iRhythm Holdings, Inc.

Previous wording

During the three months ended March 31, 2026, we received approximately 26% of our total revenue from the Medicare program through the Centers for Medicare & Medicaid Services ("CMS"). The Medicare program is administered by CMS, which imposes extensive and detailed requirements on diagnostic services providers, including IDTFs. These requirements include, but are not limited to, rules that govern how we structure our relationships with physicians, how we operate our IDTFs and market our ambulatory cardiac services ("iRhythm Services"), when we may perform diagnostic tests, and how and when we submit reimbursement claims. Our failure to comply with the applicable Medicare rules and requirements could result in discontinuation of our reimbursement under the Medicare program, a requirement to return funds already paid to us, civil monetary penalties, criminal penalties, and/or exclusion from the Medicare program, which would have a material adverse impact on our reputation, business, and results of operations.

Current wording

During the three and six months ended June 30, 2026, we received approximately 26% of our total revenue from the Medicare program through the Centers for Medicare & Medicaid Services ("CMS"). The Medicare program is administered by CMS, which imposes extensive and detailed requirements on diagnostic services providers, including IDTFs. These requirements include, but are not limited to, rules that govern how we structure our relationships with physicians, how we operate our IDTFs and market our ambulatory cardiac services ("iRhythm Services"), when we may perform diagnostic tests, and how and when we submit reimbursement claims. Our failure to comply with the applicable Medicare rules and requirements could result in discontinuation of our reimbursement under the Medicare program, a requirement to return funds already paid to us, civil monetary penalties, criminal penalties, and/or exclusion from the Medicare program, which would have a material adverse impact on our reputation, business, and results of operations.

Previous wording

Finally, government and commercial payors have and may, in the future, consider healthcare policies and proposals intended to limit or reduce perceived increases in healthcare costs, including those that could significantly affect reimbursement for healthcare products such as our systems and services. These policies have included, and may in the future include: basing reimbursement policies and rates on clinical outcomes, the comparative effectiveness, and costs, of different treatment technologies and services, changes in risk adjustment weights or the criteria required to support risk adjustment eligible diagnoses in Medicare Advantage, as well as other measures. For example, from time to time CMS or Medicare Administrative Contractors may develop National Coverage Determinations, Local Coverage Determinations (“LCDs”), or similar policies dictating the conditions for coverage and reimbursement of our iRhythm Services. For instance, in September 2025, Noridian Healthcare Solutions, LLC, Palmetto GBA, LLC, and CGS Administrators, LLC each published proposed LCDs regarding “Temporary Nontherapeutic Ambulatory Cardiac Monitoring Devices.” These proposed LCDs seek to outline the circumstances in which ACM is considered reasonable and necessary for Medicare purposes, device requirements, and associated coverage limitations. The proposed LCDs were subject to a public comment period that concluded in November 2025, in which iRhythm and other stakeholders had the opportunity to inform consideration of whether, and in what form, the LCDs might be adopted. The adoption of the proposed LCDs, or any other developments in the Medicare coverage policies on which the industry has come to rely, could necessitate changes to our business model, methods of operation, billing processes, and related compliance controls. Future significant changes in the healthcare systems in the United States or elsewhere could also have a negative impact on the demand for our current and future products and services. These include changes that may limit coverage or reduce reimbursement rates for our products and changes that may be proposed or implemented by the current or future laws or regulations.

Current wording

Finally, government and commercial payors have and may, in the future, consider healthcare policies and proposals intended to limit or reduce perceived increases in healthcare costs, including those that could significantly affect reimbursement for healthcare products such as our systems and services. These policies have included, and may in the future include: basing reimbursement policies and rates on clinical outcomes, the comparative effectiveness, and costs, of different treatment technologies and services, changes in risk adjustment weights or the criteria required to support risk adjustment eligible diagnoses in Medicare Advantage, as well as other measures. For example, from time to time CMS or Medicare Administrative Contractors may develop National Coverage Determinations, Local Coverage Determinations (“LCDs”), or similar policies dictating the conditions for coverage and reimbursement of our iRhythm Services. For instance, in September 2025, Noridian Healthcare Solutions, LLC, Palmetto GBA, LLC, and CGS Administrators, LLC each published proposed LCDs regarding “Temporary Nontherapeutic Ambulatory Cardiac Monitoring Devices.” These proposed LCDs sought to outline the circumstances in which ACM is considered reasonable and necessary for Medicare purposes, device requirements, and associated coverage limitations. As proposed, the LCDs would have, among other things, applied attended monitoring requirements, such as 24-hour monitoring station staffing, to Holter monitors and other device types for which such requirements had not previously been required. In June 2026, the LCDs were finalized. Among other clarifications, the final LCDs eliminated the requirement to apply attended monitoring to Holter monitors. LCDs, or any other developments in the Medicare coverage policies on which the industry has come to rely, can necessitate changes to our business model, methods of operation, billing processes, and related compliance controls. Future significant changes in the healthcare systems in the United States or elsewhere could also have a negative impact on the demand for our current and future products and services. These include changes that may limit coverage or reduce reimbursement rates for our products and changes that may be proposed or implemented by the current or future laws or regulations.

