LifeStance Health Group Inc

Previous wording

Private third-party payors pay for the services that we provide to many of our patients. During the year ended December 31, 2023, 95% of our patients were insured as of their latest visit. If any commercial third-party payors reduce their reimbursement rates or elect not to cover some or all of our services, our business, results of operations and financial condition may be harmed. Third-party payors may also elect to create narrow networks, which may exclude our clinicians, or otherwise terminate their agreement with us. A majority of our payor relationships operate across multiple independent regional contracts. Changes in reimbursement rates from these or other large commercial payors could adversely impact our business and results of operations.

Current wording

Private third-party payors pay for the services that we provide to many of our patients. During the year ended December 31, 2024, 96% of our patients were insured as of their latest visit. If any commercial third-party payors reduce their reimbursement rates or elect not to cover some or all of our services, our business, results of operations and financial condition may be harmed. Third-party payors may also elect to create narrow networks, which may exclude our clinicians, or otherwise terminate their agreement with us. A majority of our payor relationships operate across multiple independent regional contracts. Changes in reimbursement rates from these or other large commercial payors could adversely impact our business and results of operations.

Previous wording

Two payors individually exceeded 10% of our total revenue for the year ended December 31, 2023: UnitedHealthcare and Elevance Health, Inc., comprising 19% and 13% of our total revenue, respectively. Therefore, changes in the reimbursement rates, coverage offered by these payors or loss of in-network status may adversely impact our business and results of operations more than changes implemented by other payors.

Current wording

Two payors individually exceeded 10% of our total revenue for the year ended December 31, 2024: UnitedHealthcare and Elevance Health, Inc., comprising 17% and 15% of our total revenue, respectively. Therefore, changes in the reimbursement rates, coverage offered by these payors or loss of in-network status may adversely impact our business and results of operations more than changes implemented by other payors.

Previous wording

We plan to be selective with our payor strategy. If we choose to expand our relationships with large payors relative to more numerous smaller payors, these large payors may determine the reimbursement rates and coverage for more of our patients. In addition, we may be unable to enter new payor contracts on favorable terms, or at all. In some cases, our revenue decreases if our volume or reimbursement decreases, but our expenses, including clinician compensation, may not decrease proportionately.

Current wording

We are selective with our payor strategy and have dedicated resources for payor engagement. As we expand our relationships with large payors relative to more numerous smaller payors, these large payors may determine the reimbursement rates and coverage for more of our patients. In addition, we may be unable to enter new payor contracts on favorable terms, or at all. In some cases, our revenue decreases if our volume or reimbursement decreases, but our expenses, including clinician compensation, may not decrease proportionately. Further, as we negotiate and renew payor contracts, we may not be able to secure favorable rates, and may never be able to achieve rate parity with physical healthcare reimbursement. Reimbursement rates determined by our contracts with larger payors have and may continue to have significant impacts on our total revenue per visit and cash flows.

Previous wording

We have experienced significant growth since our inception in 2017. We continually execute a number of growth initiatives, strategies and operating plans designed to enhance our business. For example, our strategy includes recruiting new clinicians, growing our business by opening de novo centers, building our relationships with payors and developing strategic relationships with other primary care and specialist physicians to offer an integrated care model and acquiring strategic high-quality existing centers. The anticipated benefits from these efforts are based on several assumptions that may prove to be inaccurate. Moreover, we may not be able to successfully complete these growth initiatives, strategies and operating plans and realize all of the benefits, including growth targets, that we expect to achieve, or it may be more costly to do so than we anticipate. We may also pivot or delay our growth strategies, which may result in slower rates of net clinician growth or revenue growth compared to prior periods of significant growth.

Current wording

We have experienced significant growth since our inception in 2017. We continually execute a number of growth initiatives, strategies and operating plans designed to enhance our business. For example, our strategy includes recruiting new clinicians, growing our business by opening select de novo centers, building our relationships with payors and developing strategic relationships with other primary care and specialist physicians to offer an integrated care model and acquiring strategic high-quality existing centers. The anticipated benefits from these efforts are based on several assumptions that may prove to be inaccurate. Moreover, we may not be able to successfully complete these growth initiatives, strategies and operating plans and realize all of the benefits, including growth targets, that we expect to achieve, or it may be more costly to do so than we anticipate. For example, we may have increased expenses related to clinician education and licensing, as well as supervising, if we are a first employer for newly recruited clinicians. We may also pivot or delay our growth strategies, which may result in slower rates of net clinician growth or revenue growth compared to prior periods of significant growth.

Previous wording

Our significant growth in recent periods has and may continue to put strain on our business, operations and employees. We have also significantly increased the number of patient visits conducted over this period. To manage our current and anticipated future growth effectively, we must continue to maintain and enhance our financial and accounting systems and our IT infrastructure. For example, as we implement our growth strategy, we have made strategic investments in enterprise-level scalable infrastructure, including IT and technology support to continue to facilitate virtual services to patients. If our enterprise-level infrastructure is not aligned with the needs of our clinicians and staff, then we will not be able to realize the full capacity of our services and will not recognize a return on our investment in such infrastructure updates.

Current wording

Our significant growth in prior periods has and may continue to put strain on our business, operations and employees. We have also significantly increased the number of patient visits conducted over this period. To manage our current and anticipated future growth effectively, we must continue to maintain and enhance our financial and accounting systems and our IT infrastructure. For example, as we implement our growth strategy, we have made strategic investments in enterprise-level scalable infrastructure, including IT and technology support to continue to facilitate virtual services to patients. If our enterprise-level infrastructure is not aligned with the needs of our clinicians and staff, then we will not be able to realize the full capacity of our services and will not recognize a return on our investment in such infrastructure updates.

Previous wording

In addition, hiring new clinicians involves challenges, including the ability to manage decreased profitability and increased expenses incurred during each clinician’s development and ramp-up period. Rising expenses including wage inflation could adversely affect our ability to attract and retain high-quality clinicians. The substantial management time and resources that our new clinicians require may result in disruption to our existing business operations, which may harm our profitability. Our inability to successfully address these challenges and other factors may adversely affect the quality and profitability of our business operations as we pursue our growth and human capital strategy.

Current wording

In addition, hiring new clinicians involves challenges, including the ability to manage decreased profitability and increased expenses incurred during each clinician’s development and ramp-up period. Rising expenses including wage inflation could adversely affect our ability to attract and retain high-quality clinicians. The substantial management time and resources that our new clinicians require may result in disruption to our existing business operations, which may harm our profitability, and these commitments may be amplified if we continue to recruit a significant number of clinicians early in their careers. Our inability to successfully address these challenges and other factors may adversely affect the quality and profitability of our business operations as we pursue our growth and human capital strategy.

