iRhythm Holdings, Inc.

Previous wording

Our short and long-term success is subject to numerous risks and uncertainties, many of which involve factors that are difficult to predict or beyond our control. Before making a decision to invest in, hold or sell our common stock, stockholders and potential stockholders should carefully consider the risks and uncertainties described below, in addition to the other information contained in or incorporated by reference into this Quarterly Report on Form 10-Q, as well as the other information we file with the SEC. If any of the following risks are realized, our business, financial condition, results of operations and prospects could be materially and adversely affected. In that case, the value of our common stock could decline and stockholders may lose all or part of their investment. Furthermore, additional risks and uncertainties of which we are currently unaware, or which we currently consider to be immaterial, could have a material adverse effect on our business, financial condition and results of operations. Refer to our disclaimer regarding forward-looking statements at the beginning of “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Part I, Item 2 of this Quarterly Report.

Current wording

Our short and long-term success is subject to numerous risks and uncertainties, many of which involve factors that are difficult to predict or beyond our control. Before making a decision to invest in, hold or sell our common stock, stockholders and potential stockholders should carefully consider the risks and uncertainties described below, in addition to the other information contained in or incorporated by reference into this Quarterly Report on Form 10-Q, as well as the other information we file with the SEC. If any of the following risks are realized, our business, financial condition, results of operations and prospects could be materially and adversely affected. In that case, the value of our common stock could decline and stockholders may lose all or part of their investment. References to past events are provided by way of example only and are not intended to be a complete listing of such events or a representation as to whether or not such factors or similar events have occurred in the past or their likelihood of occurring in the future. Furthermore, additional risks and uncertainties of which we are currently unaware, or which we currently consider to be immaterial, could have a material adverse effect on our business, financial condition and results of operations. Refer to our disclaimer regarding forward-looking statements at the beginning of “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Part I, Item 2 of this Quarterly Report.

Previous wording

Reimbursement by Medicare is highly regulated and subject to change, and our failure to comply with applicable regulations, including regulations not designed for remote diagnostic tests like our iRhythm Services, could prevent us from receiving reimbursement under the Medicare program and some commercial payors, subject us to penalties, and adversely affect our reputation, business, and results of operations.

Current wording

•Reimbursement by Medicare is highly regulated and subject to change, and our failure to comply with applicable regulations, including regulations not designed for remote diagnostic tests like our iRhythm Services (as defined below), could prevent us from receiving reimbursement under the Medicare program and some commercial payors, subject us to penalties, and adversely affect our reputation, business, and results of operations.

Previous wording

If reimbursement or other payment for our iRhythm Services is reduced or modified in the United States or in our international markets, including through cost containment measures or changes to policies with respect to coding, coverage, and pricing, our business could suffer.

Current wording

•If reimbursement or other payment for our iRhythm Services is reduced or modified in the United States ("U.S.") or in our international markets, including through cost containment measures or changes to policies with respect to coding, coverage, and pricing, our business could suffer.

Previous wording

Our revenue relies on our iRhythm Services, which are currently our only offerings. If our iRhythm Services or future service offerings fail to gain, or lose, market acceptance, our business will suffer.

Current wording

•Our revenue relies on orders for our iRhythm Services, which are currently our only offerings. If our iRhythm Services or future service offerings fail to gain, or lose, market acceptance, our business will suffer.

Previous wording

•Although our current Zio Systems are comprised of medical devices that have received FDA marketing authorization (510(k) clearance) as well as, with respect to certain devices, regulatory certifications or approvals in the European Union ("EU"), Japan, Switzerland and the United Kingdom ("UK"), we may regularly engage in exploring and implementing product enhancements and in iterative changes to existing products, as well as seek to develop new technology or use of technology for new indications for use. These medical device developments may trigger further regulatory reviews and the results of those reviews are unpredictable.

Current wording

•Although our current products are comprised of medical devices that have received FDA marketing authorization (510(k) clearance) as well as, with respect to certain devices, regulatory certifications in the European Union ("EU"), Japan, Switzerland and the United Kingdom ("UK"), we may regularly engage in exploring and implementing product enhancements and in iterative changes to existing products, as well as seek to develop new technology or use of technology for new indications for use. These medical device developments may trigger further regulatory reviews and the results of those reviews are unpredictable.

Previous wording

Our use of third-party service providers or company resources located outside the United States to support certain customer care, clinical, and other operations of our IDTFs may present challenges, and if we are ineffective in limiting work performed by these service providers or company resources consistent with applicable regulations or our contractual agreements with commercial payors, we may be subject to penalties or experience loss of revenue.

Current wording

•Our use of third-party service providers or company resources located outside the United States to support certain customer care, clinical, and other operations of our independent diagnostic testing facilities ("IDTFs") may present challenges, and if we are ineffective in limiting work performed by these service providers or company resources consistent with applicable regulations or our contractual agreements with commercial payors, we may be subject to penalties or experience loss of revenue.

Previous wording

•Changes in applicable laws or regulations or the interpretation or enforcement policies of regulators governing our IDTFs and iRhythm Services may constrain or require us to restructure our operations or adapt certain business strategies, which may harm our revenue and operating results.

Current wording

•Changes in applicable laws or regulations or the interpretation or enforcement policies of regulators governing our medical devices, IDTFs and iRhythm Services may constrain or require us to restructure our operations or adapt certain business strategies, which may harm our revenue and operating results.

Previous wording

•In the future we may identify additional material weaknesses or otherwise fail to maintain an effective system of internal controls, which may result in material misstatements of our consolidated financial statements or cause us to fail to meet our periodic reporting obligations.

Current wording

•In the future we may identify material weaknesses or otherwise fail to maintain an effective system of internal controls, which may result in material misstatements of our consolidated financial statements or cause us to fail to meet our periodic reporting obligations.