Previous wording

We have and are continuing to incorporate AI, including machine learning (including generative and predictive) algorithms, in certain of our products, services and internal operations, including in our MCT monitoring services services with our Zio AT, which is intended to enhance their operation and effectiveness internally and for physicians and patients. Our research and development of such technology remains ongoing. AI innovation presents risks and challenges that could impact our business. Our use of new and evolving technologies such as AI that we integrate into our products, services and internal operations may cause us to experience brand or reputational harm, competitive harm, legal liability, new or enhanced governmental or regulatory scrutiny, and to incur additional costs to resolve any issues stemming from our usage. As with many innovations, AI presents risks and challenges that could undermine or slow its adoption, and therefore harm our business to the extent we increase our reliance on AI in the future. Moreover, our competitors may introduce AI technologies and features into their products and services that achieve greater market acceptance than ours. Additionally, AI algorithms may be flawed or datasets may be insufficient or contain biased information resulting in perceived or actual negative outcomes. AI solutions may be controversial because of their impact or perceived impact on human rights, privacy, employment, or other social, economic, or political issues. If we are unable to develop effective internal policies and frameworks relating to the responsible development and use of AI models and systems, we may experience brand, reputational, and/or competitive harm, or could face legal liability. In a healthcare context, model drift, explainability limits and reliance on de-identified or synthetic data that may be re-identifiable can exacerbate these risks. If the output that AI algorithms assist in producing are or are alleged to be inaccurate, deficient, or biased, our business, financial condition, and results of operations may be adversely affected. Developing, testing and deploying AI systems may also increase the costs of our product offerings due to the nature of the computing costs involved in such systems, which could impact our revenue and adversely affect our business and operating results.

Current wording

We have and are continuing to incorporate AI, including machine learning (including generative and predictive) algorithms, in certain of our products, services and internal operations, including in our MCT monitoring services with our Zio AT, which is intended to enhance their operation and effectiveness internally and for physicians and patients. Our research and development of such technology remains ongoing. AI innovation presents risks and challenges that could impact our business. Our use of new and evolving technologies such as AI that we integrate into our products, services and internal operations may cause us to experience brand or reputational harm, competitive harm, legal liability, new or enhanced governmental or regulatory scrutiny, and to incur additional costs to resolve any issues stemming from our usage. As with many innovations, AI presents risks and challenges that could undermine or slow its adoption, and therefore harm our business to the extent we increase our reliance on AI in the future. Moreover, our competitors may introduce AI technologies and features into their products and services that achieve greater market acceptance than ours. Additionally, AI algorithms may be flawed or datasets may be insufficient or contain biased information resulting in perceived or actual negative outcomes. AI solutions may be controversial because of their impact or perceived impact on human rights, privacy, employment, or other social, economic, or political issues. If we are unable to develop effective internal policies and frameworks relating to the responsible development and use of AI models and systems, we may experience brand, reputational, and/or competitive harm, or could face legal liability. In a healthcare context, model drift, explainability limits and reliance on de-identified or synthetic data that may be re-identifiable can exacerbate these risks. If the output that AI algorithms assist in producing are or are alleged to be inaccurate, deficient, or biased, our business, financial condition, and results of operations may be adversely affected. Developing, testing and deploying AI systems may also increase the costs of our product offerings due to the nature of the computing costs involved in such systems, which could impact our revenue and adversely affect our business and operating results.

Previous wording

taken novel steps in recent years to regulate MCT devices—including Zio AT—through administrative actions including development of Product Code QYX and assignment of that Product Code to certain devices already on the market, and also to applicants seeking 510(k) clearance for devices used in MCT monitoring services. FDA’s inclusion in the Product Code’s “Definition” of “Outpatient Cardiac Telemetry” devices certain activities in the purview of IDTFs and other monitoring locations presents the potential for these activities to be viewed as a component of the device subject to direct FDA oversight. It remains unclear how FDA will continue to interpret and enforce the device requirements for devices that FDA assigns to Product Code QYX.

