with existing offerings, in furtherance of this vision in a timely manner and on a cost-effective basis. If we fail to do so, we may be unable to achieve the industry-defined vision of the Autonomous Pharmacy or we may not realize the anticipated benefits of our investments in support of this vision, either of which could have a material adverse effect on our business, operating results, cash flow, or financial condition.

Previous wording

Any reduction in the demand for or adoption of our medication management solutions, medication packaging systems, or related services would reduce our revenues.

Current wording

Failure to generate new sales and any reduction in the demand for or adoption of our medication management solutions, medication packaging systems, or related services would reduce our revenues.

Previous wording

In addition, our medication management solutions and our more complex automated packaging systems typically represent a sizable initial capital expenditure and potential time and labor commitment to implement for healthcare organizations. Changes in the budgets of these organizations and the timing of spending under these budgets, as well as customer labor shortages, can have a significant effect on the demand for our medication management solutions, medication packaging systems, and related services. Customer budgets are often supported by cash flows that can be negatively affected by declining investment income and influenced by limited resources, increased operational and financing costs, macroeconomic conditions, and conflicting spending priorities among different departments. Any decrease in expenditures or change in spending priorities by healthcare facilities or increased financing costs, including as a result of the impacts of public health crises such as the COVID-19 pandemic, could decrease demand for our medication management solutions, medication packaging systems, and related services, and reduce our revenues.

Current wording

In addition, our medication management solutions and our more complex automated packaging systems typically represent a sizable initial capital expenditure and potential time and labor commitment to implement for healthcare organizations. Changes in the budgets of these organizations and the timing of spending under these budgets, as well as customer labor shortages, can have a significant effect on the demand for our medication management solutions, medication packaging systems, and related services. Customer budgets are often supported by cash flows that can be negatively affected by declining investment income and influenced by limited resources, increased operational and financing costs, macroeconomic conditions, and conflicting spending priorities among different departments. Any decrease in expenditures or change in spending priorities by healthcare facilities or increased financing costs, including as a result of the impacts of public health crises, including pandemics, could decrease demand for our medication management solutions, medication packaging systems, and related services, and reduce our revenues.

Previous wording

The purchase of our medication management solutions, including our central pharmacy automation solutions, is often part of a customer’s larger initiative to re-engineer its pharmacy and distribution and materials management systems. The purchase of our systems often entails larger strategic purchases by customers that generally require more complex and stringent contractual requirements, involve a significant commitment of management attention and resources by prospective customers, and require the input and approval of many decision-makers. In addition, new product announcements can cause a delay in our customers’ decisions to purchase our products or convert pending orders for our older products to those of our newer products. For these and other reasons, the sales cycle associated with sales of our systems is often lengthy and subject to a number of delays over which we have little or no control. A delay in, or loss of, sales of these systems (including as a result of the impacts of public health crises such as the COVID-19 pandemic or due to customer labor shortages, increased healthcare worker turnover, or customer budgetary constraints) could have an adverse effect upon our business, operating results and could harm our business, cash flow, or financial condition.

Current wording

The purchase of our medication management solutions, including our central pharmacy automation solutions, is often part of a customer’s larger initiative to re-engineer its pharmacy and distribution and materials management systems. The purchase of our systems often entails larger strategic purchases by customers that generally require more complex and stringent contractual requirements, involve a significant commitment of management attention and resources by prospective customers, and require the input and approval of many decision-makers. In addition, new product announcements can cause a delay in our customers’ decisions to purchase our products or convert pending orders for our older products to those of our newer products. For these and other reasons, the sales cycle associated with sales of our systems is often lengthy, unpredictable, and subject to a number of delays over which we have little or no control. A delay in, or loss of, sales of these systems (including as a result of the impacts of public health crises or due to customer labor shortages, increased healthcare worker turnover, or customer budgetary constraints) could have an adverse effect upon our business, operating results and could harm our business, cash flow, or financial condition.

Previous wording

In addition, and in part as a result of the complexities inherent in larger transactions, the time between the purchase and installation of our systems can generally range up to 24 months. Delays in installation can occur for reasons that are often outside of our control, such as customer labor shortages or increased healthcare worker turnover, as well as customers seeking to stagger or elongate the timeframes between the adoption of new or updated technologies. We have also experienced fluctuations in our customer and transaction size mix, which makes our ability to forecast our bookings more difficult. Because we recognize revenues for our medication management solutions and our more complex medication packaging systems only upon installation at a customer’s site, any delay in installation (including as a result of the impacts of public health crises such as the COVID-19 pandemic or due to customer labor shortages or healthcare worker turnover) will also cause a delay in the recognition of the revenues for those systems.

Current wording

In addition, and in part as a result of the complexities inherent in larger transactions, the time between the purchase and installation of our systems can generally range up to 24 months. Delays in installation can occur for reasons that are often outside of our control, such as customer labor shortages or increased healthcare worker turnover, as well as customers seeking to stagger or elongate the timeframes between the adoption of new or updated technologies. We have also experienced fluctuations in our customer and transaction size mix, which has made our ability to forecast our bookings and may make our ability to forecast our product bookings more difficult. Because we recognize revenues for our medication management solutions and our more complex medication packaging systems only upon installation at a customer’s site, any delay in installation (including as a result of the impacts of public health crises or due to customer labor shortages or healthcare worker turnover) will also cause a delay in the recognition of the revenues for those systems.

Previous wording

The transition to selling more Advanced Services, which include a software as a service or solution as a service subscription, presents a number of risks.

Current wording

The transition to selling more SaaS and Expert Services, which include a software as a service or solution as a service subscription, presents a number of risks.