Previous wording

Our competitors primarily include other outpatient mental health providers that deliver care in-person or through virtual visits. Our indirect competitors also include episodic consumer-driven point solutions, such as in-person and virtual life coaching, digital therapy and support tools and other technologies related to mental healthcare services. In addition to established mental health providers, we may face additional competition from new market entrants, including major retailers that have recently begun to offer in-person and virtual mental healthcare in certain markets. Generally, practices, certain hospitals, and other outpatient mental health providers in the local communities we serve provide services similar to those we offer, and, in some cases, our competitors may offer a broader array of services, more flexible hours or more desirable locations to patients and outpatient mental health providers than ours, and may have larger or more specialized medical staffs to serve patients. Furthermore, healthcare consumers are now able to access patient satisfaction data, as well as standard charges for services, to compare competing outpatient mental health providers; if any of our centers or our supported practices achieve poor results (or results that are lower than our competitors’) on patient satisfaction surveys, or if our standard charges are or are perceived to be higher than our competitors, we may attract fewer patients. Additional quality measures and trends toward clinical or billing transparency, including recently enacted price transparency rules that would require third-party payors to make their pricing information publicly available, may have a negative impact on our competitive position and patient volumes, as patients may prefer to use lower-cost healthcare providers if they deliver services that are perceived to be similar in quality to ours. Competition from specialized providers, medical practices, retailers, digital health companies and other parties could negatively impact our revenue and market share.

Current wording

Our competitors primarily include other outpatient mental health providers that deliver care in-person or through virtual visits. Our indirect competitors also include episodic consumer-driven point solutions, such as in-person and virtual life coaching, digital therapy and support tools and other technologies related to mental healthcare services. In addition to established mental health providers, we may face additional competition from new market entrants, including major retailers that have recently begun to offer in-person and virtual mental healthcare in certain markets. Generally, practices, certain hospitals, and other outpatient mental health providers in the local communities we serve provide services similar to those we offer, and, in some cases, our competitors may offer a broader array of services, more flexible hours or more desirable locations to patients and outpatient mental health providers than ours, and may have larger or more specialized medical staffs to serve patients. Furthermore, healthcare consumers are now able to access patient satisfaction data, as well as standard charges for services, to compare competing outpatient mental health providers; if any of our centers or our supported practices achieve poor results (or results that are lower than our competitors’) on patient satisfaction surveys, or if our standard charges are or are perceived to be higher than our competitors, we may attract fewer patients. Additional quality measures and trends toward clinical or billing transparency, including price transparency rules that require third-party payors to make their pricing information publicly available, may have a negative impact on our competitive position and patient volumes, as patients may prefer to use lower-cost healthcare providers if they deliver services that are perceived to be similar in quality to ours. Competition from specialized providers, medical practices, retailers, digital health companies and other parties could negatively impact our revenue and market share.

Previous wording

In December 2020, in connection with the Consolidated Appropriations Act of 2021, the No Surprises Act introduced protections against surprise billing by providers that became effective on January 1, 2022. The rule creates new protections against surprise billing and excessive cost sharing for healthcare consumers and creates a dispute resolution process to rectify cost disparities. The provider-specific portions of the Act require providers to submit a good faith estimate to uninsured patients (or patients who will not be submitting claims to their insurer) or to the patient’s insurer and can result in payment disputes if the resulting bill is substantially in excess of said estimate. Additionally, providers are responsible for ensuring accuracy of their provider directories with insurers and can be held responsible for the cost disparity of treatment caused by incorrect provider directory designations. As such, procedural infrastructure is required to ensure compliance with the No Surprises Act and to prevent dispute resolution and resulting noncompliance penalties. This law and any related disputes or non-compliance by us could cause disruptions in the ability for us to receive timely payment or result in penalties and therefore could have a material adverse effect on our business.

Current wording

In December 2020, in connection with the Consolidated Appropriations Act of 2021, the No Surprises Act introduced protections against surprise billing by providers that became effective on January 1, 2022. The rule created new protections against surprise billing and excessive cost sharing for healthcare consumers and created a dispute resolution process to rectify cost disparities. The provider-specific portions of the Act require providers to submit a good faith estimate to uninsured patients (or patients who will not be submitting claims to their insurer) or to the patient’s insurer and can result in payment disputes if the resulting bill is substantially in excess of said estimate. Additionally, providers are responsible for ensuring accuracy of their provider directories with insurers and can be held responsible for the cost disparity of treatment caused by incorrect provider directory designations. As such, procedural infrastructure is required to ensure compliance with the No Surprises Act and to prevent dispute resolution and resulting noncompliance penalties. This law and any related disputes or non-compliance by us could cause disruptions in the ability for us to receive timely payment or result in penalties and therefore could have a material adverse effect on our business.

Previous wording

We have in the past and may in the future be required to refund amounts we have been paid and/or pay fines and penalties as a result of these inspections, reviews, audits and investigations. If adverse inspections, reviews, audits or investigations occur and any of the results noted above occur, it could have a material adverse effect on our business, financial condition and results of operations. Furthermore, the legal, document production and other costs associated with complying with these inspections, reviews, audits or investigations could be significant.

Current wording

We have in the past and may in the future be required to refund amounts we have been paid and/or pay fines and penalties as a result of these inspections, reviews, audits and investigations. If adverse inspections, reviews, audits or investigations occur and any of the results noted above occur, it could have a material adverse effect on our business, financial condition and results of operations. Furthermore, the legal, document production and other costs associated with complying with these inspections, reviews, audits or investigations could be significant. In addition, any of these events, whether or not ultimately substantiated, may result in reputational harm that could have a material adverse effect on our business, financial condition and results of operations.

Previous wording

Increasing regulatory and legislative changes place additional demands on our information technology infrastructure that could have a direct impact on resources available for other projects tied to our strategic initiatives for our technology platform. In addition, recent trends toward greater patient engagement in healthcare require new and enhanced technologies, including more sophisticated applications for mobile devices. Connectivity among technologies is becoming increasingly important. We and our third-party vendors must also develop new systems to meet current market standards and keep pace with continuing changes in information processing technology, evolving industry and regulatory standards and patient needs. Failure to do so may present compliance challenges and impede our ability to deliver care to patients in a competitive manner. Further, because system development projects are long-term in nature, they may be more costly than expected to complete and may not deliver the expected benefits upon completion. Additional development projects may be needed or arise in the future and we may not have the necessary resources to complete such development projects. Further, the technological advances of our competitors or future competitors may result in our technologies or future technologies become uncompetitive or obsolete. Our failure to effectively invest in, implement improvements to and properly maintain the uninterrupted operation and data integrity of our information technology and other business systems could adversely affect our results of operations, financial condition and cash flow. Similarly, if our third party vendors fail to effectively invest in, implement improvements to and properly maintain the uninterrupted operation and data integrity of their own information technology systems, interruptions in their systems or network may result in disruptions of our own systems and business operations.

Current wording

Increasing regulatory and legislative changes place additional demands on our information technology infrastructure that could have a direct impact on resources available for other projects tied to our strategic initiatives for our technology platform. In addition, recent trends toward greater patient engagement in healthcare require new and enhanced technologies, including more sophisticated applications for mobile devices. Connectivity among technologies is becoming increasingly important. We and our third-party vendors must also develop new systems to meet current market standards and keep pace with continuing changes in information processing technology, evolving industry and regulatory standards and patient needs. Failure to do so may present compliance challenges and impede our ability to deliver care to patients in a competitive manner. Further, because system development projects are long-term in nature, they may be more costly than expected to complete and may not deliver the expected benefits upon completion. Additional development projects may be needed or arise in the future and we may not have the necessary resources to complete such development projects. Further, the technological advances of our competitors or future competitors may result in our technologies or future technologies becoming uncompetitive or obsolete. Our failure to effectively invest in, implement improvements to and properly maintain the uninterrupted operation and data integrity of our information technology and other business systems could adversely affect our results of operations, financial condition and cash flow. Similarly, if our third party vendors fail to effectively invest in, implement improvements to and properly maintain the uninterrupted operation and data integrity of their own information technology systems, interruptions in their systems or network may result in disruptions of our own systems and business operations.