Previous wording

During the three and nine months ended September 30, 2025, we received approximately 25% and 24%, respectively, of our total revenue from the Medicare program (inclusive of Medicare Advantage). The Medicare program is administered by CMS, which imposes extensive and detailed requirements on diagnostic services providers, including IDTFs. These requirements include, but are not limited to, rules that govern how we structure our relationships with physicians, how we operate our IDTFs and market our iRhythm Services, when we may perform diagnostic tests, and how and when we submit reimbursement claims. Our failure to comply with the applicable Medicare rules and requirements could result in discontinuation of our reimbursement under the Medicare program, a requirement to return funds already paid to us, civil monetary penalties, criminal penalties, and/or exclusion from the Medicare program, which would have a material adverse impact on our reputation, business, and results of operations.

Current wording

During the three months ended March 31, 2026, we received approximately 26% of our total revenue from the Medicare program through the Centers for Medicare & Medicaid Services ("CMS"). The Medicare program is administered by CMS, which imposes extensive and detailed requirements on diagnostic services providers, including IDTFs. These requirements include, but are not limited to, rules that govern how we structure our relationships with physicians, how we operate our IDTFs and market our ambulatory cardiac services ("iRhythm Services"), when we may perform diagnostic tests, and how and when we submit reimbursement claims. Our failure to comply with the applicable Medicare rules and requirements could result in discontinuation of our reimbursement under the Medicare program, a requirement to return funds already paid to us, civil monetary penalties, criminal penalties, and/or exclusion from the Medicare program, which would have a material adverse impact on our reputation, business, and results of operations.

Previous wording

CMS updates the reimbursement rates for diagnostic tests performed by IDTFs annually via the Medicare Physician Fee Schedule. Effective January 1, 2025, CMS updated the national payment rates for the CPT codes we use to report our cardiac monitoring services: CPT code 93247 (ECG recording conducted over a period of greater than 7 days and up to 15 days), CPT code 93243 (ECG recording conducted over a period of greater than 48 hours and up to 7 days), and CPT code 93229 (mobile cardiovascular telemetry). While the payment rates for CPT codes 93247 and 93243 saw a slight increase for calendar year 2025, the rate for CPT code 93229 experienced a decrease as compared to calendar year 2024.

Current wording

CMS updates the reimbursement rates for diagnostic tests performed by IDTFs annually via the Medicare Physician Fee Schedule. Effective January 1 of each year, CMS updates the national payment rates for the CPT codes we use to report our cardiac monitoring services: CPT code 93247 (ECG recording conducted over a period of greater than 7 days and up to 15 days), CPT code 93243 (ECG recording conducted over a period of greater than 48 hours and up to 7 days), and CPT code 93229 (mobile cardiovascular telemetry). New rates were published effective January 1, 2026, which reflect an increase in the national payment amount for CPT codes 93247, 93243 and 93229 as compared to calendar year 2025. However, there is no guarantee that these year-over-year increases will be sustained, or that payment rates will keep pace with the costs to provide our iRhythm Services in the future.

Previous wording

Because remote cardiac monitoring technology, including the Zio System, is rapidly evolving, there is a continuing risk that relative value units assigned, and reimbursement rates set, by CMS may not adequately reflect the value and expense of this technology and associated monitoring services. Further, CMS may reduce the rates for the CPT codes assigned to our services in the future, which would adversely affect our financial results, particularly to the extent commercial payors with which we contract follow suit.

Current wording

Because remote cardiac monitoring technology, including the iRhythm ACM System, is rapidly evolving, there is a continuing risk that relative value units assigned, and reimbursement rates set, by CMS may not adequately reflect the value and expense of this technology and associated monitoring services. Further, CMS may reduce the rates for the CPT codes assigned to our services in the future, which would adversely affect our financial results, particularly to the extent commercial payors with which we contract follow suit.

Previous wording

from time to time CMS or Medicare Administrative Contractors may develop National Coverage Determinations, Local Coverage Determinations (“LCDs”), or similar policies dictating the conditions for coverage and reimbursement of our iRhythm Services. For instance, in September 2025, Noridian Healthcare Solutions, LLC, Palmetto GBA, LLC, and CGS Administrators, LLC each published proposed LCDs regarding “Temporary Nontherapeutic Ambulatory Cardiac Monitoring Devices.” These proposed LCDs seek to outline the circumstances in which ambulatory cardiac monitoring is considered reasonable and necessary for Medicare purposes, device requirements, and associated coverage limitations. The proposed LCDs are the subject of ongoing public comment, in which iRhythm and other stakeholders have the opportunity to inform consideration of whether, and in what form, the LCDs might be adopted. The adoption of the proposed LCDs, or any other developments in the Medicare coverage policies on which the industry has come to rely, could necessitate changes to our business model, methods of operation, billing processes, and related compliance controls. Future significant changes in the healthcare systems in the United States or elsewhere could also have a negative impact on the demand for our current and future products and services. These include changes that may limit coverage or reduce reimbursement rates for our products and changes that may be proposed or implemented by the current or future laws or regulations.