Previous wording

We currently offer Advanced Services, which often contain a combination of robotics, smart devices, intelligent software, and expert services. These offerings include, but are not limited to, Central Pharmacy Dispensing Service, IV Compounding Service, and Point of Care Service. We also offer our Inventory Optimization Service, certain patient engagement, clinical and financial products and services under EnlivenHealth, Specialty Pharmacy Services, and 340B solutions, as a subscription. As we continue to execute on the industry vision of the Autonomous Pharmacy and grow subscription and cloud-based offerings, we may offer additional products and services on a subscription basis. The transition to selling more products and services on a subscription basis presents a number of risks. The shift requires an investment of technical, financial, compliance, and sales resources, and we cannot guarantee that we will recoup the costs of such investments, or that these investments will improve our long-term growth and operating results. Although we work to anticipate the rate of transition, if adoption of subscription solutions takes place faster than anticipated, the shift to subscription revenues will change the timing of revenue recognition and we may experience a temporary reduction of revenues and revenue growth rate. In addition, our cash flows may be impacted by the timing of invoicing of our subscription solutions. If any of our subscription solutions do not substantially meet customer requirements, contracts may be modified, causing a decline in revenue. Customers may elect not to renew their subscriptions upon expiration, or they may attempt to renegotiate pricing or other contractual terms at or prior to renewal to terms that are less favorable to us. In addition, since revenues are generally recognized over the term of the subscription, any decrease in customer purchases of our subscription-based products and services will not be fully reflected in our operating results until future periods, which may result in inflated revenue growth rates that do not reflect such decreases initially. Similarly, any additional subscription sales would not be fully reflected in our operating results until future periods.

Current wording

We currently offer SaaS and Expert Services, which often contain a combination of robotics and smart devices, intelligent software workflows, and data and analytics, all optimized by expert services. These offerings include, but are not limited to, Central Pharmacy Dispensing Service, IV Compounding Service, and Points of Care Service. We also offer our Inventory Optimization Service, certain patient engagement, clinical and financial products and services under EnlivenHealth, Specialty Pharmacy Services, and 340B solutions, as a subscription. As we continue to execute on the industry-defined vision of the Autonomous Pharmacy and grow subscription and cloud-based offerings, we may offer additional products and services on a subscription basis. The transition to selling more products and services on a subscription basis presents a number of risks. The shift requires an investment of technical, financial, compliance, and sales resources, and we cannot guarantee that we will recoup the costs of such investments, or that these investments will improve our long-term growth and operating results. Although we work to anticipate the rate of transition, if adoption of subscription solutions takes place faster than anticipated, the shift to subscription revenues will change the timing of revenue recognition and we may experience a temporary reduction of revenues and revenue growth rate. In addition, our cash flows may be impacted by the timing of invoicing of our subscription solutions. If any of our subscription solutions do not substantially meet customer requirements, contracts may be modified, causing a decline in revenue. Customers may elect not to renew their subscriptions upon expiration, or they may attempt to renegotiate pricing or other contractual terms at or prior to renewal to terms that are less favorable to us. In addition, since revenues are generally recognized over the term of the subscription, any decrease in customer purchases of our subscription-based products and services will not be fully reflected in our operating results until future periods, which may result in inflated revenue growth rates that do not reflect such decreases initially. Similarly, any additional subscription sales would not be fully reflected in our operating results until future periods.

Previous wording

If errors occur during the provision of certain of our Advanced Services, or if we fail to maintain expected service levels, we may be liable to our customers or third parties which may result in a decline in our Advanced Services offerings revenue.

Current wording

If errors occur during the provision of certain of our SaaS and Expert Services, or if we fail to maintain expected service levels, we may be liable to our customers or third parties which may result in a decline in our SaaS and Expert Services offerings revenue.

Previous wording

Certain of our Advanced Services offerings are highly complex and may be susceptible to errors, including human or technological error. We may be required to bear the cost of correcting any errors and the cost of such corrections may be significant, which could adversely affect our business, operating results, cash flow, or financial condition. In addition, our customers, or third parties such as our customers’ patients, may assert claims that they suffered damages due to our errors. These claims could result in litigation and substantial costs, including legal defense costs. Although we believe our aggregate insurance policy limits are sufficient to cover reasonably expected claims, there can be no assurance that any liability insurance we purchase will be adequate to cover claims asserted against us. We could also be subject to adverse publicity as a result of such claims, regardless of the merits or eventual outcome, which may negatively impact our ability to attract and retain customers. Furthermore, if we cannot maintain the expected level of service or if our customers fail to achieve agreed upon milestone improvements in financial or operating metrics, payments to us from such customers may be lower than anticipated.

Current wording

Certain of our SaaS and Expert Services offerings are highly complex and may be susceptible to errors, including human or technological error. We may be required to bear the cost of correcting any errors and the cost of such corrections may be significant, which could adversely affect our business, operating results, cash flow, or financial condition. In addition, our customers, or third parties such as our customers’ patients, may assert claims that they suffered damages due to our errors. These claims could result in litigation and substantial costs, including legal defense costs. Although we believe our aggregate insurance policy limits are sufficient to cover reasonably expected claims, there can be no assurance that any liability insurance we purchase will be adequate to cover claims asserted against us. We could also be subject to adverse publicity as a result of such claims, regardless of the merits or eventual outcome, which may negatively impact our ability to attract and retain customers. Furthermore, if we cannot maintain the expected level of service or if our customers fail to achieve agreed upon milestone improvements in financial or operating metrics, payments to us from such customers may be delayed, disputed, or lower than anticipated.

Previous wording

We may not be able to retain our Advanced Services customers.

Current wording

We may not be able to retain our SaaS and Expert Services customers.

Previous wording

An increasing percentage of our revenue is derived from our subscription-based Advanced Services offerings. In connection with those offerings, our customers, generally, have no obligation to renew their subscriptions. If our Advanced Services customers decline to renew their subscriptions or decide to terminate their agreements early, we would not derive the expected financial benefits from that customer, which could have a material adverse effect on our business, operating results, cash flow, or financial condition.