Current wording

Healthcare laws and regulations, and interpretations of the same, change frequently and may change significantly in the future. We may not be able to adapt our operations to address every new regulation or interpretation, and new regulations or interpretations may adversely affect our business. For example, FDA has taken novel steps in recent years to regulate MCT devices—including Zio AT—through administrative actions including development of Product Code QYX and assignment of that Product Code to certain devices already on the market, and also to applicants seeking 510(k) clearance for devices used in MCT monitoring services. FDA’s inclusion in the Product Code’s “Definition” of “Outpatient Cardiac Telemetry” devices certain activities in the purview of IDTFs and other monitoring locations presents the potential for these activities to be viewed as a component of the device subject to direct FDA oversight. It remains unclear how FDA will continue to interpret and enforce the device requirements for devices that FDA assigns to Product Code QYX.

Previous wording

Some of these legislative and regulatory proposals have manifested to date in the form of specific tariff proposals, and actions to reduce the size of the federal government, including large-scale reductions in force at FDA. The loss of key personnel at FDA, including those in leadership positions, is likely to impact the operations at FDA, which could result in, among other things, delays or limitations on our ability to obtain guidance from FDA on our products, longer review times, and delays in obtaining regulatory approvals. The escalating global economic competition and trade tensions among the United States and its trading partners could have an adverse effect on our business, results of operations, financial condition and cash flows, and there is risk of additional tariffs and other kinds of restrictions. The current administration also has issued, and is expected to continue relying upon, executive orders to address a wide range of policy areas, some of which may impact our business. Examples of executive orders that have already been issued on public health and healthcare topics include orders seeking to promote healthcare price transparency, deliver most-favored-nation pricing for prescription drugs to patients and facilitate direct-to-consumer drug sales, promote domestic production of pharmaceutical products, and expand access to in vitro fertilization. Such political developments may require us to allocate significant time, resources, and expense to modifying our policies and procedures, processes, systems, and practices to ensure compliance or adapt to the new regulatory climate, particularly to the extent such actions are subject to protracted and uncertain legal challenges. To the extent changes in the political environment have a negative impact on us or on our markets, our business, results of operation, and financial condition could be materially and adversely affected in the future.

Current wording

Some of these legislative and regulatory proposals have manifested to date in the form of specific tariff proposals, and actions to reduce the size of the federal government, including large-scale reductions in force at FDA. The loss of key personnel at FDA, including those in leadership positions, is likely to impact the operations at FDA, which could result in, among other things, delays or limitations on our ability to obtain guidance from FDA on our products, longer review times, and delays in obtaining regulatory approvals. The escalating global economic competition and trade tensions among the United States and its trading partners could have an adverse effect on our business, results of operations, financial condition and cash flows, and there is risk of additional tariffs and other kinds of restrictions. The current administration also has issued, and is expected to continue relying upon, executive orders to address a wide range of policy areas, some of which may impact our business. Examples of executive orders that have already been issued on public health and healthcare topics include orders seeking to promote healthcare price transparency, deliver most-favored-nation pricing for prescription drugs to patients and facilitate direct-to-consumer drug sales, promote domestic production of pharmaceutical products, and expand access to in vitro fertilization. Such political developments may require us to allocate significant time, resources, and expense to modifying our policies and procedures, processes, systems, and practices to ensure compliance or adapt to the new regulatory climate, particularly to the extent such actions are subject to protracted and uncertain legal challenges. To the extent changes in the political environment have a negative impact on us or on our markets, our business, results of operations, and financial condition could be materially and adversely affected in the future.

Previous wording

Further, we recognize a portion of our revenue from non-contracted third-party commercial payors. For example, during the three months ended March 31, 2026, revenue from non-contracted third-party commercial payors accounted for approximately 6% of our total revenue. We have limited visibility as to when we will receive payment for our iRhythm Services with non-contracted payors and we or our third party billing vendors must appeal any negative payment decisions, which often delays collections further. Additionally, a portion of the revenue from non-contracted payors is received from patient co-pays, which we may not receive for several months following delivery of service or may not receive at all. For revenue related to non-contracted payors, we estimate an average collection rate based on factors including historical cash collections. Subsequent adjustments, if applicable, are recorded as an adjustment to revenue. Fluctuations in revenue may make it difficult for us, research analysts, and investors to accurately forecast our revenue and operating results or to assess our actual performance. If our revenue or operating results fall below expectations, the price of our common stock would likely decline.