Current wording

Finally, government and commercial payors have and may, in the future, consider healthcare policies and proposals intended to limit or reduce perceived increases in healthcare costs, including those that could significantly affect reimbursement for healthcare products such as our systems and services. These policies have included, and may in the future include: basing reimbursement policies and rates on clinical outcomes, the comparative effectiveness, and costs, of different treatment technologies and services, changes in risk adjustment weights or the criteria required to support risk adjustment eligible diagnoses in Medicare Advantage, as well as other measures. For example, from time to time CMS or Medicare Administrative Contractors may develop National Coverage Determinations, Local Coverage Determinations (“LCDs”), or similar policies dictating the conditions for coverage and reimbursement of our iRhythm Services. For instance, in September 2025, Noridian Healthcare Solutions, LLC, Palmetto GBA, LLC, and CGS Administrators, LLC each published proposed LCDs regarding “Temporary Nontherapeutic Ambulatory Cardiac Monitoring Devices.” These proposed LCDs seek to outline the circumstances in which ACM is considered reasonable and necessary for Medicare purposes, device requirements, and associated coverage limitations. The proposed LCDs were subject to a public comment period that concluded in November 2025, in which iRhythm and other stakeholders had the opportunity to inform consideration of whether, and in what form, the LCDs might be adopted. The adoption of the proposed LCDs, or any other developments in the Medicare coverage policies on which the industry has come to rely, could necessitate changes to our business model, methods of operation, billing processes, and related compliance controls. Future significant changes in the healthcare systems in the United States or elsewhere could also have a negative impact on the demand for our current and future products and services. These include changes that may limit coverage or reduce reimbursement rates for our products and changes that may be proposed or implemented by the current or future laws or regulations.

Previous wording

We report to third party payors the technical components of the remote cardiac monitoring services that are performed with our Zio Monitor, Zio XT, and Zio AT Systems using CPT codes established by the American Medical Association. These CPT codes are manufacturer- and technology-agnostic but describe general technical features required to support the diagnostic medical procedures represented by these billing codes. Given the nature of CPT codes, there is always some degree of risk for an entity that bills for its services that regulators or other third parties could assert that the CPT codes utilized were not appropriate, and recent events have the potential to increase the risk of questions or inquiry regarding our use of a specific CPT code.

Current wording

We report to third party payors the technical components of the remote cardiac monitoring services that are performed with our Zio monitor, Zio XT, and Zio AT devices using CPT codes established by the American Medical Association ("AMA"). These CPT codes are manufacturer- and technology-agnostic but describe general technical features required to support the diagnostic medical procedures represented by these billing codes. Given the nature of CPT codes, there is always some degree of risk for an entity that bills for its services that regulators or other third parties could assert that the CPT codes utilized were not appropriate, and recent regulatory developments have the potential to increase the risk of questions or inquiry regarding our use of a specific CPT code.

Previous wording

The CPT codes used to report remote cardiac monitoring services, including those used to report our iRhythm Services, were drafted by the American Medical Association (“AMA”) in a manufacturer- and specific technology-agnostic manner. Regulators or other third parties could assert that our technology does not support certain diagnostic procedures described by the CPT codes that we currently use to report our iRhythm Services. For example, a regulator or other third party could assert that the Zio AT System cannot support MCT services, which could jeopardize our ability to submit claims for reimbursement for services utilizing our Zio AT System and may require us to evaluate whether we have received any overpayments that must be reported and returned to third-party payors. Certain language in a warning letter we received from FDA on May 25, 2023 could increase the risk of inquiries regarding our historical or current use of CPT code 93229. Consistent with the AMA’s definition of MCT and the technology categorization in FDA’s outpatient cardiac telemetry product code, the Zio AT device is intended to capture and transmit symptomatic and asymptomatic cardiac events and record continuous ECG data for long-term monitoring on adult patients who may be asymptomatic or who may suffer from transient symptoms (e.g., palpitations, shortness of breath, dizziness, light-headedness, pre-syncope, syncope, fatigue, or anxiety), with escalation to the patient’s treating healthcare professional, consistent with the healthcare professional’s prescribed notification criteria, during the monitoring period.

Current wording

The CPT codes used to report remote cardiac monitoring services, including those used to report our iRhythm Services, were drafted by the AMA in a manufacturer- and specific technology-agnostic manner. Regulators' evolving understandings and definitions of certain cardiac monitoring modalities could result in assertions that our technology does not support certain diagnostic procedures described by the CPT codes that we currently use to report our iRhythm Services. For example, although FDA “Product Codes” are created and assigned by FDA to support the agency’s responsibility for regulating medical devices in the framework of device classifications designated under 21 C.F.R. Parts 862-892, Product Codes have the potential to raise questions about expectations for devices. In November 2023, FDA established a new Product Code QYX for “Outpatient Cardiac Telemetry” and retrospectively assigned Product Code QYX to several devices, including Zio AT. FDA’s “Definition” of the “Outpatient Cardiac Telemetry” devices within this Product Code references monitoring data being “transmitted to the prescribing clinician during the monitoring period by a 24/7 attended analysis center after review by a qualified individual,” which may be read as incorporating activities of an IDTF into the device. If our IDTF capabilities and performance do not align with FDA’s interpretation and expectations for Product Code QYX, a regulator or other third party could assert that the Zio AT cannot support mobile cardiac telemetry ("MCT") monitoring services. Any such assertion could jeopardize our ability to obtain clearances with indications and labeling that provide for the scope we planned, and our ability to submit claims for reimbursement for services utilizing Zio AT and may require us to evaluate whether we have received any overpayments that must be reported and returned to third-party payors.

Previous wording

•Our revenue relies on sales of our iRhythm Services, which are currently our only offerings. If our iRhythm Services or future service offerings fail to gain, or lose, market acceptance, our business will suffer.

Current wording

Our revenue relies on orders for our iRhythm Services, which are currently our only offerings. If our iRhythm Services or future service offerings fail to gain, or lose, market acceptance, our business will suffer.