Current wording

An increasing percentage of our revenue is derived from our subscription-based SaaS and Expert Services offerings. In connection with those offerings, our customers, generally, have no obligation to renew their subscriptions. If our SaaS and Expert Services customers decline to renew their subscriptions or decide to terminate their agreements early, if permitted, we would not derive the expected financial benefits from that customer, which could have a material adverse effect on our business, operating results, cash flow, or financial condition.

Previous wording

In addition, some of our Advanced Services agreements require us to adhere to additional data, security, network access, and other institutional procedures and requirements of our customers, and in certain cases may obligate us to agreed upon services levels. If we do not meet our obligations under any such Advanced Services agreement, we could be liable for damages. In addition, should a customer undergo a change in control or ownership, it may cause us or the customer to seek to modify or terminate an Advanced Services agreement.

Current wording

In addition, some of our SaaS and Expert Services agreements require us to adhere to additional data, security, network access, and other institutional procedures and requirements of our customers, and in certain cases may obligate us to agreed upon services levels. If we do not meet our obligations under any such SaaS and Expert Services agreement, we could be liable for damages. In addition, should a customer undergo a change in control or ownership, it may cause us or the customer to seek to modify or terminate an SaaS and Expert Services agreement.

Previous wording

If we are unable to meet the demands of, or maintain our relationships with, our institutional and retail pharmacy customers, our revenue from sales of medication packages, other consumables, or our Advanced Services may decline.

Current wording

If we are unable to meet the demands of, or maintain our relationships with, our institutional and retail pharmacy customers, our revenue from sales of medication packages, other consumables, or our SaaS and Expert Services may decline.

Previous wording

Approximately 7% of our revenues during the year ended December 31, 2023 were generated from the sale of consumable medication packages, most of which are produced in our St. Petersburg, Florida facility on a continuous basis and are shipped out to fulfill the demands of our institutional and retail pharmacy customers domestically and abroad. The demands placed on institutional and retail pharmacies by their customers represent real time requirements of those customers. Our customer agreements for the sale of consumable medication packages are typically short-term in nature and typically do not impose volume commitments on the customer. If we are unable to supply quality packaging to our customers in a timely manner, they may use alternative methods of distributing medications to their customers, including consumable medication packaging sold by our competitors, and our revenues will decline. Any disruption in the production capabilities of our St. Petersburg facilities, including as a result of extreme weather conditions or natural disasters, which may become more frequent as a result of climate change, will adversely affect our ability to ship our consumable medication packages globally and would reduce our revenues.

Current wording

Approximately 8% of our revenues during the year ended December 31, 2024 were generated from the sale of consumable medication packages, most of which are produced in our St. Petersburg, Florida facility on a continuous basis and are shipped out to fulfill the demands of our institutional and retail pharmacy customers domestically and abroad. The demands placed on institutional and retail pharmacies by their customers represent real time requirements of those customers. Our customer agreements for the sale of consumable medication packages are typically short-term in nature and typically do not impose volume commitments on the customer. If we are unable to supply quality packaging to our customers in a timely manner, they may use alternative methods of distributing medications to their customers, including consumable medication packaging sold by our competitors, and our revenues will decline. Any disruption in the production capabilities of our St. Petersburg facilities, including as a result of extreme weather conditions or natural disasters, which may become more frequent as a result of climate change, will adversely affect our ability to ship our consumable medication packages globally and would reduce our revenues.

Previous wording

Similarly, our EnlivenHealth brand offers a portfolio of web-based, mobile, and telephonic patient engagement, medication management, financial management, clinical, analytics, and population health solutions to pharmacies, which is designed to support improvement in health outcomes related to medication use. The success of these offerings depends on the trust our customers place in us and our reputation and ability to provide high-quality service. If we are unable to maintain the satisfaction or meet the expectations of our customers, our reputation with current and potential customers could be harmed, which could have a material adverse effect on our business, operating results, cash flow, or financial condition. In addition, if we fail to maintain our relationships with existing customers or are unable to create new relationships with other pharmacies, this could have an adverse effect on our business, operating results, cash flow, or financial condition.

Current wording

Similarly, our EnlivenHealth brand extends beyond the inpatient setting and into ambulatory care. This brand offers a portfolio of products designed to digitally enable retail and community pharmacies with connected patient engagement and clinical and financial workflows. The success of these offerings depends on the trust our customers place in us and our reputation and ability to provide high-quality service. If we are unable to maintain the satisfaction or meet the expectations of our customers, our reputation with current and potential customers could be harmed, which could have a material adverse effect on our business, operating results, cash flow, or financial condition. In addition, if we fail to maintain our relationships with existing customers or are unable to create new relationships with other pharmacies, this could have an adverse effect on our business, operating results, cash flow, or financial condition.

Previous wording

•current or future competitors may offer or have the ability to offer a broader range of solutions than us, develop alternative solutions that provide a better customer outcome or lower cost of operation, develop new features or capabilities for their products, including artificial intelligence (“AI”), machine learning, and generative AI capabilities, which are part of an intensely competitive and rapidly evolving market, that could compete with our solutions, respond more quickly and efficiently to new or changing technologies, standards, or regulations, or devote greater resources to the development, promotion, and sale of their products than we do;

Current wording

•current or future competitors may offer or have the ability to offer a broader range of solutions than us, develop alternative solutions that provide a better customer outcome or lower cost of operation, develop new features or capabilities for their products, including AI, machine-learning, and generative AI capabilities, which are part of an intensely competitive and rapidly evolving market, that could compete with our solutions, respond more quickly and efficiently to new or changing technologies, standards, or regulations, or devote greater resources to the development, promotion, and sale of their products than we do;

Previous wording

Our ability to make payments of the principal, to pay interest, or to refinance our indebtedness, including the Notes, depends on our future performance, which is subject to economic, financial, competitive, and other factors beyond our control. Our business may not continue to, and we cannot provide assurance that our business will, generate cash flow from operations in the future sufficient to fund our cash requirements, service our debt or make necessary capital expenditures. Our failure to generate sufficient cash flow to pay our debts could have a material adverse effect on our business. In addition, if we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as borrowing more money, selling assets, restructuring debt, or obtaining additional equity capital on terms that may be onerous or highly dilutive. Any of these actions still may not be sufficient to allow us to service our debt obligations, could increase the risks related to our business or our ability to service or repay our indebtedness or may otherwise have an adverse effect on our business.