Current wording

Further, we recognize a portion of our revenue from non-contracted third-party commercial payors. For example, during the three and six months ended June 30, 2026, revenue from non-contracted third-party commercial payors accounted for approximately 6% of our total revenue. We have limited visibility as to when we will receive payment for our iRhythm Services with non-contracted payors and we or our third party billing vendors must appeal any negative payment decisions, which often delays collections further. Additionally, a portion of the revenue from non-contracted payors is received from patient co-pays, which we may not receive for several months following delivery of service or may not receive at all. For revenue related to non-contracted payors, we estimate an average collection rate based on factors including historical cash collections. Subsequent adjustments, if applicable, are recorded as an adjustment to revenue. Fluctuations in revenue may make it difficult for us, research analysts, and investors to accurately forecast our revenue and operating results or to assess our actual performance. If our revenue or operating results fall below expectations, the price of our common stock would likely decline.

Previous wording

We have incurred net losses since our inception in September 2006. We generated net losses of $13.9 million and $30.7 million during the three months ended March 31, 2026, and 2025, respectively. As of March 31, 2026, we had an accumulated deficit of $817.4 million. We have financed our operations to date primarily through private and public offerings of equity and convertible debt securities and revenue generated by prescriptions of our iRhythm Services. We have and expect to continue to incur significant research and development, sales and marketing, regulatory, and other expenses as we expand our marketing efforts to increase the prescription of our iRhythm Services, expand existing relationships with physicians, obtain regulatory clearances or approvals for our current or future services and related devices, conduct clinical trials on our existing and future services, and develop new services or add new features to our existing iRhythm Services. We also expect that our general and administrative expenses will continue to increase due to, among other things, the operational and regulatory burdens applicable to medical service providers that are public companies. As a result, we may continue to incur operating losses in the future. These losses, among other things, may have an adverse effect on our stockholders’ equity and the value of our common stock.

Current wording

We have incurred net losses since our inception in September 2006. We generated net losses of $0.4 million and $14.2 million during the three months ended June 30, 2026 and 2025, respectively, and net losses of $14.3 million and $44.9 million during the six months ended June 30, 2026 and 2025, respectively. As of June 30, 2026, we had an accumulated deficit of $817.8 million. We have financed our operations to date primarily through private and public offerings of equity and convertible debt securities and revenue generated by prescriptions of our iRhythm Services. We have and expect to continue to incur significant research and development, sales and marketing, regulatory, and other expenses as we expand our marketing efforts to increase the prescription of our iRhythm Services, expand existing relationships with physicians, obtain regulatory clearances or approvals for our current or future services and related devices, conduct clinical trials on our existing and future services, and develop new services or add new features to our existing iRhythm Services. We also expect that our general and administrative expenses will continue to increase due to, among other things, the operational and regulatory burdens applicable to medical service providers that are public companies. As a result, we may continue to incur operating losses in the future. These losses, among other things, may have an adverse effect on our stockholders’ equity and the value of our common stock.

Previous wording

Our ability to use our net operating losses (“NOLs”) to offset future taxable income may be subject to certain limitations which could subject our business to higher tax liability. We may be limited in the portion of NOL carryforwards that we can use in the future to offset taxable income for U.S. federal and state income tax purposes, and federal tax credits to offset federal tax liabilities. Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the “Code”), and similar state law provisions, limit the use of NOLs and tax credits after a cumulative change in corporate ownership of more than 50% occurs within a three-year period. Sections 382 and 383 of the Code place a formula limit on how much NOLs and tax credits a corporation can use in a tax year after a change in ownership. Avoiding an ownership change is generally beyond our control. We could experience an ownership change that might limit our use of NOLs and tax credits in the future. In addition, realization of deferred tax assets, including NOL carryforwards, depends upon our future earnings in the applicable tax jurisdictions. If we have insufficient future taxable income in the applicable tax jurisdiction for any reason, including as a result of any future corporate reorganization or restructuring activities, we may be limited in our ability to utilize some or all of our net operating losses to offset such income and reduce our tax liability in that jurisdiction. See Note 9, Income Taxes, to our unaudited consolidated financial statements included herein for additional information.