Previous wording

Our industry is subject to rapid change and is significantly affected by new product introductions, results of clinical research, corporate combinations, and other factors. Large competitors in the remote cardiac market include companies that sell standard Holter monitors including GE Healthcare, Philips Healthcare, Mortara Instrument, Inc., Spacelabs Healthcare Inc. and Welch Allyn Holdings, Inc. (now part of Baxter International, Inc.). Additional competitors, such as BioTelemetry, Inc. (now part of Royal Philips), Preventice Solutions, Inc. (now part of Boston Scientific, Inc.), and Bardy Diagnostics, Inc. (now part of Baxter International, Inc.) manufacture remote cardiac monitoring devices and also offer monitoring services. These companies have also developed other patch-based cardiac monitors that have received FDA and foreign regulatory clearances. There are also several small start-up companies trying to compete in the patch-based cardiac monitoring space, as well as several entering the patch-based cardiac monitoring market.

Current wording

Our industry is subject to rapid change and is significantly affected by new product introductions, results of clinical research, corporate combinations, and other factors. Large competitors in the remote cardiac market include companies that sell standard Holter monitors including GE Healthcare, Philips Healthcare, Mortara Instrument, Inc., Spacelabs Healthcare Inc. and Welch Allyn. Additional competitors, such as BioTelemetry, Inc. (now part of Royal Philips), Preventice Solutions, Inc. (now part of Boston Scientific, Inc.), and BardyDx manufacture remote cardiac monitoring devices and also offer monitoring services. These companies have also developed other patch-based cardiac monitors that have received FDA and foreign regulatory clearances. There are also several small start-up companies trying to compete in the patch-based cardiac monitoring space, as well as several entering the patch-based cardiac monitoring market.

Previous wording

Other controls imposed by CMS and commercial payors designed to reduce costs, commonly referred to as “utilization review,” may also affect our operations. Federal law contains numerous provisions designed to ensure that services rendered to CMS patients meet professionally recognized standards and are medically necessary, appropriate for the specific patient, and cost-effective. These provisions include a requirement that a quality improvement organization review a sampling of claims for Medicare beneficiaries to assess the quality of care and appropriateness of the services provided. These quality improvement organizations may deny payment for services or assess fines and have the authority to recommend to CMS that a provider in substantial noncompliance with applicable Medicare requirements and quality standards be excluded from participation in the Medicare program. CMS also engages Medicare Administrative Contractors, Comprehensive Error Rate Testing Contractors, Recovery Audit Contractors, and Unified Program Integrity Contractors to conduct a variety of pre- and post-payment reviews of healthcare providers’ claims, and any aberrant practices or findings from such reviews may result in referrals to the Office of Inspector General, Department of Justice (“DOJ”), or other law enforcement agencies for further investigation and follow-up. As a provider enrolled in federal healthcare programs, we expect to be subject to such audits and claims reviews in the future, which may result in suspensions or other restrictions on our ability to submit claims for our services, payment delays, overpayment recoupments, and claims denials, which would negatively impact our business, financial condition, and results of operations, and may jeopardize our participation in these federal healthcare programs.

Current wording

Other controls imposed by CMS and commercial payors designed to reduce costs, commonly referred to as “utilization review,” may also affect our operations. Federal law contains numerous provisions designed to ensure that services rendered to CMS patients meet professionally recognized standards and are medically necessary, appropriate for the specific patient, and cost-effective. These provisions include a requirement that a quality improvement organization review a sampling of claims for Medicare beneficiaries to assess the quality of care and appropriateness of the services provided. These quality improvement organizations may deny payment for services or assess fines and have the authority to recommend to CMS that a provider in substantial noncompliance with applicable Medicare requirements and quality standards be excluded from participation in the Medicare program. CMS also engages Medicare Administrative Contractors, Comprehensive Error Rate Testing Contractors, Recovery Audit Contractors, and Unified Program Integrity Contractors to conduct a variety of pre- and post-payment reviews of healthcare providers’ claims, and any aberrant practices or findings from such reviews may result in referrals to the Office of Inspector General, DOJ, or other law enforcement agencies for further investigation and follow-up. As a provider enrolled in federal healthcare programs, we expect to be subject to such audits and claims reviews in the future, which may result in suspensions or other restrictions on our ability to submit claims for our services, payment delays, overpayment recoupments, and claims denials, which would negatively impact our business, financial condition, and results of operations, and may jeopardize our participation in these federal healthcare programs.

Previous wording

We are transforming our revenue cycle management function and we may fail to realize the anticipated benefits of these efforts. These activities involve significant time and resources, and our failure to execute these activities efficiently and effectively may cause our revenue and accounts receivable to be delayed or reduced and could have an adverse effect on our business and cause reputational harm.

Current wording

We have continued to evolve our revenue cycle management function in response to increased audit risk of our billing practices by government and commercial payers who are utilizing artificial intelligence ("AI") to review our bills. As part of that evolution, we utilize third-party service providers to support certain activities and these activities involve significant time and resources on our part to train and monitor such third parties. Our failure, or the failure of these third-party service providers, to execute our or their activities efficiently and effectively may cause our revenue and accounts receivable to be delayed or reduced and could have an adverse effect on our business and cause reputational harm.

Previous wording

We are in the midst of a transformation of our revenue cycle management function, which transformation includes the utilization of third-party service providers to support certain activities. The success of this plan depends on our ability to complete the integration of these service providers in a timely manner to scale our operations to facilitate growth opportunities, without adversely affecting current revenues and accounts receivable. If we are not able to successfully achieve these objectives, the anticipated benefits of this transformation may not be realized fully or at all or may take longer to realize than expected. In addition, there is a significant degree of difficulty and management distraction inherent in the process of integrating with service providers. These difficulties include challenges supporting certain operations and activities with more than one service provider, integrating technologies (including IT systems and processes, procedures, policies and operations), and retaining key personnel. These activities are complex and time-consuming and involve delays or additional and unforeseen expenses. The process of transitioning to these service providers, the integration process, and other disruptions may also disrupt our ongoing businesses or cause inconsistencies in standards, controls, procedures, and policies that could adversely affect our relationships with payors, patients, employees, and others. Any failure to execute these activities effectively and efficiently may cause our revenue and accounts receivable to be delayed or reduced and could have an adverse effect on our business and cause reputational harm.