Current wording

Our ability to make payments of the principal, to pay interest, or to refinance our indebtedness, including the 2025 Notes and the 2029 Notes, depends on our future performance, which is subject to economic, financial, competitive, and other factors beyond our control. Our business may not continue to, and we cannot provide assurance that our business will, generate cash flow from operations in the future sufficient to fund our cash requirements, service our debt or make necessary capital expenditures. Our failure to generate sufficient cash flow to pay our debts could have a material adverse effect on our business. In addition, if we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as borrowing more money, selling assets, restructuring debt, or obtaining additional equity capital on terms that may be onerous or highly dilutive. Any of these actions still may not be sufficient to allow us to service our debt obligations, could increase the risks related to our business or our ability to service or repay our indebtedness or may otherwise have an adverse effect on our business.

Previous wording

Our ability to refinance our indebtedness will depend on the capital markets and our financial condition at the time of any such refinancing. We may not be able to engage in any of these activities or to do so on desirable terms, which could result in a default on our debt obligations. In addition, as more fully described below in the risk factor captioned “Covenants in our Second A&R Credit Agreement restrict our business and operations in many ways, and if we do not effectively manage our compliance with these covenants, our business, operating results, cash flow, or financial condition could be adversely affected,” our second amended and restated agreement with certain lenders, and Wells Fargo Bank, National Association, as administrative agent (the “Second A&R Credit Agreement”) includes customary restrictive covenants that impose operating and financial restrictions on us.

Current wording

Our ability to refinance our indebtedness will depend on the capital markets and our financial condition at the time of any such refinancing. We may not be able to engage in any of these activities or to do so on desirable terms, which could result in a default on our debt obligations. In addition, as more fully described below in the risk factor captioned “Covenants in our Second A&R Credit Agreement restrict our business and operations in many ways, and if we do not effectively manage our compliance with these covenants, our financial conditions and operating results could be adversely affected,” our second amended and restated agreement, as amended, with certain lenders, and Wells Fargo Bank, National Association, as administrative agent (the “Second A&R Credit Agreement”) includes customary restrictive covenants that impose operating and financial restrictions on us.

Previous wording

We receive, store, and process personal information and other data from and about customers, in addition to our employees and services providers. In addition, our customers use our solutions to obtain and store personal information, including health information. For example, our customers use our EnlivenHealth platform to guide and track patient notes, interventions, and appointments, which involves the collection of personal health information of patients. Our handling of data is subject to a variety of laws and regulations by federal, state, local, and foreign agencies, as well as contractual obligations and industry standards. Regulatory focus on data privacy and security concerns continues to increase globally, and laws and regulations concerning the collection, use, and disclosure of personal information are expanding and becoming more complex.

Current wording

We receive, store, and process personal information and other data from and about customers, in addition to our employees and services providers. In addition, our customers use our solutions to obtain and store personal information, including health information. For example, our customers use our EnlivenHealth platform to guide and track patient notes, interventions, and appointments, which involves the collection of personal health information of patients. Our handling of data is subject to a variety of laws and regulations by federal, state, local, and foreign agencies, as well as contractual obligations and industry standards. Regulatory focus on data privacy and security concerns continues to increase globally, and laws and regulations concerning the collection, use, and disclosure of personal information are expanding and becoming more complex. In the United States, these include federal health information privacy laws (such as the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), discussed below), security breach notification laws, and consumer protection laws, as well as state laws addressing privacy and data security (such as the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020 (collectively, the “CPRA”).

Previous wording

While HIPAA does not create a private right of action, its standards have been used as the basis for civil suits and HIPAA is enforced by the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”), which can bring actions against entities for noncompliance, including for failures to implement security measures sufficient to reduce risks to electronic protected health information or to conduct an accurate and thorough risk analysis, among other violations. HIPAA enforcement actions may lead to monetary penalties and costly and burdensome corrective action plans. We are also required to report known breaches of protected health information consistent with applicable breach reporting requirements set forth in applicable laws and regulations. Additionally, on December 10, 2020, OCR issued proposed revisions to the Privacy Rule aimed at reducing regulatory burdens that may exist in discouraging coordination of care and patient access to their health information, among other changes. While a final rule has not yet been issued, if adopted, these proposed changes may require us to update our HIPAA policies and procedures to comply with the new requirements. Additionally, pursuant to legislation passed in 2021, OCR recently issued guidance on recognized security practices for covered entities and business associates. OCR indicated that recognized security practices will not be an aggravating factor in OCR investigations, but that implementation of recognized security practices strengthen an organization’s cybersecurity and regulatory posture, as well as possibly lessening enforcement penalties in a potential regulatory enforcement action. Moreover, compliance with state laws related to health privacy may result in additional compliance costs.