Previous wording

We lease all of our centers and may experience risks relating to lease termination, lease expense escalators, lease extensions and special charges.

Current wording

We lease all of our centers and may experience risks relating to lease terminations, lease expense escalators, lease extensions and special charges.

Previous wording

Leasing centers pursuant to binding lease agreements may limit our ability to exit markets. For instance, if a center subject to a lease becomes unprofitable, we may be required to continue operating such center or, if allowed by the landlord, to close such center, we may remain obligated for the lease payments on such center. In connection with our real estate optimization initiative in 2023, we incurred special charges relating to the closing of such centers, including lease termination costs and impairment charges, which reduced and may continue to reduce our profits and adversely affect our business, financial condition or results of operations.

Current wording

Leasing centers pursuant to binding lease agreements may limit our ability to exit markets. For instance, if a center subject to a lease becomes unprofitable, we may be required to continue operating such center or, if allowed by the landlord, to close such center, but we may remain obligated for the lease payments on such center. In connection with our real estate optimization initiative, in 2024, we incurred special charges relating to the closing of such centers, including certain gains and losses related to early lease termination of previously abandoned real estate leases, which reduced our profits.

Previous wording

We are subject, and in the future may become subject from time to time, to legal proceedings, claims and inquiries, such as claims brought by our partners in connection with commercial disputes, consumer class action claims, employment claims made by our current or former employees or other claims or proceedings. For example, in the first half of 2023, two related hybrid collective/class action lawsuits, captioned Armand et al. v. LifeStance Health Group, Inc. and Jessica McAfee et al. v. LifeStance Health Group, Inc., were filed against the Company by a putative collective or class representing employees of the Company related to advances on compensation and alleged underpayments for time worked, and on April 26, 2023, a class action litigation captioned Strong v. LifeStance Health Group, Inc. was filed against the Company by a putative class representing users of the Company's website who allege various privacy-related claims premised on the Company's use of pixel technologies on its website. A district court judge dismissed the complaint without prejudice on December 19, 2023. The plaintiff has filed an amended complaint and the matter remains ongoing.

Current wording

We are subject, and in the future may become subject from time to time, to legal proceedings, claims and inquiries, such as claims brought by our partners in connection with commercial disputes, consumer class action claims, employment claims made by our current or former employees or other claims or proceedings. For example, on April 26, 2023, a class action litigation captioned Strong v. LifeStance Health Group, Inc. was filed against the Company by a putative class representing users of the Company's website who allege various privacy-related claims premised on the Company's use of pixel technologies on its website.

Previous wording

Our centers may be harmed or rendered inoperable by natural or man-made disasters, including earthquakes, power outages, fires, floods, nuclear disasters and acts of terrorism or other criminal activities, which make it difficult or impossible for us to operate our business for some period of time. Although we deliver care in both in-person and digital settings, such disruptions in our operations could negatively impact our business and results of operations and harm our reputation. Although we maintain an insurance policy covering damage to property we lease, such insurance may not be sufficient to compensate for losses that may occur. Any such losses or damages could harm our business, financial condition and results of operations. In addition, our physician partners’ facilities may be harmed or rendered inoperable by such natural or man-made disasters, which may cause disruptions, difficulties or other negative effects on our business and operations, with respect to our integrated care model.

Current wording

Our centers may be harmed or rendered inoperable by natural or man-made disasters, including earthquakes, hurricanes, power outages, fires, floods, nuclear disasters and acts of terrorism or other criminal activities, which make it difficult or impossible for us to operate our business for some period of time. Although we deliver care in both in-person and digital settings, such disruptions in our operations could negatively impact our business and results of operations and harm our reputation. Although we maintain an insurance policy covering damage to property we lease, such insurance may not be sufficient to compensate for losses that may occur. Any such losses or damages could harm our business, financial condition and results of operations. In addition, our physician partners’ facilities may be harmed or rendered inoperable by such natural or man-made disasters, which may cause disruptions, difficulties or other negative effects on our business and operations, with respect to our integrated care model.

Previous wording

We may need to raise additional funds, and we may not be able to obtain additional debt or equity financing on favorable terms or at all. If we raise additional equity financing, our security holders may experience significant dilution of their ownership interests. If we engage in additional debt financing, we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity or other ratios or restrict our ability to pay dividends or make acquisitions. In addition, the covenants in the Credit Agreement among LifeStance Health Holdings, Inc., Lynnwood Intermediate Holdings, Inc., Capital One, National Association, and each lender party thereto, dated May 4, 2022, as amended (the “2022 Credit Agreement”), limits our ability to obtain additional debt, and any failure to adhere to these covenants would result in penalties or defaults that could further restrict our liquidity or limit our ability to obtain financing. If we need additional capital and cannot raise it on acceptable terms, or at all, we may not be able to, among other things:

Current wording

We may need to raise additional funds, and we may not be able to obtain additional debt or equity financing on favorable terms or at all. If we raise additional equity financing, our security holders may experience significant dilution of their ownership interests. If we engage in additional debt financing, we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity or other ratios or restrict our ability to pay dividends or make acquisitions. In addition, the covenants in the Credit Agreement among LifeStance Health Holdings, Inc., Lynnwood Intermediate Holdings, Inc., Capital One, National Association, and each lender party thereto, dated December 19, 2024 (the “2024 Credit Agreement”), limits our ability to obtain additional debt, and any failure to adhere to these covenants would result in penalties or defaults that could further restrict our liquidity or limit our ability to obtain financing. If we need additional capital and cannot raise it on acceptable terms, or at all, we may not be able to, among other things:

Previous wording

the federal Ethics in Patient Referrals Act, commonly referred to as the Stark Law, that, unless one of the statutory or regulatory exceptions apply, prohibits physicians from referring Medicare or Medicaid patients to an entity for the provision of certain “designated health services” if the physician or a member of such physician’s immediate family has a direct or indirect financial relationship (including an ownership interest or a compensation arrangement) with the entity, and prohibit the entity from billing Medicare or Medicaid for such designated health services. Sanctions for violating the Stark Law include denial of payment, civil monetary penalties of up to $29,899 per claim submitted and exclusion from the federal healthcare programs. Failure to refund amounts received as a result of a prohibited referral on a timely basis may constitute a false or fraudulent claim and may result in civil penalties and additional penalties under the False Claims Act. The statute also provides for a penalty of up to $199,338 for a circumvention scheme;