Current wording

Our ability to use our net operating losses (“NOLs”) to offset future taxable income may be subject to certain limitations which could subject our business to higher tax liability. We may be limited in the portion of NOL carryforwards that we can use in the future to offset taxable income for U.S. federal and state income tax purposes, and federal tax credits to offset federal tax liabilities. Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the “Code”), and similar state law provisions, limit the use of NOLs and tax credits after a cumulative change in corporate ownership of more than 50% occurs within a three-year period. Sections 382 and 383 of the Code place a formula limit on how much NOLs and tax credits a corporation can use in a tax year after a change in ownership. Avoiding an ownership change is generally beyond our control. We could experience an ownership change that might limit our use of NOLs and tax credits in the future. In addition, realization of deferred tax assets, including NOL carryforwards, depends upon our future earnings in the applicable tax jurisdictions. If we have insufficient future taxable income in the applicable tax jurisdiction for any reason, including as a result of any future corporate reorganization or restructuring activities, we may be limited in our ability to utilize some or all of our net operating losses to offset such income and reduce our tax liability in that jurisdiction. See Note 9, Income Taxes, to our unaudited condensed consolidated financial statements included herein for additional information.

Previous wording

We are involved in legal proceedings related to securities litigation, patent litigation and other matters and may become involved in other legal proceedings that arise from time to time in the future. For example, as discussed further in Note 7, Commitments and Contingencies, to our unaudited consolidated financial statements included herein, a putative securities class action lawsuit was filed against iRhythm Technologies and certain of its then current and former officer alleging violations of Sections 10(b) and 20(a) of the Exchange Act and SEC Rule 10b-5 promulgated thereunder, and two patent lawsuits have been filed against iRhythm Technologies by companies affiliated with Baxter International.

Current wording

We are involved in legal proceedings related to cybersecurity litigation and other matters and may become involved in other legal proceedings that arise from time to time in the future. For example, as discussed further in Note 7, Commitments and Contingencies, to our unaudited condensed consolidated financial statements included herein, we recently settled a putative securities class action lawsuit filed against iRhythm Technologies and certain of its then current and former officers alleging violations of Sections 10(b) and 20(a) of the Exchange Act and SEC Rule 10b-5 promulgated thereunder, and we recently settled two patent lawsuits that had been filed against iRhythm Technologies by companies affiliated with Baxter.

Previous wording

Any claims against us or our subsidiaries, whether meritorious or not, can be time-consuming, result in costly litigation, be harmful to our reputation, require significant management attention, and divert significant resources. In addition, the expense of litigation and the timing of this expense from period to period are difficult to estimate and subject to change. Litigation and other claims are subject to inherent uncertainties and management’s view of these matters may change in the future. Given the uncertain nature of legal proceedings generally, we are not able in all cases to estimate the amount or range of loss that could result from an unfavorable outcome. We could incur judgments or enter into settlements of claims that could have a material adverse effect on our results of operations in any particular period.

Current wording

Any claims against us or our subsidiaries, whether meritorious or not, can be time-consuming, result in costly litigation, be harmful to our reputation, require significant management attention, and divert significant resources. In addition, the expense of litigation and the timing of this expense from period to period are difficult to estimate and subject to change. Litigation and other claims are subject to inherent uncertainties and management’s view of these matters may change in the future. Given the uncertain nature of legal proceedings generally, we are not able in all cases to estimate the amount or range of loss that could result from an unfavorable outcome. We could incur judgments or enter into settlements of claims that could have a material adverse effect on our results of operations, cash flows, and financial condition in any particular period, including as a result of the timing and amount of settlement payments and the availability and timing of any related insurance recoveries.

Previous wording

In addition, healthcare companies are subject to numerous investigations and inquiries by various governmental agencies. For example, as discussed further in Note 7, Commitments and Contingencies, to our unaudited consolidated financial statements included herein, in March 2021, we received a grand jury subpoena from the U.S. Attorney’s Office for the Northern District of California requesting information related to communications with FDA and our iRhythm ACM Systems, and, in September 2021, received a subpoena requesting additional information. On April 4, 2023, we received a Subpoena Duces Tecum from the Consumer Protection Branch, Civil Division of the DOJ, requesting production of various documents regarding our products and services. In addition, on May 25, 2023, we received a warning letter from FDA, which resulted from the inspection of our facility located in Cypress, California that concluded in August 2022. The warning letter alleged non-conformities to regulations for medical devices, including medical device reporting requirements, relating to our Zio AT System and medical device quality system requirements. On July 15, 2024, FDA initiated inspections of our Cypress and San Francisco facilities. We received 483 observations at the close of the inspection. On December 12, 2025, we received a civil investigative demand from DOJ's Civil Division's Commercial Litigation Branch seeking information and documents related to Zio AT and our associated claims for reimbursement. We have cooperated, and are continuing to cooperate, fully in connection with these matters.