Current wording

While HIPAA does not create a private right of action, its standards have been used as the basis for civil suits and HIPAA is enforced by the U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights (“OCR”), which can bring actions against entities for noncompliance, including for failures to implement security measures sufficient to reduce risks to electronic protected health information or to conduct an accurate and thorough risk analysis, among other violations. HIPAA enforcement actions may lead to monetary penalties and costly and burdensome corrective action plans. We are also required to report known breaches of protected health information consistent with applicable breach reporting requirements set forth in applicable laws and regulations. Additionally, on January 6, 2025, HHS OCR issued a Notice of Proposed Rulemaking (“NPRM”) aiming to strengthen cybersecurity protections and better defend against cyber threats targeting the U.S. health care system by bolstering the security safeguards required under the HIPAA Security Rule. While a final rule has not yet been issued (as the NPRM is open for public comment until March 7, 2025), if adopted, these proposed changes would potentially require significant operational adjustments and potential cost increases to comply, and are expected to become final in approximately 180 days from publication of any final rule. Moreover, compliance with state laws related to health privacy may result in additional compliance costs.

Previous wording

We may encounter vendors that engage in information blocking practices that may inhibit our ability to access the relevant data on behalf of patients or impose new or additional costs. Specifically, the information blocking rules were implemented as part of the 21st Century Cures Act, and are primarily designed to facilitate technology interoperability and enable the free flow of healthcare information for healthcare treatment, payment or operation purposes. HHS-OIG may impose penalties for information blocking that has occurred after September 1, 2023, and ONC and HHS proposed a rule on November 1, 2023 listing certain disincentives for actors that conduct information blocking. The impact on the information blocking rules to our business is currently unclear.

Current wording

We may encounter vendors that engage in information blocking practices that may inhibit our ability to access the relevant data on behalf of patients or impose new or additional costs. Specifically, the information blocking rules were implemented as part of the 21st Century Cures Act, and are primarily designed to facilitate technology interoperability and enable the free flow of healthcare information for healthcare treatment, payment or operation purposes.

Previous wording

The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches which is expected to increase data breach litigation. Additionally, the CPRA, came into effect in January 2023, and imposes additional data protection obligations on companies doing business in California, created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. Additional compliance investment and potential business process changes may be required. Laws similar to those in California have passed in states such as Virginia and Colorado, and have been proposed in other states and at the federal level that may ultimately have conflicting requirements that would further complicate compliance. Furthermore, new health information standards, whether implemented pursuant to HIPAA, Health Information Technology for Economic and Clinical Health (“HITECH”) Act, congressional action or otherwise could have a significant effect on the manner in which we handle health-related information, and the cost of complying with these standards could be significant. If we do not comply with existing or new laws and regulations related to patient health information, we could be subject to criminal or civil sanctions.

Current wording

The CPRA provides for civil penalties for violations, as well as a private right of action for data breaches which is expected to increase data breach litigation. Additionally, the CPRA, which came into effect in January 2023, imposed additional data protection obligations on companies doing business in California, created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. In addition to California, at least twenty (20) other states in the U.S. have passed comprehensive consumer privacy laws similar to the CPRA including, but not limited to, Virginia, Colorado, Connecticut, Oregon, Texas, and Utah (among many others). These laws are either in effect or will go into effect sometime before the end of 2026, and we expect other states to consider adopting similar laws in the future. Some of these new or existing laws may apply to our business activities, so additional compliance investment and potential business process changes may be required. Similar consumer privacy and data protection legislation has been introduced at the federal level that may ultimately have conflicting requirements and, if enacted, would further complicate compliance.

Previous wording

Additionally, the Federal Trade Commission (“FTC”) and many state attorneys general are interpreting existing federal and state consumer protection laws to impose evolving standards for the collection, use, dissemination and security of health-related and other personal information. Courts may also adopt the standards for fair information practices promulgated by the FTC, which concern consumer notice, choice, security and access. Consumer protection laws require us to publish statements that describe how we handle personal information and the choices individuals may have about the way we handle their personal information. If such information that we publish is considered untrue, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Furthermore, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in, or affecting, commerce in violation of Section 5 of the FTC Act. Additionally, the FTC recently published an advance notice of proposed rulemaking on commercial surveillance and data security, and is seeking comment on whether it should implement new trade regulation rules or other regulatory alternatives concerning the ways in which companies (1) collect, aggregate, protect, use, analyze, and retain consumer data, as well as (2) transfer, share, sell, or otherwise monetize that data in ways that are unfair or deceptive.

Current wording

Additionally, the Federal Trade Commission (“FTC”) and many state attorneys general are interpreting existing federal and state consumer protection laws to impose evolving standards for the collection, use, dissemination and security of health-related and other personal information. Courts may also adopt the standards for fair information practices promulgated by the FTC, which concern consumer notice, choice, security and access. Consumer protection laws require us to publish statements that describe how we handle personal information and the choices individuals may have about the way we handle their personal information. If such information that we publish is considered untrue, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Furthermore, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in, or affecting, commerce in violation of Section 5 of the FTC Act.

Previous wording

Additionally, data and digital services regulation continues to expand, particularly with respect to the artificial intelligence (“AI”) and automated decision making, which may further impact our business and regulatory compliance strategies. For example, AI regulation or regulatory guidance continues to emerge in response to President Biden’s Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence issued on October 30, 2023.

Current wording

Additionally, data and digital services regulation continues to expand, particularly with respect to AI and automated decision making, which may further impact our business and regulatory compliance strategies.

Previous wording

Internationally, various jurisdictions outside of the United States in which we operate have established, or are currently developing, their own data privacy and security legal frameworks with which we or our customers must comply. In certain cases, these international laws and regulations are more restrictive than many regulations in the United States. For example, within the European Union (“EU”), the General Data Protection Regulation 2016/679 (“EU GDPR”) went into effect on May 25, 2018, and introduced strict requirements for the processing of personal information of individuals. The EU GDPR governs the collection, use, disclosure, transfer, and other processing of personal information (i.e., data which identifies an individual or from which an individual is identifiable). The UK has implemented the EU GDPR as the UK GDPR which sits alongside the UK Data Protection Act 2018 (the UK GDPR, together with the EU GDPR, the “GDPR”). The GDPR has direct effect where an entity is established in the European Economic Area (“EEA”) or the UK (as applicable) and has extraterritorial effect, including where an organization outside of the EEA or the UK processes personal information in relation to the offering of goods or services to those individuals or the monitoring of their behavior.