Current wording

the federal Ethics in Patient Referrals Act, commonly referred to as the Stark Law, that, unless one of the statutory or regulatory exceptions apply, prohibits physicians from referring Medicare or Medicaid patients to an entity for the provision of certain “designated health services” if the physician or a member of such physician’s immediate family has a direct or indirect financial relationship (including an ownership interest or a compensation arrangement) with the entity, and prohibit the entity from billing Medicare or Medicaid for such designated health services. Sanctions for violating the Stark Law include denial of payment, civil monetary penalties of up to $30,868 per claim submitted and exclusion from the federal healthcare programs. Failure to refund amounts received as a result of a prohibited referral on a timely basis may constitute a false or fraudulent claim and may result in civil penalties and additional penalties under the False Claims Act. The statute also provides for a penalty of up to $205,799 for a circumvention scheme;

Previous wording

the federal Anti-Kickback Statute that prohibits the knowing and willful offer, payment, solicitation or receipt of any bribe, kickback, rebate or other remuneration for referring an individual, in return for ordering, leasing, purchasing or recommending or arranging for or to induce the referral of an individual or the ordering, purchasing or leasing of items or services covered, in whole or in part, by any federal healthcare program, such as Medicare and Medicaid. Remuneration has been interpreted broadly to be anything of value, and could include compensation, discounts or free marketing services. A person or entity does not need to have actual knowledge of the statute or specific intent to violate it to have committed a violation. In addition, the government may assert that a claim including items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the False Claims Act. Violations of the federal Anti-Kickback Statute may result in civil monetary penalties up to $120,816 for each violation, plus up to three times the remuneration involved. Civil penalties for such conduct can further be assessed under the federal False Claims Act. Violations can also result in criminal penalties and imprisonment. Similarly, violations can result in exclusion from participation in government healthcare programs, including Medicare and Medicaid. We expect the OIG to issue new regulations adding and modifying safe harbors and to issue new fraud alerts covering the latest conduct that OIG finds problematic;

Current wording

the federal Anti-Kickback Statute that prohibits the knowing and willful offer, payment, solicitation or receipt of any bribe, kickback, rebate or other remuneration for referring an individual, in return for ordering, leasing, purchasing or recommending or arranging for or to induce the referral of an individual or the ordering, purchasing or leasing of items or services covered, in whole or in part, by any federal healthcare program, such as Medicare and Medicaid. Remuneration has been interpreted broadly to be anything of value, and could include compensation, discounts or free marketing services. A person or entity does not need to have actual knowledge of the statute or specific intent to violate it to have committed a violation. In addition, the government may assert that a claim including items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the False Claims Act. Violations of the federal Anti-Kickback Statute may result in civil monetary penalties up to $124,732 for each violation, plus up to three times the remuneration involved. Civil penalties for such conduct can further be assessed under the federal False Claims Act. Violations can also result in criminal penalties and imprisonment. Similarly, violations can result in exclusion from participation in government healthcare programs, including Medicare and Medicaid. We expect the OIG to issue new regulations adding and modifying safe harbors and to issue new fraud alerts covering the latest conduct that OIG finds problematic;

Previous wording

To enforce compliance with the federal laws, the U.S. Department of Justice and the OIG have continued their scrutiny of healthcare providers, which has led to a number of investigations, prosecutions, convictions and settlements in the healthcare industry. Dealing with investigations can be time- and resource-consuming and can divert management’s attention from the business. Any such investigation or settlement could increase our costs or otherwise have an adverse effect on our business. In addition, because of the potential for large monetary exposure under the federal False Claims Act, which provides for treble damages and mandatory minimum penalties of $13,508 to $27,018 per false claim or statement, healthcare providers often resolve allegations without admissions of liability for significant and material amounts to avoid the uncertainty of treble damages that may be awarded in litigation proceedings. Such settlements often contain additional compliance and reporting requirements as part of a consent decree, settlement agreement or corporate integrity agreement. Given the significant size of actual and potential settlements, it is expected that the government will continue to devote substantial resources to investigating healthcare providers’ compliance with the healthcare reimbursement rules and fraud and abuse laws.

Current wording

To enforce compliance with the federal laws, the U.S. Department of Justice and the OIG have continued their scrutiny of healthcare providers, which has led to a number of investigations, prosecutions, convictions and settlements in the healthcare industry. Dealing with investigations can be time- and resource-consuming and can divert management’s attention from the business. Any such investigation or settlement could increase our costs or otherwise have an adverse effect on our business. In addition, because of the potential for large monetary exposure under the federal False Claims Act, which provides for treble damages and mandatory minimum penalties of $13,946 to $27,894 per false claim or statement, healthcare providers often resolve allegations without admissions of liability for significant and material amounts to avoid the uncertainty of treble damages that may be awarded in litigation proceedings. Such settlements often contain additional compliance and reporting requirements as part of a consent decree, settlement agreement or corporate integrity agreement. Given the significant size of actual and potential settlements, it is expected that the government will continue to devote substantial resources to investigating healthcare providers’ compliance with the healthcare reimbursement rules and fraud and abuse laws.

Previous wording

Several states in which we operate have adopted competition and healthcare planning laws that affect transactions in the healthcare industry. Some states require notification, filings, and/or approvals by state agencies with respect to proposed transactions involving healthcare providers. Such processes can take significant time, require filing fees, result in conditions that require certain operational changes and include regular annual reviews regarding the cost and quality of services, among other topics. For example, California's law requires at least 90-days advance notification to the Office of Health Care Affordability within the state Department of Health Care Services of certain proposed transactions that close on or after April 1, 2024 and require extensive documentation in connection with the submission of documents. These laws and the level of enforcement by the respective state agencies are subject to continuous change and interpretation, and compliance with these laws could adversely affect our business.

Current wording

Several states in which we operate have adopted competition and healthcare planning laws that affect transactions in the healthcare industry, including California, Illinois, Indiana, Massachusetts, Minnesota, Nevada, New York, Oregon, and Washington, and states generally continue to propose such laws. Some states require notification, filings, and/or approvals by state agencies with respect to proposed transactions involving healthcare providers. Such processes can take significant time, require filing fees, result in conditions that require certain operational changes and include regular annual reviews regarding the cost and quality of services, among other topics. For example, California's law requires at least 90-days advance notification to the Office of Health Care Affordability within the state Department of Health Care Services of certain proposed transactions and require extensive documentation in connection with the submission of documents. These laws and the level of enforcement by the respective state agencies are subject to continuous change and interpretation, and compliance with these laws could adversely affect our business.

