Alignment Healthcare, Inc.

Previous wording

•Security breaches, loss of data and other disruptions could compromise sensitive business or member information, or prevent access to critical information and expose us to liability.

Current wording

•Cybersecurity breaches, loss of data and other disruptions could compromise sensitive business or member information, or prevent access to critical information and expose us to liability.

Previous wording

We expect our aggregate costs will increase substantially in the foreseeable future as we expect to invest heavily in increasing our member base, growing our provider networks, expanding our operations geographically, engaging in expanded marketing and outreach efforts, enhancing our technology, hiring additional employees, operating as a public company and acquiring companies or assets complementary to our business. These efforts may prove more expensive than we currently anticipate, and we may not succeed in increasing our revenue sufficiently to offset these higher expenses. In addition, even if we are successful in increasing our membership and consequently increasing our total revenues from premiums earned, we may not successfully and effectively predict, price and manage the medical costs of our members. To date, we have financed our operations principally from the sale of our equity, revenue from the CMS and the incurrence of indebtedness. We may not generate positive cash flow from operations or profitability in the future.

Current wording

We have incurred net losses on an annual basis since our inception, including a net loss of $1.0 million and $128.1 million for the years ended December 31, 2025 and December 31, 2024. As of December 31, 2025, we had an accumulated deficit of $1,009.0 million. We expect our aggregate costs will increase substantially in the foreseeable future as we expect to invest heavily in increasing our member base, growing our provider networks, expanding our operations geographically, engaging in expanded marketing and outreach efforts, enhancing our technology, hiring additional employees, operating as a public company and acquiring companies or assets complementary to our business. These efforts may prove more expensive than we currently anticipate, and we may not succeed in increasing our revenue sufficiently to offset these higher expenses. In addition, even if we are successful in increasing our membership and consequently increasing our total revenues from premiums earned, we may not successfully and effectively predict, price and manage the medical costs of our members. To date, we have financed our operations principally from the sale of our equity, revenue from the CMS and the incurrence of indebtedness. We may not generate positive cash flow from operations or profitability in the future.

Previous wording

•we may be unsuccessful in identifying or in executing key strategic joint ventures or other arrangements to facilitate our entry into new markets;

Current wording

•we may be unsuccessful in entering new markets, including by identifying and executing key strategic joint ventures or other arrangements to facilitate such entry;

Previous wording

•when expanding into new markets, we may face competition with greater knowledge of such local markets;

Current wording

•when expanding into new markets, we may face competition with greater knowledge of such local markets; and

Previous wording

•expansion into new offerings or new markets, or the acquisition of complementary businesses or assets, may require us to raise additional capital, which may not be available on desirable terms or at all; and

Current wording

•expansion into new offerings or new markets, or the acquisition of complementary businesses or assets, may require us to raise additional capital, which may not be available on desirable terms or at all.

Previous wording

Premium increases, introduction of new product designs, and our relationships with our providers in various markets, among other issues, could also affect our membership levels. Other actions that could affect membership levels include our possible exit from or entrance into markets, or the termination of a large contract. If we do not compete effectively in our markets, if we set rates too high or too low in highly competitive markets to keep or increase our market share, if membership does not increase as we expect, if membership declines, or if we lose membership with favorable medical cost experience while retaining or increasing membership with unfavorable medical cost experience, our results of operations, financial position, and cash flows may be materially adversely affected.

Current wording

Premium increases, introduction of new product designs, and our relationships with our providers in various markets, among other issues, could also affect our membership levels. Other actions that could affect membership levels include our possible exit from or entrance into markets or the entering into or termination of a key network contract. If we do not compete effectively in our markets, if we set rates too high or too low in highly competitive markets to keep or increase our market share, if membership does not increase as we expect, if membership declines, or if we lose membership with favorable medical cost experience while retaining or increasing membership with unfavorable medical cost experience, our results of operations, financial position, and cash flows may be materially adversely affected.

Previous wording

CMS measures the quality of Medicare Advantage plans through a Five Star Quality Rating System. The Star Rating system considers various measures adopted by CMS, including, among others, quality of care, preventative services, chronic illness management and member satisfaction. The achievement of Star ratings of 4-Star or higher qualifies Medicare Advantage plans for an increase in the benchmark against which they bid (potentially increasing premium payments). As of January 1, 2025, approximately 98% of our members are enrolled in rated plans that have a 4.0 Star rating or greater for the 2025 rating year / 2026 payment year. However, we may not be able to maintain or improve upon these Star ratings in future years. Failure to maintain satisfactory quality and performance measures may negatively affect our premium rates, impede our ability to compete for new business in existing or new markets or result in the termination of our contracts, or affect our ability to enter into new CMS contracts or expand the service area of current health plans. Star ratings are an important component of how MA beneficiaries select an MA plan, both during each annual enrollment period and throughout each year. Low Star ratings may reduce our membership, if members choose to enroll in higher-rated plans.

Current wording

CMS measures the quality of Medicare Advantage plans through a Five Star Quality Rating System. The Star Rating system considers various measures adopted by CMS, including, among others, quality of care, preventative services, chronic illness management and member satisfaction. The achievement of Star ratings of 4-Star or higher qualifies Medicare Advantage plans for an increase in the benchmark against which they bid (potentially increasing premium payments). As of January 1, 2026, approximately 100% of our members are enrolled in plans that have a 4.0 Star rating or greater for the 2026 rating year / 2027 payment year. However, we may not be able to maintain or improve upon these Star ratings in future years. Failure to maintain satisfactory quality and performance measures may negatively affect our premium rates, impede our ability to compete for new business in existing or new markets or result in the termination of our contracts, or affect our ability to enter into new CMS contracts or expand the service area of current health plans. Star ratings are an important component of how MA beneficiaries select an MA plan, both during each annual enrollment period and throughout each year. Low Star ratings may reduce our membership, if members choose to enroll in higher-rated plans.

Previous wording

CMS updates and makes changes to the Star ratings annually. Changes implemented by CMS with respect to the Five Star Quality Rating System have, in the past, and could, in the future, negatively impact our Star ratings. For example, in rating year 2024, CMS removed performance outliers from the calculation of non-Consumer Assessment of Healthcare Providers and Systems (“non-CAHPS data”) measure rating cut points using the Tukey outlier deletion method. This change increased cut points overall, making it more difficult to achieve and maintain high Star ratings. In the 2025 Star ratings, only seven MA-Part D contracts earned a 5-star rating, a significant decrease from 31 in 2024, 57 in 2023, and 74 in 2022.