Current wording

Internationally, various jurisdictions outside of the United States in which we operate have established, or are currently developing, their own data privacy and security legal frameworks with which we or our customers must comply. In certain cases, these international laws and regulations are more restrictive than many regulations in the United States. For example, within the European Union (“EU”), the General Data Protection Regulation 2016/679 (“EU GDPR”) went into effect on May 25, 2018, and introduced strict requirements for the processing of personal information of individuals. The EU GDPR governs the collection, use, disclosure, transfer, and other processing of personal information (i.e., data which identifies an individual or from which an individual is identifiable). The UK has implemented the EU GDPR as the UK GDPR which sits alongside the UK Data Protection Act 2018 (the UK GDPR, together with the EU GDPR, the “GDPR”). The GDPR has direct effect where an entity is established in the European Economic Area (“EEA”) or the UK (as applicable) and has extraterritorial effect, including where an organization outside of the EEA or the UK processes personal information in relation to the offering of goods or services to those individuals or the monitoring of their behavior while those individuals are in the EEA or UK.

Previous wording

In addition, the EU GDPR prohibits the international transfer of personal information from the EEA to the United States and other jurisdictions that the European Commission does not recognize as having “adequate” data protection laws unless a data transfer mechanism has been put in place or a derogation under the EU GDPR can be relied upon. In July 2020, the Court of Justice of the EU (“CJEU”) in its Schrems II judgement limited how organizations could lawfully transfer personal data from the EEA to the US by invalidating the EU-US Privacy Shield for purposes of international transfers and imposing further restrictions on the use of standard contractual clauses (“EU SCCs”), including a requirement for companies to carry out a transfer privacy impact assessment (“TIAs”). A TIA, among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under EU SCCs will need to be implemented to ensure an “essentially equivalent” level of data protection to that afforded in the EEA.

Current wording

In addition, the EU GDPR prohibits the international transfer of personal information from the EEA to the United States and other jurisdictions that the European Commission does not recognize as having “adequate” data protection laws unless a data transfer mechanism has been put in place or a derogation under the EU GDPR can be relied upon. In July 2020, the Court of Justice of the EU (“CJEU”) in its Schrems II judgement limited how organizations could lawfully transfer personal data from the EEA to the US by invalidating the EU-US Privacy Shield for purposes of international transfers and imposing further restrictions on the use of standard contractual clauses (“EU SCCs”), which Omnicell utilizes such standard contractual clauses for cross-border transfers of personal data from the EEA and UK to the U.S. The Schrems II judgement also includes a requirement for companies to carry out a transfer privacy impact assessment (“TIAs”). A TIA, among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under EU SCCs will need to be implemented to ensure an “essentially equivalent” level of data protection to that afforded in the EEA.

Previous wording

On October 7, 2022, US President Biden introduced an Executive Order to facilitate a new Trans-Atlantic Data Privacy Framework (“DPF”) and on 10 July 2023, the European Commission adopted its Final Implementing Decision granting the U.S. adequacy (“Adequacy Decision”) for EU-US transfers of personal data for entities self-certified to the DPF. Entities relying on EU SCCs for transfers to the U.S. are also able to rely on the analysis in the Adequacy Decision as support for their TIA regarding the equivalence of U.S. national security safeguards and redress. This may have implications for our cross-border data flows and has and may in the future result in increased compliance costs.

Current wording

Following the CJEU’s decision, in October 2022, former U.S. President Biden signed an executive order to implement the EU-U.S. Data Privacy Framework (“DPF,” together with the EU-U.S., “EU-U.S. DPF”), which would serve as a replacement to the EU-US Privacy Shield. The EU initiated the process to adopt an adequacy decision for the EU-U.S. DPF in December 2022, and the European Commission adopted the adequacy decision in July 2023. The adequacy decision permits U.S. companies who self-certify to the EU-U.S. DPF to rely on it as a valid data transfer mechanism for data transfers from the EEA to the U.S. Entities relying on EU SCCs for transfers to the U.S. are also able to rely on the analysis in the Adequacy Decision as support for their TIA regarding the equivalence of U.S. national security safeguards and redress. This may have implications for our cross-border data flows and has and may in the future result in increased compliance costs. In addition, some privacy advocacy groups have already suggested that they will be challenging the EU-U.S. DPF.

Previous wording

The UK GDPR also imposes similar restrictions on transfers of personal data from the UK to jurisdictions that the UK Government does not consider adequate, including the United States. The UK Government has published its own form of the EU SCCs, known as the International Data Transfer Agreement and an International Data Transfer Addendum to the new EU SCCs. The UK Information Commissioner’s Office has also published its version of the TIA and guidance on international transfers, although entities may choose to adopt either the EU or UK style TIA. Further, on September 21, 2023, the UK Secretary of State for Science, Innovation and Technology established a UK-U.S. data bridge (i.e., a UK adequacy decision) and adopted UK regulations to implement the UK-U.S. data bridge (“UK Adequacy Regulations”). The UK Adequacy Regulations have now been passed in the UK Parliament, and personal data may be transferred from the UK under the UK-U.S. data bridge through the UK extension to the DPF, from October 12, 2023, to organizations self-certified under the DPF.