Current wording

In addition, healthcare companies are subject to numerous investigations and inquiries by various governmental agencies. For example, as discussed further in Note 7, Commitments and Contingencies, to our unaudited condensed consolidated financial statements included herein, in March 2021, we received a grand jury subpoena from the U.S. Attorney’s Office for the Northern District of California requesting information related to communications with FDA and our iRhythm ACM Systems, and, in September 2021, received a subpoena requesting additional information. On April 4, 2023, we received a Subpoena Duces Tecum from the Consumer Protection Branch, Civil Division of the DOJ, requesting production of various documents regarding our products and services. In addition, on May 25, 2023, we received a warning letter from FDA, which resulted from the inspection of our facility located in Cypress, California that concluded in August 2022. The warning letter alleged non-conformities to regulations for medical devices, including medical device reporting requirements, relating to our Zio AT System and medical device quality system requirements. On July 15, 2024, FDA initiated inspections of our Cypress and San Francisco facilities. We received 483 observations at the close of the inspection. On December 12, 2025, we received a civil investigative demand from DOJ's Civil Division's Commercial Litigation Branch seeking information and documents related to Zio AT and our associated claims for reimbursement. We have cooperated, and are continuing to cooperate, fully in connection with these matters.

Previous wording

Further, three decisions from the U.S. Supreme Court in July 2024 may lead to an increase in litigation against regulatory agencies that could create uncertainty and thus negatively impact our business. The first decision overturned established precedent that required courts to defer to regulatory agencies’ interpretations of ambiguous statutory language. The second decision overturned regulatory agencies’ ability to impose civil penalties in administrative proceedings. The third decision extended the statute of limitations within which entities may challenge agency actions. These cases may result in increased litigation by industry parties against regulatory agencies and impact how such agencies choose to pursue enforcement and compliance actions. However, the specific, lasting effects of these decisions, which may vary within different judicial districts and circuits, is unknown. We also cannot predict the extent to which FDA and SEC regulations, policies, and decisions may become subject to increasing legal challenges, delays, and changes.

Current wording

Further, three decisions from the U.S. Supreme Court in July 2024 may lead to an increase in litigation against regulatory agencies that could create uncertainty and thus negatively impact our business. The first decision overturned established precedent that required courts to defer to regulatory agencies’ interpretations of ambiguous statutory language. The second decision overturned regulatory agencies’ ability to impose civil penalties in administrative proceedings. The third decision extended the statute of limitations within which entities may challenge agency actions. These cases may result in increased litigation by industry parties against regulatory agencies and impact how such agencies choose to pursue enforcement and compliance actions. However, the specific, lasting effects of these decisions, which may vary within different judicial districts and circuits, are unknown. We also cannot predict the extent to which FDA and SEC regulations, policies, and decisions may become subject to increasing legal challenges, delays, and changes.

Previous wording

Our research and development and manufacturing operations may involve the use or handling of hazardous materials. We are subject to a variety of federal, state, local, and international laws, rules, and regulations governing the use, handling, storage, disposal and remediation of hazardous and biological materials, as well as the sale, labeling, collection, recycling, treatment, and disposal, of products containing such hazardous substances, and we incur expenses relating to compliance with these laws and regulations. If we violate environmental, health, and safety laws, including as a result of human error, equipment failure, or other cases, we could face substantial liabilities, fines, and penalties, personal injury and third-party property damage claims, and substantial investigation and remediation costs. These expenses or this liability could have a significant negative impact on our financial condition. Environmental laws could become more stringent over time, imposing greater compliance costs and increasing risks and penalties associated with violations. We are subject to potentially conflicting and changing regulatory agendas of political, business, and environmental groups. Changes to or restrictions on the procedures for hazardous or biological material storage or handling might require unplanned capital investment or relocation of our facilities. Failure to comply, or the cost of complying, with new or existing laws or regulations could harm our business, financial condition, and results of operations.

Current wording

Our research and development and manufacturing operations may involve the use or handling of hazardous materials. We are subject to a variety of federal, state, local, and international laws, rules, and regulations governing the use, handling, storage, disposal and remediation of hazardous and biological materials, as well as the sale, labeling, collection, recycling, treatment, and disposal, of products containing such hazardous substances, and we incur expenses relating to compliance with these laws and regulations. If we violate environmental, health, and safety laws, including as a result of human error, equipment failure, or other causes, we could face substantial liabilities, fines, and penalties, personal injury and third-party property damage claims, and substantial investigation and remediation costs. These expenses or this liability could have a significant negative impact on our financial condition. Environmental laws could become more stringent over time, imposing greater compliance costs and increasing risks and penalties associated with violations. We are subject to potentially conflicting and changing regulatory agendas of political, business, and environmental groups. Changes to or restrictions on the procedures for hazardous or biological material storage or handling might require unplanned capital investment or relocation of our facilities. Failure to comply, or the cost of complying, with new or existing laws or regulations could harm our business, financial condition, and results of operations.