Current wording

CMS updates and makes changes to the Star ratings annually. Changes implemented by CMS with respect to the Five Star Quality Rating System have, in the past, and could, in the future, negatively impact our Star ratings. For example, in rating year 2024, CMS removed performance outliers from the calculation of non-Consumer Assessment of Healthcare Providers and Systems (“non-CAHPS data”) measure rating cut points using the Turkey outlier deletion method. This change increased cut points overall, making it more difficult to achieve and maintain high Star ratings. In the 2026 Star ratings, only 18 MA-Part D contracts earned a 5-star rating, an increase from seven in 2025 but a significant decrease from 31 in 2024 and 57 in 2023.

Previous wording

Additionally, CMS continues to make changes to Star Ratings methodology that could negatively impact our Star Ratings in future years. For example, in April 2024, CMS finalized changes to the measures used in the Star ratings, the calculation of the Categorical Adjustment Index and the Health Equity Index for contracts undergoing consolidation, and the weights assigned to certain measures. These and future adjustments to the Star rating methodology may have a negative impact on our Star ratings.

Current wording

Additionally, CMS continues to make changes to Star Ratings methodology that could negatively impact our Star Ratings in future years. For example, CMS recently proposed changes for the 2027 Star Ratings, including streamlining the Star Ratings measure set by removing certain measures and revising aspects of the reward factor methodology (including proposing to remove the Health Equity Index reward and revert to the historical reward factor). These changes, if finalized, and future adjustments to the Star rating methodology may have a negative impact on our Star ratings.

Previous wording

Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our members, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation.

Current wording

Cybersecurity breaches, loss of data and other disruptions could compromise sensitive information related to our business or our members, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation.

Previous wording

We are highly dependent on information technology networks and systems, including the internet, to securely process, transmit and store this sensitive data and information. Security breaches of this infrastructure, including physical or electronic break-ins, computer viruses, ransomware, attacks by hackers and other malicious actors and similar breaches, and employee or contractor error, negligence or malfeasance, can create system disruptions, shutdowns or unauthorized disclosure or modifications of such sensitive data or information, causing PHI or other PII to be accessed or acquired without authorization or to become publicly available. We utilize a third-party operated 24x7 security operations center that continuously monitors the security and privacy posture of our systems and have implemented the HITRUST Alliance's Common Security Framework as part of our certification by HITRUST; however, we cannot provide assurance that these measures will protect us from all cybersecurity threats and risks. As our third-party service providers manage important aspects of the collection, storage, processing and transmission of employee, user and member information, and other confidential and sensitive information, we rely on them to perform functions that have material cybersecurity risks. Because of the sensitivity of the PHI, other PII and other sensitive information we and our service providers collect, store, transmit, and otherwise process and use, the security of our technology platform and other aspects of our services, including those provided or facilitated by our third-party service providers, are important to our operations and business strategy. Measures taken to protect our systems, those of our contractors or third-party service providers, or the PHI, other PII, or other sensitive information we or contractors or third-party service providers process or maintain (including our requirement that our third-party service providers enter into business associate agreements or other required security agreements, if applicable), may not adequately protect us from the risks associated with the collection, storage, processing and transmission of such sensitive data and information. For example, we may be required to expend significant capital and other resources, such as in the performance of ongoing risk assessments of our and our third-party service providers’ information systems, to protect against security breaches or to alleviate problems caused by security breaches. Because cyber-attacks are becoming more sophisticated and frequent and the techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not identified until they are launched against a target, despite the implementation of security measures, we or our third-party service providers may be unable to anticipate these techniques or to implement adequate protective measures.

Current wording

We are highly dependent on information technology networks and systems, including the internet, to securely process, transmit and store this sensitive data and information. Cybersecurity breaches of this infrastructure, including electronic break-ins, computer viruses, ransomware, attacks by hackers and other malicious actors and similar breaches, physical break-ins and employee or contractor error, negligence or malfeasance, can create system disruptions, shutdowns or unauthorized disclosure or modifications of such sensitive data or information, causing PHI or other PII to be accessed or acquired without authorization or to become publicly available. We utilize a third-party operated 24x7 security operations center that continuously monitors the security and privacy posture of our systems and have implemented the HITRUST Alliance's Common Security Framework as part of our certification by HITRUST; however, we cannot provide assurance that these measures will protect us from all cybersecurity threats and risks. As our third-party service providers manage important aspects of the collection, storage, processing and transmission of employee, user and member information, and other confidential and sensitive information, we rely on them to perform functions that have material cybersecurity risks. Because of the sensitivity of the PHI, PII and other sensitive information we and our service providers collect, store, transmit, and otherwise process and use, the security of our technology platform and other aspects of our services, including those provided or facilitated by our third-party service providers, are important to our operations and business strategy. Measures taken to protect our systems, those of our contractors or third-party service providers, or the PHI, PII or other sensitive information we or contractors or third-party service providers process or maintain (including our requirement that our third-party service providers enter into business associate agreements or other required security agreements, if applicable), may not adequately protect us from the risks associated with the collection, storage, processing and transmission of such sensitive data and information. For example, we may be required to expend significant capital and other resources, such as in the performance of ongoing risk assessments of our and our third-party service providers’ information systems, to protect against cybersecurity breaches or to alleviate problems caused by cybersecurity breaches. Because cyber-attacks are becoming more sophisticated and frequent and the techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not identified until they are launched against a target, despite the implementation of security measures, we or our third-party service providers may be unable to anticipate these techniques or to implement adequate protective measures.

Previous wording

A security breach or privacy violation that leads to disclosure or unauthorized use or modification of, or that prevents access to or otherwise impacts the confidentiality, security, or availability of, member information, including PHI or other PII, or other sensitive information we or our contractors or third-party service providers maintain or otherwise process, could harm our reputation and brand, compel us to comply with breach notification laws, and cause us to incur significant costs for remediation, fines, penalties, providing notification to individuals. We would need to identify and implement measures intended to repair or replace systems or technology and to prevent future occurrences, and we could face potential increases in insurance premiums. This is of particular risk when considering tight integration with third-party service providers who manage or provide parts of our information systems. If we are unable to prevent or mitigate such security breaches or privacy violations or implement satisfactory remedial measures, or if it is perceived that we have been unable to do so, our operations could be disrupted, we may be unable to provide access to our systems, and we could suffer a loss of members. We may also suffer loss of reputation, adverse impacts on member and investor confidence and financial loss, and we would be exposed to the risk of governmental investigations or other actions, regulatory or contractual penalties, and other claims and liabilities, including liability under laws and regulations that protect the privacy of member information or other personal information, such as HIPAA. In addition, security breaches and other inappropriate access to, or acquisition or processing of, information can be difficult to detect, and any delay in identifying such incidents or in providing any notification of such incidents may lead to increased harm.