Current wording

We have continued to evolve our revenue cycle management function in response to the increased audit risk of our billing practices as a result of enhanced use of AI by government and commercial payers. As part of that evolution, we utilize third-party service providers to support certain activities and these activities involve significant time and resources on our part to train and monitor such third parties. The success of our efforts to evolve our revenue cycle management function depends on the ability of our service providers to deliver timely and accurate services that will continue to support our business as we scale our operations to facilitate growth opportunities, without adversely affecting current revenues and accounts receivable. If we are not able to successfully achieve these objectives, the anticipated benefits of these efforts may not be realized fully or at all or may take longer to realize than expected. In addition, there is a significant degree of difficulty and management distraction inherent in the process of managing and working with third-party service providers. These difficulties include challenges supporting certain operations and activities with more than one service provider, integrating technologies (including IT systems and processes, procedures, policies and operations), and retaining key personnel. These activities are complex and time-consuming and can involve delays or additional and unforeseen expenses. The process of transitioning to any new or additional providers, the integration process, and other disruptions may also disrupt our ongoing businesses or cause inconsistencies in standards, controls, procedures, and policies that could adversely affect our relationships with payors, patients, employees, and others. Our failure, or the failure of these third-party service providers, to execute our or their activities efficiently and effectively may cause our revenue and accounts receivable to be delayed or reduced and could have an adverse effect on our business and cause reputational harm.

Previous wording

Although our current Zio Systems are comprised of medical devices that have received FDA marketing authorization (510(k) clearance) as well as, with respect to certain devices, regulatory certifications or approvals in the EU, Japan, Switzerland and the UK, we may regularly engage in exploring and implementing product enhancements and in iterative changes to existing products, as well as seek to develop new technology or use of technology for new indications for use. These medical device developments may trigger further regulatory reviews and the results of those reviews are unpredictable.

Current wording

Although our current iRhythm ACM Systems are comprised of medical devices that have received FDA marketing authorization (510(k) clearance) as well as, with respect to certain devices, regulatory certifications or approvals in the EU, Japan, Switzerland and the UK, we may regularly engage in exploring and implementing product enhancements and in iterative changes to existing products, as well as seek to develop new technology or use of technology for new indications for use. These medical device developments may trigger further regulatory reviews, and the results of those reviews are unpredictable.

Previous wording

Before a new medical device or a new intended use for a medical device can be marketed in the United States, a company must first submit an application and receive either 510(k) clearance, De Novo marketing rights, or premarket approval from FDA, unless an exemption applies. All of these processes can be expensive, lengthy, and unpredictable. We may not be able to obtain the clearances or approvals we seek or may be unduly delayed in doing so, which could harm our business. Even if we are granted regulatory clearances or approvals, they may include significant limitations on the indicated uses for the product, which may limit the market for the product. Although we have obtained 510(k) clearances to market our Zio Systems, our clearances can be revoked if safety, efficacy, or significant regulatory compliance problems develop. Even planned changes and improvements to devices and their uses can trigger the need for a new submission. FDA requirements dictate that we must evaluate potential changes and document our decision-making regarding the need for additional submissions and clearances or approvals. Unless effectively planned for in advance, our desired commercial timeline may be impacted.

Current wording

Before a new medical device or a new intended use for a medical device can be marketed in the United States, a company must first submit an application and receive either 510(k) clearance, De Novo marketing rights, or premarket approval from FDA, unless an exemption applies. All of these processes can be expensive, lengthy, and unpredictable. Reductions or changes in agency personnel and resources can add to the unpredictability of this process. We may not be able to obtain the clearances or approvals we seek or may be unduly delayed in doing so, which could harm our business. Even if we are granted regulatory clearances or approvals, they may include significant limitations on the indicated uses for the product, which may limit the market for the product. Although we have obtained 510(k) clearances to market our iRhythm ACM Systems, our clearances can be revoked if safety, efficacy, or significant regulatory compliance problems develop. Even planned changes and improvements to devices and their uses can trigger the need for a new submission. FDA requirements dictate that we must evaluate potential changes and document our decision-making regarding the need for additional submissions and clearances or approvals. Unless effectively planned for in advance, our desired commercial timeline may be impacted.

Previous wording

Significant changes or modifications in design, components, method of manufacture, or the intended use or technological characteristics of our Zio Systems may require new or modified FDA marketing authorization, CE Mark certification in the EU, UKCA Mark certification, Swiss Medical Devices Ordinance (“MedDO”) marketing authorization or Japanese Pharmaceutical and Medical Device Agency (“PMDA”) marketing authorization. In some instances, we have identified a need for, and sought and obtained new, 510(k) clearances from FDA for these changes or modifications.

Current wording

Significant changes or modifications in design, components, method of manufacture, or the intended use or technological characteristics of our iRhythm ACM Systems may require new or modified FDA marketing authorization, CE Mark certification in the EU, UK Conformity Assessed ("UKCA") Mark certification, Swiss Medical Devices Ordinance (“MedDO”) marketing authorization or Japanese Pharmaceutical and Medical Device Agency ("PMDA") marketing authorization. In some instances, we have identified a need for, and sought and obtained new regulatory approvals for these changes or modifications.

Previous wording

As permitted by applicable law, FDA allows device manufacturers to internally analyze and document a decision that a new clearance or approval is viewed by the manufacturer as unnecessary. Accordingly, we have made certain changes and modifications to our Zio Systems in the past that we believe did not require additional clearances or approvals by FDA.