Previous wording

Our ability to perform medical and virtual services in a particular U.S. state is directly dependent upon the applicable laws governing the practice of medicine or other professions, healthcare delivery and fee splitting in such locations, which are subject to changing political, regulatory and other influences. The extent to which a U.S. state considers particular actions or relationships to constitute the practice of medicine or other professions is subject to change and to evolving interpretations by professional boards and state attorneys general, among others, each of which has broad discretion. There is a risk that U.S. state authorities in some jurisdictions may find that our contractual relationships with outpatient mental health practices, which govern the provision of medical and virtual services and the payment of administrative and operations support fees, violate laws prohibiting the corporate practice of medicine or other professions and fee-splitting. And lawsuits alleging violation of such state doctrines are not uncommon, with a present case against a national emergency physician staffing company that began in California in January 2024 that could have an effect on our business operations in California. The extent to which each state may consider particular actions or contractual relationships to constitute improper influence of professional judgment varies across the states and is subject to change and to evolving interpretations by state licensing boards and state attorneys general, among others. Accordingly, we must monitor our compliance with laws in every jurisdiction in which we operate on an ongoing basis. Our activities and arrangements, if challenged, could be found to be in violation with the law. Additionally, it is possible that the laws and rules governing the practice of medicine or other professions, including the provision of virtual services, and fee splitting in one or more jurisdictions may change in a manner adverse to our business. While the management contracts prohibit us from controlling, influencing or otherwise interfering with the practice of medicine and other professions by the supported clinicians, and provide that clinicians retain exclusive control and responsibility for all aspects of the practice of medicine or other professions and the delivery of clinical services, there can be no assurance that our contractual arrangements and activities with supported practices will be free from scrutiny from U.S. state authorities, and we cannot guarantee that subsequent interpretation of the corporate practice and fee-splitting laws will not circumscribe our business operations. State corporate practice doctrines also often impose penalties on healthcare clinicians themselves for aiding the corporate practice of medicine or other professions, which could discourage clinicians from participating in our network. If a successful legal challenge or an adverse change in relevant laws were to occur, and we were u…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Our ability to perform medical and virtual services in a particular U.S. state is directly dependent upon the applicable laws governing the practice of medicine or other professions, healthcare delivery and fee splitting in such locations, which are subject to changing political, regulatory and other influences. The extent to which a U.S. state considers particular actions or relationships to constitute the practice of medicine or other professions is subject to change and to evolving interpretations by professional boards and state attorneys general, among others, each of which has broad discretion. There is a risk that U.S. state authorities in some jurisdictions may find that our contractual relationships with outpatient mental health practices, which govern the provision of medical and virtual services and the payment of administrative and operations support fees, violate laws prohibiting the corporate practice of medicine or other professions and fee-splitting. And lawsuits alleging violation of such state doctrines are not uncommon—in 2024, a case against a national emergency physician staffing company in California challenging a model of operation similar to our own was voluntarily dismissed without a decision after the company elected to exit the California market, resulting in the state's loss of jurisdiction. The extent to which each state may consider particular actions or contractual relationships to constitute improper influence of professional judgment varies across the states and is subject to change and to evolving interpretations by state licensing boards and state attorneys general, among others. Accordingly, we must monitor our compliance with laws in every jurisdiction in which we operate on an ongoing basis. Our activities and arrangements, if challenged, could be found to be in violation with the law. Additionally, it is possible that the laws and rules governing the practice of medicine or other professions, including the provision of virtual services, and fee splitting in one or more jurisdictions may change in a manner adverse to our business. While the management contracts prohibit us from controlling, influencing or otherwise interfering with the practice of medicine and other professions by the supported clinicians, and provide that clinicians retain exclusive control and responsibility for all aspects of the practice of medicine or other professions and the delivery of clinical services, there can be no assurance that our contractual arrangements and activities with supported practices will be free from scrutiny from U.S. state authorities, and we cannot guarantee that subsequent interpretation of the corporate practice and fee-splitting laws will not circumscribe our business operations. State corporate practice doctrines also often impose penalties on healthcare clinicians themselves for aiding the corporate practice of medicine or other professions, which could discourage clinicians from participating in our networ…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

The impact of healthcare reform legislation and other changes in the healthcare industry and in healthcare spending on us is currently unknown, but may harm our business.

Current wording

The impact on us of healthcare reform legislation and other changes in the healthcare industry and in healthcare spending, including as a result of the 2024 elections, is currently unknown, but may harm our business.

Previous wording

Since its enactment, there have been judicial and Congressional challenges to certain aspects of the ACA as well as efforts to repeal or replace certain aspects of the ACA. While efforts to repeal all or part of the ACA have subsided, we cannot be certain that there will not be further legislative efforts or judicial challenges in the future. There may also be renewed interest in challenging the ACA as a result of the upcoming 2024 election. In addition to judicial challenges, the Biden administration or U.S. Congress may advance new healthcare policy goals and objectives through statute, regulation and executive order. For example, the Biden administration has indicated an intent to propose a public health insurance option, which, if enacted, could significantly change the competitive landscape among commercial insurance carriers.

Current wording

Since its enactment, there have been judicial and Congressional challenges to certain aspects of the ACA as well as efforts to repeal or replace certain aspects of the ACA. While efforts to repeal all or part of the ACA have generally subsided, we cannot be certain that there will not be further legislative efforts or judicial challenges in the future, or how the ACA will be upheld by the Trump administration. In addition to judicial challenges, the Trump administration or U.S. Congress may advance new healthcare policy goals and objectives or reverse existing healthcare policy goals, through statute, regulation and executive order. For example, premium subsidies for the ACA are set to expire in 2025, which without renewal will cause premium increases for the majority of ACA enrollees in 2026 and could result in an increase in the number of uninsured. The control of the House and Senate by a single party beginning in 2025, may enable broad policy changes in the healthcare industry, potentially affecting our business.

Previous wording

Our business involves the storage and transmission of proprietary information and sensitive or confidential data, including personal information of employees and others, as well as the PHI of our patients. Several laws and regulations require us to keep this information secure. Because of the extreme sensitivity of the information we store and transmit, the security features of our and our third-party vendors’ computer, network and communications systems infrastructure are critical to the success of our business. Our security features and processes or our vetting and oversight of third parties and related hardware and software may not be sufficient for all circumstances. We also exercise limited control over third-party vendors and their computer systems and choice of software, which increases our vulnerability to problems with the technology and information services they provide. Determined threat actors would likely be able to penetrate our security or the security of our vendors with enough skills, resources, and time, and they may evade detection for extended periods of time. A breach or failure of our or our third-party vendors’ network, hosted service providers or vendor systems could result from a variety of circumstances and events, including third-party action, employee negligence or error, malfeasance, computer viruses, cyber-attacks by computer hackers such as denial-of-service and phishing attacks, nation-state attacks, political protests, failures during the process of upgrading or replacing software and databases, power outages, hardware failures, telecommunication failures, software errors or incompatibility, user errors or catastrophic events. Information security risks have generally increased in recent years because of the proliferation of new technologies and the increased sophistication and activities of perpetrators of cyber-attacks. We are also dependent on a technology supply chain that involves many third parties, some of whom may not be known to us, and each of these companies may also be a source of potential risk to our patients, operations and reputation. Hackers and data thieves are increasingly sophisticated and operating large-scale and complex automated attacks, including on companies within the healthcare industry. As cyber threats continue to evolve, we and our third-party vendors may be unable to anticipate all potential threats. We may be required to expend additional resources to further enhance our information security measures and/or to investigate and remediate any information security vulnerabilities. If our or our third-party vendors’ security measures fail or are breached, it could result in unauthorized persons accessing sensitive patient data (including PHI), a loss of or damage to our data, or an inability to access data sources, process data or provide our services to our patients. A security incident may even remain undetected for an extended period, and we or our third-party vendors may be unable t…

Excerpt shortened here; the source contains the full paragraph.