Current wording

A cybersecurity breach or other breach or privacy violation that leads to disclosure or unauthorized use or modification of, or that prevents access to or otherwise impacts the confidentiality, security, integrity or availability of, member information, including PHI, PII or other sensitive information we or our contractors or third-party service providers maintain or otherwise process, could harm our reputation and brand, compel us to comply with breach notification laws, and cause us to incur significant costs for remediation, fines, penalties, providing notification to individuals and civil claims. We would need to identify and implement measures intended to repair or replace systems or technology and to prevent future occurrences, and we could face potential increases in insurance premiums. This is of particular risk when considering tight integration with third-party service providers who manage or provide parts of our information systems. If we are unable to prevent or mitigate such security breaches or privacy violations or implement satisfactory remedial measures, or if it is perceived that we have been unable to do so, our operations could be disrupted, we may be unable to provide access to our systems, and we could suffer a loss of members. We may also suffer loss of reputation, adverse impacts on member and investor confidence and financial loss, and we would be exposed to the risk of governmental investigations or other actions, regulatory or contractual penalties, and other claims and liabilities, including liability under laws and regulations that protect the privacy of member information or other personal information, such as HIPAA as well as other federal and state privacy, data security, consumer protection, biometric information, eavesdropping and wiretapping, electronic communications, and data breach notification laws that permit private rights of action or other civil claims. In addition, cybersecurity breaches and other inappropriate access to, or acquisition or processing of, information can be difficult to detect, and any delay in identifying such incidents or in providing any notification of such incidents may lead to increased harm.

Previous wording

A data breach could result in incorrect or delayed medical recommendations and prescriptions, missed alerts and missed opportunities to intervene for our members on a timely basis. Unauthorized access, loss or dissemination could also disrupt our operations, including our ability to perform our services, access member health information, collect, process, and prepare company financial information, provide information about our current and future services and engage in other member and clinician education and outreach efforts. Any of the foregoing could have a material adverse effect on our business, results of operations and financial condition.

Current wording

A cybersecurity breach could result in incorrect or delayed medical recommendations and prescriptions, missed alerts and missed opportunities to intervene for our members on a timely basis. Unauthorized access, loss or dissemination could also disrupt our operations, including our ability to perform our services, access member health information, collect, process, and prepare company financial information, provide information about our current and future services and engage in other member and clinician education and outreach efforts. Any of the foregoing could have a material adverse effect on our business, results of operations and financial condition.

Previous wording

•As of January 1, 2025, under our contracts with CMS, we provided health insurance coverage to approximately 209,900 individual Medicare Advantage members. Our continued participation in the Medicare Advantage program through these and other contracts is not guaranteed. Our CMS contracts are subject to annual renewal, and CMS must also annually approve our bids for the plans we intend to offer under each contract. The loss of these and other CMS contracts or significant changes to the terms thereof may have a material adverse effect on our business, results of operations and financial condition.

Current wording

•As of January 1, 2026, under our contracts with CMS, we provided health insurance coverage to approximately 275,300 individual Medicare Advantage members. Our continued participation in the Medicare Advantage program through these and other contracts is not guaranteed. Our CMS contracts are subject to annual renewal, and CMS must also annually approve our bids for the plans we intend to offer under each contract. The loss of these and other CMS contracts or significant changes to the terms thereof may have a material adverse effect on our business, results of operations and financial condition.

Previous wording

CMS released a final rule on January 30, 2023, which changes both the use of extrapolation and the application of the FFS Adjuster. Specifically, CMS will not extrapolate audit results for any audits covering payment years prior to 2018. Additionally, CMS will not apply any FFS Adjuster in RADV audits. These changes are expected to have a material impact on Medicare Advantage organizations, including us. In November 2024, CMS announced it had initiated the payment year 2018 RADV audits, and it expects to begin issuing the audit findings in mid-calendar year 2026, including instructions on how the overpayments will be collected as part of the audit.

Current wording

CMS released a final rule on January 30, 2023, which changes both the use of extrapolation and the application of the FFS Adjuster. Specifically, under the final rule CMS would not extrapolate audit results for any audits covering payment years prior to 2018. Additionally, CMS would not apply any FFS Adjuster in RADV audits. These changes would be expected to have a material impact on Medicare Advantage organizations, including us. In November 2024, CMS announced it had initiated the payment year 2018 RADV audits, and it expected to begin issuing the audit findings in mid-calendar year 2026, including instructions on how the overpayments will be collected as part of the audit. In May 2025, CMS reiterated its focus on RADV audits, noting that the agency planned to complete the payment year 2018 RADV audits by early 2026 and that, going forward, CMS would audit all eligible MA contracts each payment year. However, in September 2025, a federal district court vacated CMS’s 2023 RADV final rule on procedural grounds, creating uncertainty regarding the application of that rule’s audit methodology, including the use of extrapolation and the elimination of the FFS Adjuster, and potentially delaying CMS’s ability to conclude these audits as originally anticipated. The government has filed a notice of appeal in that litigation, and the timing and methodology for issuing findings and any related payment recovery actions remain uncertain.

Previous wording

•Our CMS contracts that cover members’ prescription drugs under Medicare Part D contain provisions for risk sharing and certain payments for prescription drug costs for which we are not at risk. These provisions, certain of which are described below, affect our ultimate payments from CMS.

Current wording

Our CMS contracts that cover members’ prescription drugs under Medicare Part D contain provisions for risk sharing and certain payments for prescription drug costs for which we are not at risk. These provisions, certain of which are described below, affect our ultimate payments from CMS. Beginning in 2025, the Inflation Reduction Act (the “IRA”) imposes changes to the Medicare Part D program, including changes to catastrophic coverage, manufacturer discount obligations, and CMS reinsurance subsidies. These changes to tend to increase the portion of prescription drug costs for which we are financially responsible and may increase variability in our ultimate payments from CMS.

Previous wording

Reinsurance and low-income cost subsidies represent payments from CMS in connection with the Medicare Part D program. Reinsurance subsidies represent payments for CMS’s portion of claims costs which exceed the member’s out-of-pocket threshold, or the catastrophic coverage level. Low-income cost subsidies represent payments from CMS for all or a portion of the deductible, the coinsurance and co-payment amounts above the out-of-pocket threshold for low-income beneficiaries. Monthly prospective payments from CMS for reinsurance and low-income cost subsidies are based on assumptions submitted with our annual bid. A reconciliation and settlement of CMS’s prospective subsidies against actual prescription drug costs we paid, as well as other factors, is made after the end of the applicable year.

Current wording

Reinsurance and low-income cost subsidies represent payments from CMS in connection with the Medicare Part D program. Pursuant to the IRA, CMS’s share of costs in the catastrophic coverage phase decreased from 80% in 2024 to 20% in 2025, meaning that we are responsible for a greater portion of prescription drug costs above the out-of-pocket threshold. Reinsurance subsidies represent payments for CMS’s portion of claims costs which exceed the member’s out-of-pocket threshold, or the catastrophic coverage level. Low-income cost subsidies represent payments from CMS for all or a portion of the deductible, the coinsurance and co-payment amounts above the out-of-pocket threshold for low-income beneficiaries. Monthly prospective payments from CMS for reinsurance and low-income cost subsidies are based on assumptions submitted with our annual bid. A reconciliation and settlement of CMS’s prospective subsidies against actual prescription drug costs we paid, as well as other factors, is made after the end of the applicable year.