Current wording

As permitted by applicable law, FDA allows device manufacturers to internally analyze and document a decision that a new clearance or approval is viewed by the manufacturer as unnecessary. Accordingly, we have made certain changes and modifications to our iRhythm ACM Systems in the past that we believe did not require additional clearances or approvals by FDA.

Previous wording

Such internal decisions are, however, subject to review by FDA, and may require additional action in the event FDA questions earlier internal decision-making. For example, FDA raised questions in the warning letter issued on May 25, 2023 regarding certain changes and modifications to the Zio AT System for which we did not make 510(k) submissions, and rather documented our analysis in letters to file. We have recently (following, and in alignment with, discussion with FDA) submitted an updated 510(k) to address Zio AT device modifications that were, prior to our receipt of the warning letter, previously documented in letters to file. In October 2024, following, and in alignment with, discussion with FDA, we received FDA 510(k) clearance for these design updates, as well as additional 510(k) clearance relating to further enhancements to our Zio AT device.

Current wording

Such internal decisions are, however, subject to review by FDA, and may require additional action in the event FDA questions earlier internal decision-making. For example, FDA raised questions in the warning letter issued on May 25, 2023 regarding certain changes and modifications to Zio AT for which we did not make 510(k) submissions, and rather documented our analysis in letters to file. We have recently (following, and in alignment with, discussion with FDA) submitted an updated 510(k) to address Zio AT modifications that were, prior to our receipt of the warning letter, previously documented in letters to file. In October 2024, following, and in alignment with, discussion with FDA, we received FDA 510(k) clearance for these design updates, as well as additional 510(k) clearance relating to further enhancements to Zio AT.

Previous wording

In instances where FDA, an EU/UK Notified/Approved Body, the PMDA or the Swiss regulatory body disagrees with our internal analysis and decision that a new or additional approval or marketing authorization or certification is not needed for any such modifications, we may be required to recall and/or stop the distribution of the impacted Zio System and/or correct the labeling for such Zio System. We may be required to submit a new marketing application or certification, which could require additional testing or other supporting data, a redesign of a product, or otherwise impact the provision of services. In these circumstances, the process may require engagement with regulators to resolve concerns and reach a resolution for a product, and we may be subject to significant enforcement actions.

Current wording

In instances where FDA, an EU/UK Notified/Approved Body, the PMDA or the Swiss regulatory body disagrees with our internal analysis and decision that a new or additional approval or marketing authorization or certification is not needed for any such modifications, we may be required to recall and/or stop the distribution of the impacted iRhythm ACM System and/or correct the labeling for such iRhythm ACM System. We may be required to submit a new marketing application or certification, which could require additional testing or other supporting data, a redesign of a product, or otherwise impact the provision of services. In these circumstances, the process may require engagement with regulators to resolve concerns and reach a resolution for a product, and we may be subject to significant enforcement actions.

Previous wording

As a manufacturer of medical devices, we are subject to extensive regulation and related compliance requirements. Noncompliance and even allegations of noncompliance with these wide-ranging requirements may subject us to high compliance costs to remediate or defend against allegations of noncompliance, as well as enforcement action from U.S. federal or state regulators and enforcement authorities. Regulators may interpret or apply reportability or field action requirements differently than a company, which can result in enforcement risk. Actions to which a company may be subject could include the issuance of warning letters, adverse publicity, seizures, prohibitions on product sales, recalls, and civil and criminal penalties, any one of which could significantly impact our manufacturing supply and provision of services and impair our financial results. Failure to maintain full compliance with the requirements of the Quality System Regulation (“QSR”), also known as 21 CFR Part 820, EU Standards (presently the Medical Devices Regulations (“EU MDR”)), UK Medical Device Regulations (“UK MDR”), Japanese medical device Quality Management System (“Japanese QMS”) and the Swiss MedDO could result in similar disruptions in these markets. Furthermore, even if we adhere to regulatory standards and expectations in our corrective actions, the public nature of such actions can result in broader negative publicity and perceptions, which could harm our reputation.

Current wording

As a manufacturer of medical devices, we are subject to extensive regulation and related compliance requirements. Noncompliance and even allegations of noncompliance with these wide-ranging requirements may subject us to high compliance costs to remediate or defend against allegations of noncompliance, as well as enforcement action from U.S. federal or state regulators and enforcement authorities. Regulators may interpret or apply reportability or field action requirements differently than a company, which can result in enforcement risk. Actions to which a company may be subject could include the issuance of warning letters, adverse publicity, seizures, prohibitions on product sales, recalls, and civil and criminal penalties, any one of which could significantly impact our manufacturing supply and provision of services and impair our financial results. Failure to maintain full compliance with the requirements of FDA's QSR, now referred to as the Quality Management System Regulation or "QMSR", the EU Medical Device Regulation (formally Regulation (EU) 2017/745 or "EU MDR"), the UK Medical Devices Regulations (formally the Medical Devices Regulations 2002 (SI 2002/618) or "UK MDR"), Japan's Quality Management System Ordinance ("Japanese QMS") and the Swiss Medical Devices Ordinance ("MedDO") could result in similar disruptions in these markets. Furthermore, even if we adhere to regulatory standards and expectations in our corrective actions, the public nature of such actions can result in broader negative publicity and perceptions, which could harm our reputation.

Previous wording

Our design and manufacturing facilities and processes and those of certain third-party suppliers are subject to FDA and state, as well as EU, UK, Japanese and Swiss regulatory inspections for compliance with various medical device regulations and standards, including FDA, EU MDR, UK MDR, Japanese QMS and Swiss MedDO requirements. Developing and maintaining a compliant quality system is time consuming and investment intensive. Requirements and standards may change and evolve over time, and we will need to adapt. For example, FDA has issued final regulations on updates to the QSR which will largely align with the ISO 13485 standard, and these are set to take effect February 2, 2026.