Current wording

As cyber threats continue to evolve, we and our third-party vendors may be unable to anticipate all potential threats. We may be required to expend additional resources to further enhance our information security measures and/or to investigate and remediate any information security vulnerabilities. If our or our third-party vendors’ security measures fail or are breached, it could result in unauthorized persons accessing sensitive patient data (including PHI), a loss of or damage to our data, or an inability to access data sources, process data or provide our services to our patients. A security incident may even remain undetected for an extended period, and we or our third-party vendors may be unable to anticipate such threats and attacks or implement adequate preventive measures. For example, in February 2024, UnitedHealth Group announced that its Change Healthcare information technology systems were being taken offline for an undefined period, which impacted our operations, including our ability to process insurance claims, collect payments and confirm insurance eligibility of patients, and the ability of third-party pharmacies to fill electronic prescriptions our clinicians write for patients. Such failures or breaches of our or our third-party vendors’ security measures, or our or our third-party vendors’ inability to effectively resolve such failures or breaches in a timely manner, could severely damage our reputation, adversely affect patient, provider or investor confidence in us, and reduce the demand for our services from existing and potential patients. In addition, we could face litigation (including class action claims), damages for breach of contract, monetary penalties or regulatory actions for violation of applicable laws or regulations, and incur significant costs to comply with applicable data breach notification laws and to implement remedial measures to prevent future occurrences and mitigate past incidents. Although we maintain insurance coverage that may cover certain liabilities and expenses in connection with security breaches and other security incidents, we cannot be certain that our insurance coverage will be sufficient to compensate for all liability, that insurance will continue to be available to us on commercially reasonable terms (if at all), or that any insurer will not deny coverage as to any future claim, and in any event, insurance coverage would not address the reputational damage that could result from a security incident.

Previous wording

Should an attacker gain access to our network or the network of our third-party vendor, including by way of example, using compromised credentials of an authorized user, we are at risk that the attacker might successfully leverage that access to compromise additional systems and data. Certain measures that could increase the security of our systems, such as data encryption (including data at rest encryption), heightened monitoring and logging, scanning for source code errors or deployment of multi-factor authentication, take significant time and resources to deploy broadly, and such measures may not be deployed in a timely manner or be effective against an attack. As cybersecurity threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. The inability to implement, maintain and upgrade adequate safeguards could have a material adverse effect on our business.

Current wording

As cybersecurity threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. The inability to implement, maintain and upgrade adequate safeguards could have a material adverse effect on our business.

Previous wording

Our use and disclosure of PII, including PHI, is subject to federal and state privacy and security regulations, and our failure to comply with those regulations or to adequately secure such information we hold could result in significant liability or reputational harm and, in turn, substantial harm to our supported practices, supported clinicians, patient base and revenue.

Current wording

Our use and disclosure of PII, including PHI, is subject to federal and state privacy and security laws and regulations, and our failure to comply with those regulations or to adequately secure such information we hold could result in significant liability or reputational harm and, in turn, substantial harm to our supported practices, supported clinicians, patient base and revenue.

Previous wording

The privacy and security of PII stored, maintained, received or transmitted electronically is a major issue in the United States. While we strive to comply with all applicable privacy and security laws and regulations, as well as our own posted privacy policies, legal standards for privacy, including but not limited to “unfairness” and “deception,” as enforced by the Federal Trade Commission and state attorneys general and comprehensive privacy laws in more than a dozen states, continue to evolve and any failure or perceived failure to comply may result in proceedings or actions against us by government entities or others, or could cause us to lose customers, which could have a material adverse effect on our business. Recently, there has been an increase in public awareness of privacy issues in the wake of revelations about the activities of various government agencies and in the number of private privacy-related lawsuits filed against companies. Any allegations about us, our supported practices or our supported clinicians with regard to the collection, processing, use, disclosure, or security of PII or other privacy-related matters, even if unfounded and even if we are in compliance with applicable laws, could damage our reputation and harm our business.

Current wording

The privacy and security of PII stored, maintained, received or transmitted electronically is a significant issue in the United States. While we strive to comply with all applicable privacy and security laws and regulations, as well as our own posted privacy policies, legal standards for privacy, including but not limited to “unfairness” and “deception,” as enforced by the Federal Trade Commission and state attorneys general and comprehensive privacy laws in more than 20 states, continue to evolve. Our failure or perceived failure to comply may result in proceedings or actions against us by government entities or others, or could cause us to lose customers, which could have a material adverse effect on our business. Recently, there has been an increase in public awareness of privacy issues and in the number of private privacy-related lawsuits filed against companies. Any allegations about us, our supported practices or our supported clinicians with regard to the collection, processing, use, disclosure, or security of PII or other privacy-related matters, even if unfounded, could damage our reputation and harm our business.

Previous wording

Numerous foreign, federal and state laws and regulations govern collection, dissemination, use and confidentiality of personally identifiable health information, including state privacy and confidentiality laws (including state laws requiring disclosure of breaches) and HIPAA.

Current wording

Numerous federal and state laws and regulations govern collection, dissemination, use and confidentiality of personally identifiable health information, including state privacy and confidentiality laws (including state laws requiring notification of data breaches) and HIPAA.

Previous wording

HIPAA establishes a set of basic national privacy and security standards for the protection of PHI, by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates with whom such covered entities contract for services, which includes us. Certain of our entities and supported practices are covered entities, while our management service entities are business associates.

Current wording

HIPAA establishes a set of baseline national privacy and security standards for the protection of PHI, by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates with whom such covered entities contract for services, which includes us. Certain of our entities and supported practices are covered entities, while our management service entities are business associates.

Previous wording

HIPAA imposes mandatory penalties for certain violations. Penalties for violations of HIPAA and its implementing regulations include civil monetary penalties of up to $68,928 per violation, not to exceed $2,067,813 for violations of the same standard in a single calendar year (as of 2023, and subject to periodic adjustments for inflation). However, a single breach incident can result in violations of multiple standards, which could result in significant fines. A person who knowingly obtains or discloses individually identifiable health information in violation of HIPAA may face a criminal penalty of up to $50,000 and up to one-year of imprisonment. The criminal penalties increase if the wrongful conduct involves false pretenses or the intent to sell, transfer, or use identifiable health information for commercial advantage, personal gain, or malicious harm, with a maximum fine of $250,000 and maximum imprisonment of ten years. HIPAA also authorizes state attorneys general to file suit on behalf of their residents. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. Any such penalties or lawsuits could harm our business, financial condition, results of operations and prospects.

Current wording

HIPAA imposes mandatory penalties for certain violations. Penalties for violations of HIPAA and its implementing regulations include civil monetary penalties of up to $71,162 per violation, not to exceed $2,134,831 for violations of the same standard in a single calendar year (as of 2024, and subject to periodic adjustments for inflation). However, a single breach incident can result in violations of multiple standards, which could result in significant fines. A person who knowingly obtains or discloses individually identifiable health information in violation of HIPAA may face a criminal penalty of up to $50,000 and up to one-year of imprisonment. The criminal penalties increase if the wrongful conduct involves false pretenses or the intent to sell, transfer, or use identifiable health information for commercial advantage, personal gain, or malicious harm, with a maximum fine of $250,000 and maximum imprisonment of ten years. HIPAA also authorizes state attorneys general to file suit on behalf of their residents. While HIPAA does not create a private right of action allowing individuals to bring lawsuits in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. Any such penalties or lawsuits could harm our business, financial condition, results of operations and prospects.