Previous wording

The Inflation Reduction Act of 2022 (“IRA”), signed into law on August 16, 2022, reflects an ongoing effort to control prescription drug costs and reduce spending by the federal government. The IRA contains several provisions that impact the Part D program and that may influence our benefit design and profitability. For example, beginning in 2024, Part D plans were required to eliminate member cost-sharing in the catastrophic phase of the benefit, and beginning in 2025, the coverage gap phase was eliminated. Part D plans must now also implement a cap on member out-of-pocket spending of $2,000. These changes have the potential to increase the financial responsibility of Part D plan sponsors. Furthermore, beginning in 2025, Part D plans must offer enrollees the option to pay out-of-pocket prescription drug costs in the form of capped monthly payments instead of all at once at the pharmacy. This may increase administrative burdens for plans by requiring new payment tracking systems and risk management strategies. These changes may significantly alter the plans that we offer and may adversely affect our business, results of operations and financial condition.

Current wording

The Inflation Reduction Act of 2022 (“IRA”), signed into law on August 16, 2022, reflects an ongoing effort to control prescription drug costs and reduce spending by the federal government. The IRA contains several provisions that impact the Part D program and that may influence our benefit design and profitability. For example, beginning in 2024, Part D plans were required to eliminate member cost-sharing in the catastrophic phase of the benefit, and beginning in 2025, the coverage gap phase was eliminated. For 2026, Part D plans must also implement a cap on member out-of-pocket spending of $2,100. These changes have the potential to increase the financial responsibility of Part D plan sponsors. Furthermore, Part D plans must offer enrollees the option to pay out-of-pocket prescription drug costs in the form of capped monthly payments through the Medicare Prescription Payment Plan instead of all at once at the pharmacy.

Previous wording

A substantial portion of our revenue is driven by CMS payments in connection with our health plans in California, North Carolina, Nevada, Arizona and Texas, with over 94% of our members concentrated in California as of December 31, 2024. As a result, our exposure to many of the risks described herein is not mitigated by a diversification of geographic focus. Unfavorable changes in healthcare or other benefit costs or reimbursement rates or increased competition in these areas or any other geographic area where our membership becomes concentrated in the future could therefore have a disproportionately adverse effect on our operating results. Furthermore, due to the concentration of our operations in these states and in California in particular, our business may be adversely affected by economic, health or other conditions that disproportionately affect these states as compared to other states (e.g., outbreaks of infectious disease) or by natural disasters such as major earthquake, wildfire or hurricane. Any of these factors could have a significant impact on the health of a large number of our covered members, access to care may be more difficult and proposed responses, including telehealth, may not be available. Moreover, regulatory changes undertaken in response to such events could require us to cover health care costs for members for which we would not typically be responsible.

Current wording

A substantial portion of our revenue is driven by CMS payments in connection with our health plans in California, North Carolina, Nevada, Arizona and Texas, with approximately 84% of our members concentrated in California as of December 31, 2025. As a result, our exposure to many of the risks described herein is not mitigated by a diversification of geographic focus. Unfavorable changes in healthcare or other benefit costs or reimbursement rates or increased competition in these areas or any other geographic area where our membership becomes concentrated in the future could therefore have a disproportionately adverse effect on our operating results. Furthermore, due to the concentration of our operations in these states and in California in particular, our business may be adversely affected by economic, health or other conditions that disproportionately affect these states as compared to other states (e.g., outbreaks of infectious disease) or by natural disasters such as major earthquake, wildfire or hurricane. Any of these factors could have a significant impact on the health of a large number of our covered members, access to care may be more difficult and proposed responses, including telehealth, may not be available. Moreover, regulatory changes undertaken in response to such events could require us to cover health care costs for members for which we would not typically be responsible.

Previous wording

Additionally, CMS audits Medicare Advantage organizations for documentation to support RAF-related payments for members. The Medicare Advantage organizations ask providers to submit the underlying documentation for members that they serve. It is possible that claims associated with members with higher RAF scores could be subject to more scrutiny in a CMS or plan audit. CMS may impose penalties as a result of its audits. In addition, we could be liable for penalties to the government under the FCA that range from $5,500 to $11,000 (adjusted for inflation) for each false claim, plus up to three times the amount of damages caused by each false claim, which can be as much as the amounts received directly or indirectly from the government for each such false claim. On February 12, 2024, the DOJ issued a final rule announcing adjustments to FCA penalties, under which the per claim penalty range was increased to a range from $13,946 to $27,894 for penalties assessed after February 12, 2024 with respect to violations occurring after November 2, 2015. CMS has indicated that, for some audits of plan years beginning with 2018, payment adjustments will not be limited to RAF scores for the specific Medicare Advantage enrollees for which errors are found but may also be extrapolated to the entire Medicare Advantage plan membership.

Current wording

Additionally, CMS audits Medicare Advantage organizations for documentation to support RAF-related payments for members. The Medicare Advantage organizations ask providers to submit the underlying documentation for members that they serve. It is possible that claims associated with members with higher RAF scores could be subject to more scrutiny in a CMS or plan audit. CMS may impose penalties as a result of its audits. In addition, we could be liable for penalties to the government under the FCA that range from $5,500 to $11,000 (adjusted for inflation) for each false claim, plus up to three times the amount of damages caused by each false claim, which can be as much as the amounts received directly or indirectly from the government for each such false claim. On July 3, 2025, the DOJ issued a final rule announcing adjustments to FCA penalties, under which the per claim penalty range was increased to a range from $14,308 to $28,619 for penalties assessed after July 3, 2025 with respect to violations occurring after November 2, 2015. As discussed above, there is ongoing litigation regarding CMS’s 2023 RADV final rule, which would allow CMS to extrapolate findings in RADV audits, potentially leading to much larger recoveries.

Previous wording

We rely on a number of vendors and other third parties to perform various functions and fulfill our obligations to CMS and members. Our ability to operate our business depends on the performance of, and continued contracts with, these vendors. The functions performed by our major vendors include, but are not limited to, information technology support, claims processing, pharmaceutical benefit management, supplemental benefits (e.g., our "black card" benefit, vision benefits, transportation benefits) and other business process outsourcing. We also rely in part on third-party brokers for the marketing and sale of our insurance plans and on our IPAs, which perform certain functions on our behalf.