Current wording

Our design and manufacturing facilities and processes and those of certain third-party suppliers are subject to FDA and state, as well as EU, UK, Japanese and Swiss regulatory inspections for compliance with various medical device regulations and standards, including FDA, EU MDR, UK MDR, Japanese QMS and Swiss MedDO requirements. Developing and maintaining a compliant quality system is time consuming and investment intensive. Requirements and standards may change and evolve over time, and we will need to adapt. For example, FDA has issued final regulations on updates to FDA's QMSR, which harmonizes key areas of quality management for device manufacturers in alignment with global regulatory requirements including ISO 13485:2016 and clause 3 of ISO 9000:2015. These regulations took effect on February 2, 2026. While FDA's QMSR is now in effect, the transition presents some uncertainties relative to FDA practices and expectations in upcoming inspections of device quality systems.

Previous wording

We are required to file various reports with FDA, as well as EU, UK, Japanese and Swiss regulators, including reports required by each jurisdiction’s adverse event, certain malfunctions, and field action reporting regulations. These reports are often required if our Zio System may have caused or contributed to a death or serious injury or malfunctioned in a way that would likely cause or contribute to a death or serious injury if the malfunction were to recur. They may also be reasonable, necessary, or prudent for a range of other reasons relating to the importance of gathering information in the post marketing setting and managing risk throughout the product lifecycle, or to address requests from regulators to increase or expand the scope of reporting. An increase in the reporting of events associated with the use of our products and services from us or others and any delays to the filing of reports may increase regulator and public scrutiny, especially given that these reports are typically publicly available information in most jurisdictions, including the United States, which could harm our business.

Current wording

We are required to file various reports with FDA, as well as EU, UK, Japanese and Swiss regulators, including reports required by each jurisdiction’s adverse event, certain malfunctions, and field action reporting regulations. These reports are often required if our iRhythm ACM System may have caused or contributed to a death or serious injury or malfunctioned in a way that would likely cause or contribute to a death or serious injury if the malfunction were to recur. They may also be reasonable, necessary, or prudent for a range of other reasons relating to the importance of gathering information in the post marketing setting and managing risk throughout the product lifecycle, or to address requests from regulators to increase or expand the scope of reporting. An increase in the reporting of events associated with the use of our products and services from us or others and any delays to the filing of reports may increase regulator and public scrutiny, especially given that these reports are typically publicly available information in most jurisdictions, including the United States, which could harm our business.

Previous wording

If we initiate a field action (whether a “correction” made relative to a device that remains in the field, which could be through a labeling or software update, or “removal” or “recall” and return of that device to us, or field advisory notices) to reduce a risk to health posed by our Zio System, we would be required to report the Correction or Removal to FDA and, in many cases, similar reports to other regulatory agencies.

Current wording

If we initiate a field action (whether a “correction” made relative to a device that remains in the field, which could be through a labeling or software update, or “removal” or “recall” and return of that device to us, or field advisory notices) to reduce a risk to health posed by our iRhythm ACM System, we would be required to report the correction or removal to FDA and, in many cases, similar reports to other regulatory agencies.

Previous wording

•The Customer Advisory Notice we initiated September 28, 2022 to Zio AT customers, and our reports to FDA under 21 C.F.R. Part 806, regarding a Zio AT labeling correction involving additions and modifications to the Zio AT labeling precautions relating to the device’s maximum transmission limits during wear, and also to the need for healthcare providers to complete registration to initiate monitoring services. FDA classified this field action as a Class II Recall following our initial 806 report and although we believe wehave completed the distribution of the Advisory Notice to our identified impacted customers, andwe requested the closure of this field action in March 2023, the status remains open in the public FDA recall database. and FDA has not yet confirmed the termination or completion of this recall to us.

Current wording

•The Customer Advisory Notice we initiated September 28, 2022 to Zio AT customers, and our reports to FDA under 21 C.F.R. Part 806, regarding a Zio AT labeling correction involving additions and modifications to Zio AT labeling precautions relating to the device’s maximum transmission limits during wear, and also to the need for healthcare providers to complete registration to initiate monitoring services. FDA classified this field action as a Class II Recall following our initial 806 report and although we believe wehave completed the distribution of the Advisory Notice to our identified impacted customers andrequested the closure of this field action in March 2023, the status remains open in the public FDA recall database, and FDA has not yet confirmed the termination or completion of this recall to us.

Previous wording

•Our May 25, 2023 receipt of a warning letter from FDA alleging non-conformities to regulations for medical devices, including medical device reporting requirements, relating to our Zio AT System and medical device quality system requirements. We submitted a timely response to FDA in June 2023 and are continuing to work with the agency to address the issues outlined in the warning letter, including specific dialogue on key topics and our planned path forward. As part of this dialogue we agreed to make two 510(k) submissions relating to the Zio AT, and on October 21, 2024, we were granted FDA clearance for one 510(k) encompassing design updates that had previously been documented through letters to file and on October 30, 2024 we were granted FDA clearance on a second 510(k) submission related to design modifications and labeling updates for the Zio AT device.

Current wording

•Our May 25, 2023 receipt of a warning letter from FDA alleging non-conformities to regulations for medical devices, including medical device reporting requirements, relating to our Zio AT and medical device quality system requirements. We submitted a timely response to FDA in June 2023 and are continuing to work with the agency to address the issues outlined in the warning letter, including specific dialogue on key topics and our planned path forward. As part of this dialogue we agreed to make two 510(k) submissions relating to Zio AT. On October 21, 2024, we were granted FDA clearance for one 510(k) encompassing design updates that had previously been documented through letters to file. On October 30, 2024 we were granted FDA clearance on a second 510(k) submission related to design modifications and labeling updates for Zio AT.