Current wording

The UK GDPR also imposes similar restrictions on transfers of personal data from the UK to jurisdictions that the UK Government does not consider adequate, including the United States. The UK Government has published its own form of the EU SCCs, known as the International Data Transfer Agreement and an International Data Transfer Addendum to the new EU SCCs. The UK Information Commissioner’s Office has also published its version of the TIA and guidance on international transfers, although entities may choose to adopt either the EU or UK style TIA.

Previous wording

In the EU a number of new laws related to digital data and AI have recently entered into force, or are expected to enter into force in the foreseeable future. We are still assessing the scope of application, impact, and risk of these recent EU laws on our business, and will continue to assess this moving forward, including for example: (i) the EU’s Data Act, which was adopted on November 27, 2023 and seeks to, among other things regulate the use of, and access to, data generated through connected (or Internet-of-Things) devices and introduces a new means for public sector bodies to access, use and re-use private sector data; and (ii) the proposed European Health Data Space Regulation which is expected to be agreed in Q3 2024 and seeks to, among other things, provide individuals with more control over their electronic health data (“EHD”), enable cross-border sharing of EHD between national EU healthcare systems and facilitate the sharing of EHD for secondary research purposes. In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that may legally or contractually apply to us, and other regulatory protections may lose their applicability to our business as regulations and legal proceedings continue to evolve globally. We also expect that there will continue to be new proposed laws, regulations, and industry standards relating to privacy, data protection, and information security, including in the UK (see above), where we have business operations. We cannot predict the scope of any such future laws, regulations, and standards that may be applicable to us, or how courts, agencies, or data protection authorities might interpret current ones. It is possible that these laws and other obligations may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the functionality of our solutions.

Current wording

In the EU a number of new laws related to digital data and AI have recently entered into force, or are expected to enter into force in the foreseeable future. We are still assessing the scope of application, impact, and risk of these recent EU laws on our business, and will continue to assess this moving forward, including for example the European Health Data Space Regulation which was adopted by the European Parliament in the second quarter of 2024 and seeks to, among other things, provide individuals with more control over their electronic health data (“EHD”), enable cross-border sharing of EHD between national EU healthcare systems and facilitate the sharing of EHD for secondary research purposes. In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that may legally or contractually apply to us, and other regulatory protections may lose their applicability to our business as regulations and legal proceedings continue to evolve globally. We also expect that there will continue to be new proposed laws, regulations, and industry standards relating to privacy, data protection, and information security, including in the UK (see above), where we have business operations. We cannot predict the scope of any such future laws, regulations, and standards that may be applicable to us, or how courts, agencies, or data protection authorities might interpret current ones. It is possible that these laws and other obligations may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the functionality of our solutions.

Previous wording

We rely on information technology (“IT”) systems to keep financial records and corporate records, communicate with staff and external parties, and operate other critical functions, including sales and manufacturing processes. As our business needs change, we may need to expand or update our IT systems. We also utilize third-party cloud services in connection with our operations, which also may need to be expanded or updated as our business needs change. Our IT systems and third-party cloud services are potentially vulnerable to disruption due to breakdown, malicious intrusion and computer viruses, public health crises such as the COVID-19 pandemic, other catastrophic events or environmental impact, as well as due to system upgrades and/or new system implementations. Our systems may also experience vulnerabilities from third-party or open source software code that may be incorporated into our own or our vendors’ systems. Any prolonged system disruption in our IT systems or third-party services could negatively impact the coordination of our sales, planning, and manufacturing activities, which could harm our business. In addition, in order to maximize our information technology efficiency, we have physically consolidated our primary corporate data and computer operations. This concentration, however, exposes us to a greater risk of disruption to our internal IT systems. Although we maintain offsite back-ups of our data, a disruption of operations at our facilities could materially disrupt our business if we are not capable of restoring function within an acceptable time frame.

Current wording

We rely on information technology (“IT”) systems to keep financial records and corporate records, communicate with staff and external parties, and operate other critical functions, including sales and manufacturing processes. As our business needs change, we may need to expand or update our IT systems. We also utilize third-party cloud services in connection with our operations, which also may need to be expanded or updated as our business needs change. Our IT systems and third-party cloud services are potentially vulnerable to disruption due to breakdown, malicious intrusion and computer viruses, public health crises, other catastrophic events or environmental impact, as well as due to system upgrades and/or new system implementations. Our systems may also experience vulnerabilities from third-party or open source software code that may be incorporated into our own or our vendors’ systems. Any prolonged system disruption in our IT systems or third-party services could negatively impact the coordination of our sales, planning, and manufacturing activities, which could harm our business. In addition, in order to maximize our information technology efficiency, we have physically consolidated our primary corporate data and computer operations. This concentration, however, exposes us to a greater risk of disruption to our internal IT systems. Although we maintain offsite back-ups of our data, a disruption of operations at our facilities could materially disrupt our business if we are not capable of restoring function within an acceptable time frame.

Previous wording

Our IT systems and third-party cloud services are potentially vulnerable to cyber-attacks, including ransomware, or other data security incidents, by employees or others, which may expose sensitive data to unauthorized persons. In addition, we have a large number of employees working remotely, which number may continue to grow, and such arrangements may involve increased use of office equipment off premises, which may make our systems more susceptible to security breaches or breach attempts. As previously disclosed, on May 4, 2022, we determined that certain of our information technology systems were affected by ransomware impacting certain internal systems. Upon detecting the security event, we took immediate steps designed to contain the incident and implement its business continuity plans to restore and support continued operations. We contained the incident and restored substantially all of its critical information technology systems. We do not believe the security event will have a material adverse effect on its business, operating results, cash flow or financial condition.

Current wording

Our IT systems and third-party cloud services are potentially vulnerable to cyber-attacks, including ransomware, or other data security incidents, by employees or others, which may expose sensitive data to unauthorized persons. In addition, we have a large number of employees working remotely, which number may continue to grow, and such arrangements may involve increased use of office equipment off premises, which may make our systems more susceptible to security breaches or breach attempts. As previously disclosed, on May 4, 2022, we determined that certain of our information technology systems were affected by ransomware impacting certain internal systems. We do not believe the security event has had, or will have, a material adverse effect on its business, operating results, cash flow, or financial condition.