Current wording

We rely on a number of vendors and other third parties to perform various functions and fulfill our obligations to CMS and members. Our ability to operate our business depends on the performance of, and continued contracts with, these vendors. The functions performed by our major vendors include, but are not limited to, information technology support, claims processing, pharmaceutical benefit management, supplemental benefits (e.g., our "black card" benefit, vision benefits, dental benefits and transportation benefits) and other business process outsourcing. We also rely in part on third-party brokers for the marketing and sale of our insurance plans and on our IPAs, which perform certain functions on our behalf.

Previous wording

The Patient Protection and Affordable Care Act and The Health Care and Education Reconciliation Act of 2010 (which we collectively refer to as the “Health Care Reform Law”) enacted significant reforms to various aspects of the U.S. health insurance industry. Certain significant provisions of the Health Care Reform Law include, among others, mandated coverage requirements, mandated benefits and guarantee issuance associated with commercial medical insurance, rebates to policyholders based on minimum benefit ratios, adjustments to Medicare Advantage premiums, the establishment of federally facilitated or state-based exchanges coupled with programs designed to spread risk among insurers, and the introduction of plan designs based on set actuarial values. Some of these changes impact us and other entities that offer Medicate Advantage plans.

Current wording

The Patient Protection and Affordable Care Act and The Health Care and Education Reconciliation Act of 2010 (which we collectively refer to as the “Health Care Reform Law”) enacted significant reforms to various aspects of the U.S. health insurance industry. Certain significant provisions of the Health Care Reform Law include, among others, mandated coverage requirements, mandated benefits and guarantee issuance associated with commercial medical insurance, rebates to policyholders based on minimum benefit ratios, adjustments to Medicare Advantage premiums, the establishment of federally facilitated or state-based exchanges coupled with programs designed to spread risk among insurers, and the introduction of plan designs based on set actuarial values. Some of these changes impact us and other entities that offer Medicare Advantage plans.

Previous wording

The use of individually identifiable health data by our business is regulated at federal and state levels. These laws and rules are changed frequently by legislation or administrative interpretation. Various state laws address the use and maintenance of PII. Among these state laws, which we describe in more detail below, we are most substantially affected by the California Consumer Privacy Act, which uniquely among general consumer privacy laws did not exempt employee information, business contact information, and only maintains narrow exemptions for data subject to HIPAA or the Gramm-Leach-Bliley Act. We may need to change the way we create, receive, maintain or transmit PII to comply with these state laws.

Current wording

The use of individually identifiable health data by our business is regulated at federal and state levels. These laws and rules are changed frequently by legislation or administrative interpretation. Various state laws address the use and maintenance of PII. Among these state laws, which we describe in more detail below, we are most substantially affected by the California Consumer Privacy Act ("CCPA"), which uniquely among general consumer privacy laws did not exempt employee information, business contact information, and only maintains narrow exemptions for data subject to HIPAA or the Gramm-Leach-Bliley Act. We are required to comply with these laws in the way we create, receive, maintain or transmit PII.

Previous wording

HIPAA imposes mandatory penalties for certain violations. In 2024, penalties for violations of HIPAA and its implementing regulations started at $141 per violation and could not exceed approximately $71,162 per violation, subject to a cap of approximately $2.1 million for violations of the same standard in a single calendar year. However, a single breach incident can result in violations of multiple standards. Additionally, the penalty amounts listed above are also due for inflation adjustments in 2025.

Current wording

HIPAA imposes mandatory penalties for certain violations. In 2026, penalties for violations of HIPAA and its implementing regulations started at $145 per violation and could not exceed approximately $73,011 per violation, subject to a cap of approximately $2.2 million for violations of the same standard in a single calendar year]. However, a single breach incident can result in violations of multiple standards. Additionally, the penalty amounts listed above are also due for inflation adjustments in 2026.

Previous wording

HIPAA also authorizes state attorneys general to file suit on behalf of their residents for statutory damages of up to $25,000. While HIPAA does not create a private right of action allowing individuals to sue in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI.

Current wording

HIPAA also authorizes state attorneys general to file suit on behalf of their residents for violations of HIPAA. While HIPAA does not create a private right of action allowing individuals to sue in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI.

Previous wording

HIPAA further requires that members be notified of any unauthorized acquisition, access, use or disclosure of their unsecured PHI that compromises the privacy or security of such information, with certain exceptions related to unintentional or inadvertent use or disclosure by employees or authorized individuals. HIPAA specifies that such notifications must be made without unreasonable delay and in no case later than 60 calendar days after discovery of the breach. If a breach affects 500 patients or more, it must be reported to HHS without unreasonable delay, and HHS will post the name of the breaching entity on its public website. Breaches affecting more than 500 patients in the same state or jurisdiction must also be reported to the local media. If a breach involves fewer than 500 people, the covered entity must record it in a log and notify HHS at least annually.

Current wording

HIPAA further requires that members be notified of any unauthorized acquisition, access, use or disclosure of their unsecured PHI that compromises the privacy or security of such information, with certain exceptions related to unintentional or inadvertent use or disclosure by employees or authorized individuals. HIPAA specifies that such notifications must be made without unreasonable delay and in no case later than 60 calendar days after discovery of the breach. If a breach affects 500 individuals or more, it must be reported to HHS without unreasonable delay, and HHS will post the name of the breaching entity on its public website. Breaches affecting more than 500 individuals in the same state or jurisdiction must also be reported to prominent media outlets serving the state or jurisdiction. If a breach involves fewer than 500 individuals, the covered entity must record it in a log and notify HHS at least annually.

Previous wording

Data privacy and security at the state level remains an evolving landscape. For example, CCPA, which came into effect on January 1, 2020, requires companies that process information on California residents to make disclosures to consumers about their data collection, use and sharing practices, allow consumers to opt out of certain data sharing with third parties and provides a cause of action for data breaches. In addition, on November 3, 2020, California voters approved amendments to the CCPA, known as the CPRA, which significantly modifies the CCPA, including by expanding consumers’ rights with respect to certain personal information and creating a state agency, the California Privacy Protection Agency (“CPPA”), to oversee implementation and enforcement efforts. The CPPA is able to finance operations through penalties issued and with the CPRA’s removal of the mandatory cure period from CCPA, we will have less warning before compliance risk results in legal action. The CPRA’s amendments became effective on January 1, 2023. The CCPA contains exemptions for medical information governed by the California Confidentiality of Medical Information Act, and for PHI collected by a covered entity or business associate governed by the privacy, security, and breach notification rule established pursuant to HIPAA.