Previous wording

•Our retrospective submission of certain Medical Device Reports in the fourth quarter of 2023, as part of our commitments following the FDA 483 observations and FDA warning letter issued on May 25, 2023.

Current wording

•Our retrospective submission of certain Medical Device Reports in the fourth quarter of 2023, as part of our commitments following FDA 483 observations and the FDA warning letter issued on May 25, 2023.

Previous wording

Our Zio Systems and iRhythm Services are not intended to be prescribed or ordered for use as an emergency system. They are not intended for critical care patients or patients suspected of life-threatening arrhythmias who require inpatient or emergency ECG monitoring. Given the nature of arrhythmias and the patient population for which our iRhythm Services are ordered by physicians, in which there may be several health conditions present, there are instances in which a patient may experience a medical event during the wear period of a Zio System. In some cases, it may be medically and logistically challenging to obtain information sufficient to definitively determine all contributing factors to an event. In some instances, we may receive initial reports of complaints from the qualified cardiac technicians or through our customer service representatives. The initial reports of these non-physicians are likely to contain information that requires verification and further investigation.

Current wording

Our iRhythm ACM Systems and iRhythm Services are not intended to be prescribed or ordered for use as an emergency system. They are not intended for critical care patients or patients suspected of life-threatening arrhythmias who require inpatient or emergency ECG monitoring. Given the nature of arrhythmias and the patient population for which our iRhythm Services are ordered by physicians, in which there may be several health conditions present, there are instances in which a patient may experience a medical event during the wear period of an iRhythm ACM System. In some cases, it may be medically and logistically challenging to obtain information sufficient to definitively determine all contributing factors to an event. In some instances, we may receive initial reports of complaints from the qualified cardiac technicians or through our customer service representatives. The initial reports of these non-physicians are likely to contain information that requires verification and further investigation.

Previous wording

In addition, even though our services and their associated devices are not intended to recognize, detect, or initiate response to terminal end-of-life events, a patient may nevertheless be wearing a Zio device when they experience such an event. Given the functionality of our technology and our services, we may become aware of data reflecting a non-survivable, end-of-life cardiac event. We or others (such as healthcare professionals, patients, or family members) may report such events even where it does not appear to us that our device caused or could have prevented an end-of-life event. Given the structure of such reporting to FDA the full medical context is not generally available to the public, which may cause additional scrutiny, questions, or concerns regarding our products and services. For example, in the fourth quarter of 2023, as part of our commitments following the FDA Form 483 observations and warning letter issued on May 25, 2023, we retrospectively submitted certain Medical Device Reports to FDA, and the publicly available information in these reports may receive additional scrutiny.

Current wording

In addition, even though our services and their associated devices are not intended to recognize, detect, or initiate response to terminal end-of-life events, a patient may nevertheless be wearing a Zio device when they experience such an event. Given the functionality of our technology and our services, we may become aware of data reflecting a non-survivable, end-of-life cardiac event. We or others (such as healthcare professionals, patients, or family members) may report such events even where it does not appear to us that our device caused or could have prevented an end-of-life event. Given the structure of such reporting to FDA the full medical context is not generally available to the public, which may cause additional scrutiny, questions, or concerns regarding our products and services. For example, in the fourth quarter of 2023, as part of our commitments following FDA Form 483 observations and the FDA warning letter issued on May 25, 2023, we retrospectively submitted certain Medical Device Reports to FDA, and the publicly available information in these reports may receive additional scrutiny.

Previous wording

We are subject to FDA requirements to investigate complaints about our Zio Systems. If we do not effectively manage and monitor our complaint-handling procedures, we may be subject to regulatory enforcement action, litigation risks, and risk of negative publicity.

Current wording

We are subject to FDA requirements to investigate complaints about our iRhythm ACM Systems. If we do not effectively manage and monitor our complaint-handling procedures, we may be subject to regulatory enforcement action, litigation risks, and risk of negative publicity.

Previous wording

•key components of our Zio Systems are provided by a sole or single supplier or limited number of suppliers, and we do not maintain large inventory levels of these components; if we experience a shortage or quality issues in any of these components, we would need to identify and qualify new supply sources, which could increase our expenses and result in manufacturing delays;

Current wording

•key components of our iRhythm ACM Systems are provided by a sole or single supplier or limited number of suppliers, and we do not maintain large inventory levels of these components; if we experience a shortage or quality issues in any of these components, we would need to identify and qualify new supply sources, which could increase our expenses and result in manufacturing delays;

Previous wording

•the extent to which we become dependent upon others for the manufacture of our Zio Systems which could adversely affect our future profit margins and our ability to market our iRhythm Services;

Current wording

•the extent to which we become dependent upon others for the manufacture of our iRhythm ACM Systems which could adversely affect our future profit margins and our ability to market our iRhythm Services;

Previous wording

•global demand and supply factors concerning commodity components common to all electronic circuits, including Zio Systems, could result in shortages that manifest as extended lead times for circuit boards, which could limit our ability to sustain and/or grow our business;

Current wording

•global demand and supply factors concerning commodity components common to all electronic circuits, including iRhythm ACM Systems, could result in shortages that manifest as extended lead times for circuit boards, which could limit our ability to sustain and/or grow our business;

Previous wording

If we were unable to successfully manufacture our Zio Systems in sufficient quantities, or to maintain sufficient capacity to provide our iRhythm Services, it would materially harm our business.

Current wording

If we were unable to successfully manufacture our iRhythm ACM Systems in sufficient quantities, or to maintain sufficient capacity to provide our iRhythm Services, it would materially harm our business.

Previous wording

We depend on third-party vendors for the supply and manufacture of certain components of our Zio Systems, as well as for other aspects of our operations.

Current wording

We depend on third-party vendors for the supply and manufacture of certain components of our iRhythm ACM Systems, as well as for other aspects of our operations.