Previous wording

HIPAA further requires that patients be notified of any unauthorized acquisition, access, use or disclosure of their unsecured PHI that compromises the privacy or security of such information, with certain exceptions related to unintentional or inadvertent use or disclosure by employees or authorized individuals. HIPAA specifies that such notifications must be made “without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.” If a breach affects 500 patients or more, it must be reported to HHS without unreasonable delay, and HHS will post the name of the breaching entity on its public website. Breaches affecting 500 patients or more in the same state or jurisdiction must also be reported to the local media. If a breach involves fewer than 500 people, the covered entity must record it in a log and notify HHS at least annually. Further, the HHS OCR published a proposed rule in January of 2021, which, among other things calls for greater care coordination and an individual’s rights to access patient records. The proposed rule specifically encourages the disclosure of PHI when needed to help individuals experiencing substance use disorder, serious mental illness and in emergency circumstances. The proposed rule is subject to a regulatory suspension announced by the Biden administration and we do not know when (or if) the final rule will be published or whether there may be additional changes to the regulations, but when it is, we will need to evaluate and potentially update our HIPAA regulatory programs and documentation to ensure compliance with such requirements. HHS OCR additionally issued a proposed rule in April of 2023 to modify existing standards permitting uses and disclosures of PHI when the PHI pertains to reproductive healthcare, which is defined broadly.

Current wording

HIPAA further requires that patients be notified of any unauthorized acquisition, access, use or disclosure of their unsecured PHI that compromises the privacy or security of such information, with certain exceptions related to unintentional or inadvertent use or disclosure by employees or authorized individuals. HIPAA specifies that such notifications must be made “without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.” If a breach affects 500 patients or more, it must be reported to HHS without unreasonable delay, and HHS will post the name of the breaching entity on its public website. Breaches affecting 500 patients or more in the same state or jurisdiction must also be reported to the local media. If a breach involves fewer than 500 people, the covered entity must record it in a log and notify HHS at least annually. Further, the HHS OCR published a proposed rule in January of 2021, which, among other things calls for greater care coordination and an individual’s rights to access patient records. The proposed rule specifically encourages the disclosure of PHI when needed to help individuals experiencing substance use disorder, serious mental illness and in emergency circumstances. The proposed rule is subject to a regulatory suspension announced by the Biden administration and we do not know when (or if) the final rule will be published or whether there may be additional changes to the regulations, but when it is, we will need to evaluate and potentially update our HIPAA regulatory programs and documentation to ensure compliance with such requirements.

Previous wording

Additionally, tracking technologies generally used to collect and analyze information about user behavior and enhance the user experience may qualify as HIPAA violations and result in sanction. In December 2022, OCR issued a bulletin titled, “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates,” which sets forth broad-reaching guidance for HIPAA covered entities and their business associates that utilize online tracking technologies on their webpages and applications. In the guidance, OCR takes the position that when individuals use regulated entities’ websites, the individual information gleaned from that use (including IP address, geographic location, or other unique identifying code) may include PHI, and such information cannot be disclosed to a tracking vendor in a manner that would constitute an impermissible disclosure under HIPAA (e.g., disclosure without a valid HIPAA authorization or business associate agreement (“BAA”)) or any other violations of HIPAA. See “—Risks Related to Our Business and Our Industry—Litigation, including in connection with commercial disputes or employment claims, against us could be costly and time-consuming to defend.”

Current wording

Additionally, online tracking technologies generally used to collect and analyze information about user behavior and enhance the user experience may qualify as HIPAA violations and result in sanction. In December 2022, OCR issued a bulletin titled, “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates,” which sets forth broad-reaching guidance for HIPAA covered entities and their business associates that utilize online tracking technologies on their webpages and applications. In the guidance, OCR takes the position that when individuals use regulated entities’ websites, the individual information gleaned from that use (including, in certain circumstances, IP address, geographic location, or other unique identifying code) may include PHI, and such information cannot be disclosed to a tracking vendor in a manner that would constitute an impermissible disclosure under HIPAA (e.g., disclosure without a valid HIPAA authorization or business associate agreement (“BAA”)). In March 2024, the OCR updated its 2023 guidance on the use of online tracking technologies on webpages and applications by HIPAA covered entities and business associates to address the disclosure of individually identifiable health information through unauthenticated, public-facing webpages. The guidance was subject to court challenge, and its interpretation and enforcement remain subject to ongoing developments. There have been several class action lawsuits, including against LifeStance, asserting that HIPAA covered entities and business associates improperly used or disclosed PHI through online tracking technologies. See “—Risks Related to Our Business and

Previous wording

Further, the U.S. federal government and various states and governmental agencies have adopted or are considering adopting various laws, regulations and standards regarding the collection, use, retention, security, disclosure, transfer and other processing of sensitive and personal information. For example, California implemented the California Confidentiality of Medical Information Act, which imposes restrictive requirements regulating the use and disclosure of health information and other personally identifiable information. These laws and regulations are not necessarily preempted by HIPAA, particularly if a state affords greater protection to individuals than HIPAA. Where state laws are more protective, we have to comply with the stricter provisions. In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. California has also implemented the California Consumer Privacy Act ("CCPA"), which came into effect on January 1, 2020, which increases privacy rights for California residents and imposes obligations on companies that process their personal information. Among other things, the CCPA requires covered companies to provide new disclosures to California consumers and provide such consumers new data protection and privacy rights, including the ability to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. The CCPA has been amended from time to time, and it is possible that further amendments will be enacted, but even in its current format remains unclear how various provisions of the CCPA will be interpreted and enforced. Additionally, the recently passed California Privacy Rights Act (“CPRA”) has significantly modified the CCPA, including expanding consumers’ rights with respect to certain sensitive personal information, and creating a new state agency that is vested with authority to implement and enforce the CCPA and CPRA. The majority of the CPRA provisions went into effect on January 1, 2023, with some requirements applying to data collected beginning January 1, 2022. The CPRA significantly expanded the CCPA's data protection obligations. Failure to comply with CCPA or CPRA could result in penalties for noncompliance of up to $7,500 per violation. More than a dozen other states have now passed comprehensive privacy laws that will come into effect at various times over the next few years. We will need to continue to evaluate our privacy program as the implementation of the law evolves and may need to make further modifications to our programs, which, if we fail to do so as required, may expose us to liability under the regulation. When we…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Further, the U.S. federal government and various states and governmental agencies have adopted or are considering adopting various laws, regulations and standards regarding the collection, use, retention, security, disclosure, transfer and other processing of sensitive and personal information. For example, California implemented the California Confidentiality of Medical Information Act, which imposes restrictive requirements regulating the use and disclosure of health information and other personally identifiable information. These laws and regulations are not necessarily preempted by HIPAA, particularly if a state affords greater protection to individuals than HIPAA. Where state laws are more protective, we have to comply with the stricter provisions. In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. For example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA") gives California residents certain privacy rights in the collection and use of their personal information, and take certain other acts in furtherance of those rights. Failure to comply with the CCPA may result in, among other things, civil penalties of up to $7,500 per violation, as well as a private right of action for certain data breaches. Additionally, California created a data protection agency authorized to implement and enforce the CCPA, which could result in increased enforcement. While the CCPA contains an exemption for PHI subject to HIPAA, we may process other personal information that is subject to the CCPA. In addition, almost 20 other states have now passed comprehensive privacy laws that have taken effect or will come into effect at various times over the next few years.