Current wording

Data privacy and security at the state level remains an evolving landscape. For example, CCPA, which came into effect on January 1, 2020, requires companies that process personal information of California residents to make disclosures to consumers about their data collection, use and sharing practices, allow consumers to exercise certain rights with respect to their data, including the right to opt out of certain data sharing with third parties and provides a cause of action for data breaches. In addition, on November 3, 2020, California voters approved amendments to the CCPA, known as the California Privacy Rights Act ("CPRA"), which significantly modifies the CCPA, including by expanding consumers’ rights with respect to certain personal information and creating a state agency, the California Privacy Protection Agency (“CPPA”), to oversee implementation and enforcement efforts. The CPPA is able to finance operations through penalties issued and with the CPRA’s removal of the mandatory cure period from CCPA, we will have less warning before compliance risk results in legal action. The CPRA’s amendments became effective on January 1, 2023. The CCPA contains exemptions for medical information governed by the California Confidentiality of Medical Information Act, and for PHI collected by a covered entity or business associate governed by the privacy, security, and breach notification rule established pursuant to HIPAA.

Previous wording

The CPPA has released for public comment draft regulations on risk assessments, cybersecurity assessments, and automated decision-making technologies, which close on February 19, 2025. These regulations are the final components of the CPRA's amendments to the CCPA, which granted the CPPA the authority to pass additional regulations. These regulations in their draft form contain substantial new compliance obligations with respect to PII we process.

Current wording

On September 23, 2025, the CPPA finalized its regulations on risk assessments, cybersecurity assessments, and automated decision-making technologies. These regulations contain substantial new compliance obligations with respect to PII we process.

Previous wording

While the CPRA/CCPA is an example of consumer privacy law, the NAIC’s Model Insurance Data Security Law (the "Model law") is a different type of law focused on securing insurance licensees’ information systems. Versions of this Model Law have been passed in many states and are expected to be passed in more states in the coming years. Similar to HIPAA, the Model Law requires the implementation of technical, administrative, and procedural information security practices and procedures and includes reporting requirements for data breaches. These Model Laws exist in a majority of states and are typically enforced by state insurance regulators.

Current wording

While the CCPA is an example of consumer privacy law, the NAIC’s Model Insurance Data Security Law (the "Model law") is a different type of law focused on securing insurance licensees’ information systems. Versions of this Model Law have been passed in many states and are expected to be passed in more states in the coming years. Similar to HIPAA, the Model Law requires the implementation of technical, administrative, and procedural information security practices and procedures and includes reporting requirements for data breaches. These Model Laws exist in a majority of states and are typically enforced by state insurance regulators.

Previous wording

As described above, substantially all of our relevant member data is maintained on our technology platform, AVA, which aggregates and provides us with access to extensive member datasets, including individually identifiable PHI. As a result, any breach of our technology platform could expose us to substantial liability under HIPAA, the HITECH Act and other applicable laws, regulations or rules. See “Risk Factors—Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our members, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation.”

Current wording

As described above, substantially all of our relevant member data is maintained on our technology platform, AVA, which aggregates and provides us with access to extensive member datasets, including individually identifiable PHI. As a result, any breach of our technology platform could expose us to substantial liability under HIPAA, the HITECH Act and other applicable laws, regulations or rules. See “Risk Factors—Cybers ecurity breaches, loss of data and other disruptions could compromise sensitive information related to our business or our members, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation.”

Previous wording

As a corporate entity, we are not licensed to practice medicine. Many states in which we operate through our subsidiaries limit the practice of medicine to licensed individuals or professional organizations comprised of licensed individuals, and business corporations generally may not exercise control over the medical decisions of physicians. Statutes, regulations and court decisions relating to the practice of medicine, fee-splitting between physicians and referral sources, and similar issues vary widely from state to state. While we endeavor to comply with state corporate practice of medicine laws and regulations as we interpret them, the laws and regulations in these areas are complex, changing, and often subject to varying interpretations. The interpretation and enforcement of these laws vary significantly from state to state.

Current wording

As a corporate entity, we are not licensed to practice medicine. Many states in which we operate through our subsidiaries limit the practice of medicine to licensed individuals or professional organizations exclusively owned and comprised of licensed individuals, and business corporations generally may not exercise control over the medical decisions of licensed physicians or other licensed clinicians. Statutes, regulations and court decisions relating to the practice of medicine, fee-splitting between physicians and referral sources, and similar issues vary widely from state to state. In addition, various state laws also generally prohibit the sharing of professional services income with nonprofessional or business interests. While we endeavor to comply with state corporate practice of medicine laws and regulations as we interpret them, the laws and regulations in these areas are complex, changing, and often subject to varying interpretations. The interpretation and enforcement of these laws vary significantly from state to state.

Previous wording

Under business support services agreements between certain of our subsidiaries and affiliated physician-owned professional groups, these groups retain sole responsibility for all medical decisions, as well as for hiring and managing physicians and other licensed healthcare providers, developing operating policies and procedures, implementing professional standards and controls, and maintaining malpractice insurance. Regulatory authorities and other parties may assert that, despite the business support services agreements and other arrangements through which we operate, we are engaged in the prohibited corporate practice of medicine or that our arrangements constitute unlawful fee-splitting. Penalties for violations of the corporate practice of medicine or fee-splitting laws vary by state and may result in physicians being subject to disciplinary action, as well as to forfeiture of revenue from payors for services rendered. For business entities such as us, violations may also bring both civil and, in more extreme cases, criminal liability for engaging in medical practice without a license, our agreements could be found legally invalid and unenforceable (in whole or in part) or we could be required to restructure our contractual arrangements.

Current wording

Under business support services agreements between certain of our subsidiaries and affiliated physician-owned professional groups, these groups retain sole responsibility for all medical decisions, as well as for hiring and managing physicians and other licensed healthcare providers, developing operating policies and procedures, implementing professional standards and controls, and maintaining malpractice insurance. Regulatory authorities and other parties may assert that, despite the business support services agreements and other arrangements through which we operate, we are engaged in the prohibited corporate practice of medicine or that our arrangements constitute unlawful fee-splitting. Penalties for violations of the corporate practice of medicine or fee-splitting laws vary by state and may result in physicians being subject to disciplinary action, as well as to forfeiture of revenue from payors for services rendered. For business entities such as us, violations may also bring both civil and, in more extreme cases, criminal liability for engaging in medical practice without a license, our agreements could be found legally invalid and unenforceable (in whole or in part) or we could be required to restructure our contractual arrangements. Recently, Oregon and California have passed laws codifying and strengthening their existing corporate practice of medicine prohibitions in ways which may require us to adjust contractual arrangements with our affiliated physician-owned professional groups, and we are aware of a number of other states considering similar legislation.

Previous wording

We, our in-house and externally engaged physicians and the facilities in which they operate are subject to various federal, state and local licensing and certification laws and regulations and accreditation standards and other laws, relating to, among other things, the adequacy of medical care, equipment, privacy of member information, physician relationships, personnel and operating policies and procedures. Failure to comply with these licensing, certification and accreditation laws, regulations and standards could result in prior payments being subject to recoupment, requirements to make significant changes to our operations and can give rise to civil or, in extreme cases, criminal penalties. We routinely take the steps we believe are necessary to retain or obtain all requisite licensure and operating authorities. While we have made reasonable efforts to substantially comply with federal, state and local licensing and certification laws and regulations and standards as we interpret them, the agencies that administer these programs may find that we have failed to comply in some material respects. If this were to occur, we could be subject to civil and/or criminal penalties, or we could be required to close or limit our operations at relevant sites.