Previous wording

In addition, licensing or acquiring technologies from third parties exposes us to increased risk of being the subject of intellectual property infringement and vulnerabilities due to, among other things, our lower level of visibility into the development process with respect to such technology and the care taken to safeguard against risks. We currently rely on or incorporate, and will in the future rely on or incorporate, technology that we license from third parties, including software, into our solutions. We cannot be certain that our licensors do not or will not infringe on the intellectual property rights of third parties or that our licensors have or will have sufficient rights to the licensed intellectual property in all jurisdictions in which we may sell our platform. Some of our agreements with our licensors may be terminated by them for convenience, or otherwise provide for a limited term. If we are unable to continue to license technology because of intellectual property infringement claims brought by third parties against our licensors or against us, or if we are unable to continue our license agreements or enter into new licenses on commercially reasonable terms, our ability to develop and sell solutions and services containing or dependent on that technology would be limited, and our business, including our financial conditions, cash flows and results of operations could be harmed. Additionally, if we are unable to license technology from third parties, we may be forced to acquire or develop alternative technology, which we may be unable to do in a commercially feasible manner, or at all, and may require us to use alternative technology of lower quality or performance standards. This could limit or delay our ability to offer new or competitive solutions and increase our costs. Third-party software we rely on may be updated infrequently, unsupported or subject to vulnerabilities that may not be resolved in a timely manner, any of which may expose our solutions to vulnerabilities. Any impairment of the technologies or of our relationship with these third parties could harm our business, operating results, and financial condition.

Current wording

In addition, licensing or acquiring technologies from third parties exposes us to increased risk of being the subject of intellectual property infringement and vulnerabilities due to, among other things, our lower level of visibility into the development process with respect to such technology and the care taken to safeguard against risks. We currently rely on or incorporate, and will in the future rely on or incorporate, technology that we license from third parties, including software, into our solutions. We cannot be certain that our licensors do not or will not infringe on the intellectual property rights of third parties or that our licensors have or will have sufficient rights to the licensed intellectual property in all jurisdictions in which we may sell our platform. Some of our agreements with our licensors may be terminated by them for convenience, or otherwise provide for a limited term. If we are unable to continue to license technology because of intellectual property infringement claims brought by third parties against our licensors or against us, or if we are unable to continue our license agreements or enter into new licenses on commercially reasonable terms, our ability to develop and sell solutions and services containing or dependent on that technology would be limited, and our business, including our financial condition, cash flows and results of operations could be harmed. Additionally, if we are unable to license technology from third parties, we may be forced to acquire or develop alternative technology, which we may be unable to do in a commercially feasible manner, or at all, and may require us to use alternative technology of lower quality or performance standards. This could limit or delay our ability to offer new or competitive solutions and increase our costs. Third-party software we rely on may be updated infrequently, unsupported or subject to vulnerabilities that may not be resolved in a timely manner, any of which may expose our solutions to vulnerabilities. Any impairment of the technologies or of our relationship with these third parties could harm our business, operating results, and financial condition.

Previous wording

Cybersecurity risks, including those involving network security breaches, services interruptions and other incidents affecting the confidentiality, integrity or availability of our data and systems, could result in the compromise of confidential data or critical systems and give rise to potential harm to our patients, remediation costs and other expenses, expose us to liability under HIPAA, breach notification laws, consumer protection laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations.

Current wording

We have in the past, and may in the future, experience cybersecurity incidents. Cybersecurity incidents, including those involving network security breaches, services interruptions and other threats affecting the confidentiality, integrity or availability of our data and systems, could result in the compromise of confidential data or critical systems and give rise to potential harm to our patients, remediation costs and other expenses, expose us to liability under HIPAA, breach notification laws, consumer protection laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations.