Previous wording

There are many other state-based data privacy and security laws and regulations that may impact our business. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may require us to modify our data processing practices and policies, divert resources from other initiatives and projects and could restrict the way services involving data are offered, all of which may adversely affect our results of operations. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than federal, international or other state laws, and such laws may differ from each other, which may complicate compliance efforts. State laws are changing rapidly and there is discussion in Congress of a new federal data protection and privacy law to which we may be subject.

Current wording

These comprehensive state privacy laws also provide exemptions for PHI subject to HIPAA or exempt covered entities and business associates entirely. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may require us to modify our data processing practices and policies, divert resources from other initiatives and projects and could restrict the way services involving data are offered, all of which may adversely affect our results of operations. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than federal, international or other state laws, and such laws may differ from each other, which may complicate compliance efforts. State laws are changing rapidly and there is discussion in Congress of a new federal data protection and privacy law to which we may be subject. We will need to continue to evaluate our privacy program as the implementation of the law evolves and may need to make further modifications to our programs, which, if we fail to do so as required, may expose us to liability.

Previous wording

The interplay of federal and state laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and our clients and potentially exposing us to additional expense, adverse publicity and liability. Further, as regulatory focus on privacy issues continues to increase and laws and regulations concerning the protection of personal information expand and become more complex, these potential risks to our business could intensify. Changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, such as PHI or PII, along with increased customer demands for enhanced data security infrastructure, could greatly increase our cost of providing our services, decrease demand for our services, reduce our revenue and/or subject us to additional liabilities.

Current wording

The interplay of federal and state laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and our clients and potentially exposing us to additional expense, adverse publicity and liability. Further, as regulatory focus on privacy issues continues to increase and laws and regulations concerning the protection of personal information expand and become more complex, these potential risks to our business could intensify. Changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, such as PHI or PII, along with increased customer demands for enhanced data security, could greatly increase our cost of providing our services, decrease demand for our services, reduce our revenue and/or subject us to additional liabilities.

Previous wording

Because of the breadth of these laws and the narrowness of their exceptions and safe harbors, it is possible that our business activities can be subject to challenge under one or more of such laws. The scope and enforcement of each of these laws is uncertain and subject to rapid change in the current environment of healthcare reform. Federal, state and foreign enforcement bodies have recently increased their scrutiny of interactions between healthcare companies and healthcare providers, which has led to a number of investigations, prosecutions, convictions and settlements in the healthcare industry. Any such investigations, prosecutions, convictions or settlements could result in significant financial penalties, damage to our brand and reputation, and a loss of customers, any of which could have an adverse effect on our business.

Current wording

The evolving patchwork of differing state and federal privacy and data security laws increases the cost and complexity of operating our business and increases our exposure to liability, including from third-party litigation and regulatory investigations, enforcement, fines and penalties. The scope and enforcement of each of these laws is uncertain and subject to rapid change, particularly, in the current environment of healthcare reform. Federal and state enforcement bodies have recently increased their scrutiny of interactions between healthcare companies and healthcare providers, which has led to a number of investigations, prosecutions, convictions and settlements in the healthcare industry. Any such investigations, prosecutions, convictions or settlements could result in significant financial penalties, damage to our brand and reputation, and a loss of customers, any of which could have an adverse effect on our business.

Previous wording

As of December 31, 2023, we had $289.5 million in principal amount outstanding under our 2022 Credit Agreement. Our indebtedness, or any additional indebtedness we may incur, could require us to divert funds identified for other purposes for debt service and impair our liquidity position. If we cannot generate sufficient cash flow from operations to service our debt, we may need to refinance our debt, dispose of assets or issue equity to obtain necessary funds. We do not know whether we will be able to take any of these actions on a timely basis, on terms satisfactory to us or at all.

Current wording

As of December 31, 2024, we had $290.0 million in principal amount outstanding under our 2024 Credit Agreement. Our indebtedness, or any additional indebtedness we may incur, could require us to divert funds identified for other purposes for debt service and impair our liquidity position. If we cannot generate sufficient cash flow from operations to service our debt, we may need to refinance our debt, dispose of assets or issue equity to obtain necessary funds. We do not know whether we will be able to take any of these actions on a timely basis, on terms satisfactory to us or at all.

Previous wording

As of December 31, 2023, investment entities affiliated with TPG Inc. ("TPG"), affiliates of Silversmith Capital Partners ("Silversmith"), and affiliates of Summit Partners ("Summit" and together with TPG and Silversmith, our "Principal Stockholders"), collectively, beneficially owned approximately 63.5% of our common stock. The Principal Stockholders together will control the vote of all matters submitted to a vote of our stockholders, which enables them to control the election of the members of the Board of Directors and other corporate decisions. Even when the Principal Stockholders cease to own shares of our stock representing a majority of the total voting power, for so long as the Principal Stockholders continue to own a significant percentage of our stock, the Principal Stockholders will still be able to significantly influence the composition of our Board of Directors and the approval of actions requiring stockholder approval. Accordingly, for such period of time, the Principal Stockholders will have significant influence with respect to our management, business plans and policies, including the appointment and removal of our officers, decisions on whether to raise future capital and amending our charter and bylaws, which govern the rights attached to our common stock. In particular, for so long as the Principal Stockholders continue to own a significant percentage of our stock, the Principal Stockholders will be able to cause or prevent a change of control of us or a change in the composition of our Board of Directors and could preclude any unsolicited acquisition of us. The concentration of ownership could deprive you of an opportunity to receive a premium for your shares of common stock as part of a sale of us and ultimately might affect the market price of our common stock.

Current wording

As of December 31, 2024, investment entities affiliated with TPG Inc. ("TPG"), affiliates of Silversmith Capital Partners ("Silversmith"), and affiliates of Summit Partners ("Summit" and together with TPG and Silversmith, our "Principal Stockholders"), collectively, beneficially owned approximately 57.6% of our common stock. The Principal Stockholders together will control the vote of all matters submitted to a vote of our stockholders, which enables them to control the election of the members of the Board of Directors and other corporate decisions. Even when the Principal Stockholders cease to own shares of our stock representing a majority of the total voting power, for so long as the Principal Stockholders continue to own a significant percentage of our stock, the Principal Stockholders will still be able to significantly influence the composition of our Board of Directors and the approval of actions requiring stockholder approval. Accordingly, for such period of time, the Principal Stockholders will have significant influence with respect to our management, business plans and policies, including the appointment and removal of our officers, decisions on whether to raise future capital and amending our charter and bylaws, which govern the rights attached to our common stock. In particular, for so long as the Principal Stockholders continue to own a significant percentage of our stock, the Principal Stockholders will be able to cause or prevent a change of control of us or a change in the composition of our Board of Directors and could preclude any unsolicited acquisition of us. The concentration of ownership could deprive you of an opportunity to receive a premium for your shares of common stock as part of a sale of us and ultimately might affect the market price of our common stock.