Current wording

Failure to comply with these licensing, certification and accreditation laws, regulations and standards could result in prior payments being subject to recoupment, requirements to make significant changes to our operations and can give rise to civil or, in extreme cases, criminal penalties. We routinely take the steps we believe are necessary to retain or obtain all requisite licensure and operating authorities. While we have made reasonable efforts to substantially comply with federal, state and local licensing and certification laws and regulations and standards as we interpret them, the agencies that administer these programs may find that we have failed to comply in some material respects. If this were to occur, we could be subject to civil and/or criminal penalties, or we could be required to close or limit our operations at relevant sites.

Previous wording

In jurisdictions where the corporate practice of medicine is prohibited, we have historically operated by maintaining long-term business support contracts with multiple associated professional medical entities that are wholly owned by physicians and, in turn, employ or contract with physicians to provide those professional medical services required by our members. Under these business support services agreements, our primary operating subsidiary performs only non-medical business support services, does not represent that it offers medical services and does not exercise influence or control over the practice of medicine by the physicians or the associated physician groups. In addition to the above business support services arrangements, we have certain contractual rights relating to the orderly transfer of equity interests in our associated physician practices through succession agreements and other arrangements with their physician equity holders. Such equity interests cannot, however, be transferred to or held by us or by any non-professional medical entity. Accordingly, neither we nor our direct subsidiaries directly own any equity interests in any of our physician practices. In the event that any of the physician owners of our associated physician practices fail to comply with the business support services arrangement, if any business support services arrangement is terminated and/or we are unable to enforce our contractual rights over the orderly transfer of equity interests in any of our associated physician practices, such events could have a material adverse effect on our business, results of operations, financial condition and cash flows.

Current wording

In jurisdictions where the corporate practice of medicine is prohibited, we have historically operated by maintaining long-term business support contracts with multiple associated professional medical entities that are wholly owned by physicians and, in turn, employ or contract with physicians to provide those professional medical services required by our members. Under these business support services agreements, our primary operating subsidiary performs only non-medical business support services, does not represent that it offers medical services and does not exercise influence or control over the practice of medicine by the physicians or the associated physician groups. In addition to the above business support services arrangements, we have certain contractual rights relating to the orderly transfer of equity interests in our associated physician practices through succession agreements and other arrangements with their physician equity holders. Such equity interests cannot, however, be transferred to or held by us or by any non-professional medical entity. Accordingly, neither we nor our direct subsidiaries directly own any equity interests in any of our physician practices. In the event that any of the physician owners of our associated physician practices fail to comply with the business support services arrangement, if any business support services arrangement is terminated and/or we are unable to enforce our contractual rights over the orderly transfer of equity interests in any of our associated physician practices, such events could have a material adverse effect on our business, results of operations, financial condition and cash flows. Further, the enforceability of such equity transfer restriction agreements has been called into question by state courts and regulators in New Jersey, New York, California, and Oregon. The invalidation of our transfer restriction agreements in such states may have a detrimental effect on our relationship with our affiliated physician-owned professional entities.

Previous wording

The policies and decisions of the federal and state governments regarding the Medicare Advantage program in which we participate have a substantial impact on our profitability. These governmental policies and decisions, which we cannot predict with certainty, directly shape the revenues given to us under the Medicare Advantage program, the eligibility and enrollment of our members, the services we provide to our members, and our administrative, healthcare services, and other costs associated with the Medicare Advantage program. Legislative or regulatory actions, such as changes to the Medicare Advantage program, those resulting in a reduction in payments to us, an increase in our cost of administrative and healthcare services, or additional fees, taxes or assessments, may have a material adverse effect on our results of operations, financial position, and cash flows. For example, CMS recently finalized new regulations requiring Utilization Management (UM) committees to include a health equity expert and conduct an annual analysis of prior authorization impacts on enrollees with social risk factors, with the findings publicly posted on their website. These changes expand upon recently imposed requirements for UM committees and the annual review of UM policies, further increasing the regulatory burden on MA plans. Additionally, CMS implemented stricter regulations on Third-Party Marketing Organizations (TPMOs), prohibiting the sharing or resale of personal beneficiary data without prior written consent, which may limit outreach efforts and reduce lead generation and enrollment opportunities for MA plans. CMS’s focus on marketing activities coincides with an apparent increased DOJ interest, as well. In recent years, the DOJ has launched investigations into whether marketing and recruiting practices of Medicare Advantage Organizations and their downstream providers violate the FCA.

Current wording

The policies and decisions of the federal and state governments regarding the Medicare Advantage program in which we participate have a substantial impact on our profitability. These governmental policies and decisions, which we cannot predict with certainty, directly shape the revenues given to us under the Medicare Advantage program, the eligibility and enrollment of our members, the services we provide to our members, and our administrative, healthcare services, and other costs associated with the Medicare Advantage program. Legislative or regulatory actions, such as changes to the Medicare Advantage program, those resulting in a reduction in payments to us, an increase in our cost of administrative and healthcare services, or additional fees, taxes or assessments, may have a material adverse effect on our results of operations, financial position, and cash flows. For example, under the Contract Year 2026 Medicare Advantage and Part D final rule, CMS finalized new federal requirements for certain D-SNPs that, beginning in 2027, will require the use of integrated member identification cards that serve as the ID cards for both the Medicare and Medicaid plans in which an enrollee is enrolled, and the completion of an integrated health risk assessment for Medicare and Medicaid, rather than separate assessments for each program. CMS also codified timeframes for all special needs plans to conduct health risk assessments and develop individualized care plans, and to prioritize the involvement of the enrollee or the enrollee’s representative in the development of such care plans. These requirements may increase administrative complexity, operational costs, and coordination obligations for D-SNPs and may affect our ability to offer or maintain such plans in certain markets.

Previous wording

While we believe that we have structured our agreements and operations in material compliance with applicable healthcare laws and regulations, we may be unable to successfully address changes in the current regulatory environment. In addition, some of the healthcare laws and regulations applicable to us are subject to limited or evolving interpretations, and a review of our business or operations by a court, law enforcement or a regulatory authority might result in a determination that could have a material adverse effect on us.

Current wording

While we believe that we have structured our agreements and operations in material compliance with applicable healthcare laws and regulations, we may be unable to successfully address changes in the current regulatory environment. In addition, some of the healthcare laws and regulations applicable to us are subject to limited or evolving interpretations, and a review of our business or operations by a court, law enforcement or a regulatory authority might result in a determination that could have a material adverse effect on us. Furthermore, the healthcare laws and regulations applicable to us may be amended or interpreted in a manner that could have a material adverse effect on our business, prospects, results of operations and financial condition.