Previous wording

Cybersecurity threats can come from a variety of sources, ranging in sophistication from an individual hacker to malfeasance by employees, consultants or service providers to criminal or other unauthorized threat actors, including state-sponsored attackers. Unauthorized parties may also attempt to gain access to our systems or facilities through fraud, trickery or other forms of deceiving our employees, and contractors. Cyber threats may be generic, or they may be custom-crafted against our information systems. Cyber incidents can result from deliberate attacks or unintentional events. Over the past several years, cyber-attacks and other cyber incidents have become more prevalent and much harder to detect and defend against. These cyber-attacks and other incidents include unauthorized access to our network, information technology and data, and that of our of contractors and service providers; compromise of employee credentials and accounts; transmission of computer viruses and other malware; phishing and spamming attacks; ransomware attacks and other acts of cyber extortion; and malicious actions by persons inside our organization and other insider threats. For example, during the first quarter of 2024, we experienced a temporary delay in the billing of our contracted and non-contracted payer customers, performed by our third-party claims processing vendor. The delay was due to a cybersecurity incident experienced by Change Healthcare, a division of UnitedHealth Group, with whom one of our third-party vendors engages for services relating to billing and collections. The delay in billing resulted in a temporary delay in our cash collections. Risks related to our reliance on third-party vendors, industry concentration risks and single points of failure could materially affect our collections and operations. Additionally, the increasing use of mobile devices for remote access to our systems and data also increases these vulnerabilities and risks.

Current wording

Cybersecurity threats can come from a variety of sources, ranging in sophistication from an individual hacker to malfeasance by employees, consultants or service providers to criminal or other unauthorized threat actors, including state-sponsored attackers. Unauthorized parties may also attempt to gain access to our systems or facilities through fraud, trickery or other forms of deceiving our employees and contractors. Cyber threats may be generic, or they may be custom-crafted against our information systems. Cyber incidents can result from deliberate attacks or unintentional events. Over the past several years, cyber-attacks and other cyber incidents have become more prevalent and much harder to detect and defend against. These cyber-attacks and other incidents include unauthorized access to our network, information technology and data, and that of our contractors and service providers; compromise of employee credentials and accounts; transmission of computer viruses and other malware; phishing and spamming attacks; ransomware attacks and other acts of cyber extortion; and malicious actions by persons inside our organization and other insider threats.

Previous wording

Our internal technology systems and infrastructure, and those of our contractors, are vulnerable to damage from natural disasters, acts of terrorism, war and other acts of foreign governments and failures of telecommunication, electrical and other critical systems. In addition, hardware, software or applications we develop or procure from third parties may contain defects in design or manufacture or other problems that could unexpectedly compromise information security or other problems that unexpectedly could interfere with our business operations. Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and may not immediately produce signs of intrusion, we may be unable to anticipate these incidents or techniques, timely discover them, or implement adequate preventative measures.

Current wording

Our internal technology systems and infrastructure, and those of our contractors, are vulnerable to damage from natural disasters, acts of terrorism, war and other acts of foreign governments and failures of telecommunication, electrical and other critical systems. In addition, hardware, software or applications we develop or procure from third parties may contain defects in design or manufacture or other problems that could unexpectedly compromise information security or other problems that unexpectedly could interfere with our business operations. Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and may not immediately produce signs of intrusion, we may be unable to anticipate these incidents or techniques, timely discover them, or implement adequate preventative measures. Risks related to our reliance on third-party vendors, industry concentration risks and single points of failure could materially affect our business, operating results, and financial condition. Additionally, the increasing use of mobile devices for remote access to our systems and data also increases these vulnerabilities and risks.

Previous wording

As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any cybersecurity vulnerabilities. If our Zio devices are subject to cybersecurity vulnerabilities leading to potential harm to patients or compromises data security and confidentiality, we may be required to initiate field actions, including device recalls, or subject to government inspections, investigations or enforcement actions. In addition to any other risks this may present, this could cause significant harm to our brand reputation and consumer trust in our devices.

Current wording

As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any cybersecurity vulnerabilities. More capable general-purpose AI models released by major providers that are or may soon become widely accessible to developers and end users have amplified, and will continue to amplify, the capabilities of threat actors, enabling more targeted and convincing phishing and social engineering campaigns, automated identification and exploitation of software vulnerabilities, the generation of novel malware and attack vectors, prompt injection attacks, automated reconnaissance, and the ability to conduct attacks at greater speed and scale than previously possible. These AI-enhanced threats may be more difficult to detect using traditional security measures and may require us to invest in additional defensive capabilities. If our Zio devices are subject to cybersecurity vulnerabilities leading to potential harm to patients or compromises data security and confidentiality, we may be required to initiate field actions, including device recalls, or subject to government inspections, investigations or enforcement actions. In addition to any other risks this may present, this could cause significant harm to our brand reputation and consumer trust in our devices.