Previous wording

We may also be subject to various cybersecurity laws in the EU and the UK, including the UK Network and Information Systems Regulation 2018 (“NIS Regulations”), and the EU Network and Information Systems Security 1 Directive (“NISD1”) as implemented into EU Member State law (and as updated by the EU Network and Information Systems Security 2 Directive (“NISD2”)) which apply to certain operators of “essential services” and digital service providers, such as cloud providers, and medical device manufacturers. In addition, the EU Critical Entities Resilience Directive entered into force on January 17, 2023 which applies to, among other things, “essential services” including manufacturers of medical devices, imposes stringent cybersecurity and resilience requirements in particular in relation to incidents significantly impacting the continuation of the critical infrastructure service offering in the EU.

Current wording

We may also be subject to various cybersecurity laws in the EU and the UK, including the UK Network and Information Systems Regulation 2018 (“NIS Regulations”), and the EU Network and Information Systems Security 1 Directive (“NISD1”) as implemented into EU Member State law (and as updated by the EU Network and Information Systems Security 2 Directive (“NISD2”)) which apply to certain operators of “essential services” and digital service providers, such as cloud providers, and medical device manufacturers.

Previous wording

We sell certain solutions that receive, store, and process our customers’ data. For example, our Inventory Optimization Service solution combines a cloud-based predictive intelligence platform with expert services designed to monitor pharmacy operations and recommend opportunities to help improve efficiency, regulatory compliance, and patient outcomes. As another example, our EnlivenHealth patient engagement platform is a private cloud-based solution that supports improving patient adherence goals through a single web-based platform that hosts functionality to guide and track patient notes, interventions, and appointments. These solutions require that we maintain an information technology infrastructure that is robust and reliable within competitive and regulatory constraints that continue to evolve. Operational malfunctions, including loss of customer data or power or telecommunications infrastructure outages, or an effective attack on our solutions could disrupt the proper functioning of our solutions, allow unauthorized access to sensitive and confidential information of our customers (including protected health information), and disrupt our customers’ operations, which could result in reduced quality of services and contract liability or claims by customers and other third parties. In addition to the risks and impacts noted above, any of these events could damage our reputation or cause our solutions to be perceived as having security vulnerabilities and reduce demand, which could have a material adverse effect on our business, operating results, cash flow, or financial condition. These risks are likely to increase as we continue to grow our cloud-based offerings, including in support of the industry vision of the Autonomous Pharmacy, and as we receive, store, and process more of our customers’ data.

Current wording

We sell certain solutions that receive, store, and process our customers’ data. For example, our Inventory Optimization Service solution combines a cloud-based predictive intelligence platform with expert services designed to monitor pharmacy operations and recommend opportunities to help improve efficiency, regulatory compliance, and patient outcomes. As another example, our EnlivenHealth patient engagement platform is a private cloud-based solution that supports improving patient adherence goals through a single web-based platform that hosts functionality to guide and track patient notes, interventions, and appointments. These solutions require that we maintain an information technology infrastructure that is robust and reliable within competitive and regulatory constraints that continue to evolve. Operational malfunctions, including loss of customer data or power or telecommunications infrastructure outages, or an effective attack on our solutions could disrupt the proper functioning of our solutions, allow unauthorized access to sensitive and confidential information of our customers (including protected health information), and disrupt our customers’ operations, which could result in reduced quality of services and contract liability or claims by customers and other third parties. In addition to the risks and impacts noted above, any of these events could damage our reputation or cause our solutions to be perceived as having security vulnerabilities and reduce demand, which could have a material adverse effect on our business, operating results, cash flow, or financial condition. These risks are likely to increase as we continue to grow our cloud-based offerings, including in support of the industry-defined vision of the Autonomous Pharmacy, and as we receive, store, and process more of our customers’ data.

Previous wording

While we have implemented a number of security measures designed to protect our systems and data, including firewalls, antivirus and malware detection tools, patches, log monitors, routine back-ups, system audits, routine password modifications, and disaster recovery procedures, and have designed certain security features into our solutions, we and our third party service providers regularly defend against and respond to data security incidents and such measures may not be adequate or implemented properly to prevent or fully address the adverse effect of such events. In some cases, we may be unaware of an incident or its magnitude and effects as breaches and other inappropriate access can be difficult to detect, and any delay in identifying them may lead to increased harm. In addition, while we possess insurance that currently includes coverage for cyber-attacks, we have seen a trend where the amount of coverage being offered by insurance providers for such cyber-attacks is decreasing while the cost of obtaining such coverage is increasing. If this trend continues, the insurance coverage we possess may not be adequate or the cost to obtain such coverage may become prohibitive.

Current wording

While we have implemented a number of security measures designed to protect our systems and data, including firewalls, antivirus and malware detection tools, patches, log monitors, routine back-ups, system audits, routine password modifications, employee training, and disaster recovery procedures, and have designed certain security features into our solutions, we and our third party service providers regularly defend against and respond to data security incidents and such measures may not be adequate or implemented properly to prevent or fully address the adverse effect of such events. In some cases, we may be unaware of an incident or its magnitude and effects as breaches and other inappropriate access can be difficult to detect, and any delay in identifying them may lead to increased harm. In addition, while we possess insurance that currently includes coverage for cyber-attacks, we have seen a trend where the amount of coverage being offered by insurance providers for such cyber-attacks is decreasing while the cost of obtaining such coverage is increasing. If this trend continues, the insurance coverage we possess may not be adequate or the cost to obtain such coverage may become prohibitive.