Previous wording

Medicare Advantage organizations may offer dual-eligible special needs plans (“D-SNPs”), which are plans that may only enroll beneficiaries who are eligible for both Medicare and Medicaid. D-SNPs must meet additional statutory and regulatory requirements that are intended to address certain challenges faced by the dually eligible population. According to CMS, some Medicare Advantage organizations offer plans that are not D-SNPs but that are designed to attract primarily dual-eligible beneficiaries (“D-SNP look-alike plans”). In 2020, CMS issued a final rule to restrict the offering of D-SNP look-alike plans. Specifically, CMS will not enter into a contract for a new Medicare Advantage plan that is not a special needs plan and is projected to enroll more than 80% dual-eligible members. Moreover, CMS will not renew a contract for such plans unless the plan has been active for less than a year and enrolls 200 or fewer members. There may be additional CMS restrictions on D-SNP plans and their enrollment, as CMS recently finalized a policy that would, among other things, lower the threshold to seventy percent (70%) in 2025 and sixty percent (60%) in 2026. Additionally, the California Department of Healthcare Services has adopted regulatory changes limiting the availability of D-SNP contracts. Since contract year 2024, DHCS will only contract with new D-SNPs that are affiliated with a Medi-Cal managed care plan. Furthermore, beginning in contract year 2025, existing D-SNPs without such affiliations will be prohibited from enrolling new members. These regulatory developments are likely to restrict the types of plans we can offer and the membership mix we can maintain in our plans. To the extent we have to offer enhanced benefits to attract or retain dual-eligible members in certain plans, the profitability of such plans may be impacted. These regulatory developments may accordingly have an adverse impact on our membership, financial condition, results of operations and cash flows.

Current wording

Medicare Advantage organizations may offer dual-eligible special needs plans (“D-SNPs”), which are plans that may only enroll beneficiaries who are eligible for both Medicare and Medicaid. D-SNPs must meet additional statutory and regulatory requirements that are intended to address certain challenges faced by the dually eligible population. According to CMS, some Medicare Advantage organizations offer plans that are not D-SNPs but that are designed to attract primarily dual-eligible beneficiaries (“D-SNP look-alike plans”). In 2020, CMS issued a final rule to restrict the offering of D-SNP look-alike plans. Specifically, CMS will not enter into a contract for a new Medicare Advantage plan that is not a special needs plan and is projected to enroll more than 80% dual-eligible members. Moreover, CMS will not renew a contract for such plans unless the plan has been active for less than a year and enrolls 200 or fewer members. There may be additional CMS restrictions on D-SNP plans and their enrollment, as CMS recently finalized a policy that would, among other things, lower the threshold to seventy percent (70%) in 2025 and sixty percent (60%) in 2026. Additionally, the

Previous wording

As described above, because of regulations preventing the corporate practice of medicine, certain of our associated physician practice groups that operate our clinics are wholly owned or primarily owned by physicians employed by us. Although we retain certain rights regarding the succession of ownership of the associated practices through succession agreements and other arrangements with their physician equity holders, if current owners died, were incapacitated or otherwise were no longer affiliated with us, there could be a material adverse effect on the relationship between us and the associated physician practices and, therefore, our business operations could be adversely affected.

Current wording

As described above, because of regulations preventing the corporate practice of medicine, certain of our associated physician practice groups that operate our clinics are wholly owned or primarily owned by physicians employed by us. Although we retain certain rights regarding the succession of ownership of the associated practices through succession agreements and other arrangements with their physician equity holders, if current owners died, were incapacitated or otherwise were no longer affiliated with us, there could be a material adverse effect on the relationship between us and the associated physician practices and, therefore, our business operations could be adversely affected. Recently, Oregon and California have passed laws codifying and strengthening their existing corporate practice of medicine prohibitions in ways which may require us to adjust contractual arrangements with our affiliated physician-owned professional groups.

Previous wording

As described above, because of laws prohibiting the corporate practice of medicine, we enter into contractual arrangements to manage certain of our affiliated physician practices. If we were to hold the equity of such physician practices directly, we would be able to exercise our rights as an equity holder directly to effect changes in the boards of directors of those entities, which could effect changes at the management and operational level. In contrast, under our current contractual arrangements with our associated physician groups, we may not be able to directly change the members of the boards of directors of these entities and would have to rely on the entities and the entities’ equity holders to perform their obligations in order to exercise our control over the entities. If any of these affiliated entities or their equity holders fail to perform their respective obligations under the contractual arrangements, we may have to incur substantial costs and expend additional resources to enforce such arrangements.

Current wording

As described above, because of laws prohibiting the corporate practice of medicine, we enter into contractual arrangements to manage certain of our affiliated physician practices. If we were to hold the equity of such physician practices directly, we would be able to exercise our rights as an equity holder directly to effect changes in the boards of directors of those entities, which could effect changes at the management and operational level. In contrast, under our current contractual arrangements with our associated physician groups, we may not be able to directly change the members of the boards of directors of these entities and would have to rely on the entities and the entities’ equity holders to perform their obligations in order to exercise our control over the entities. If any of these affiliated entities or their equity holders fail to perform their respective obligations under the contractual arrangements, we may have to incur substantial costs and expend additional resources to enforce such arrangements. Further, the enforceability of equity transfer restriction agreements has been called into question by state courts and regulators in New Jersey, New York, California, and Oregon. The invalidation of our transfer restriction agreements in such states may have a detrimental effect on our relationship with our affiliated physician-owned professional entities.

Previous wording

On November 22, 2024 we completed the sale of $330.0 million of our 4.25% Convertible Senior Notes (the "Convertible Notes"). The Convertible Notes were issued pursuant to an indenture, dated as of November 22, 2024, between the Company and U.S. Bank Trust Company, National Association, as trustee. The Convertible Notes are senior, unsecured obligations of the Company, and interest will be payable semi-annually in arrears at a rate of 4.25% per annum beginning on May 15, 2025. The Convertible Notes will mature on November 15, 2029, unless earlier repurchased, redeemed or converted in accordance with their terms.

Current wording

On November 22, 2024 we completed the sale of $330.0 million of our 4.25% Convertible Senior Notes (the "Convertible Notes"). The Convertible Notes were issued pursuant to an indenture, dated as of November 22, 2024, between the Company and U.S. Bank Trust Company, National Association, as trustee. The Convertible Notes are senior, unsecured obligations of the Company, and interest will be payable semi-annually in arrears at a rate of 4.25% per annum beginning on May 15, 2025. The Convertible Notes will mature on November 15, 2029, unless earlier repurchased, redeemed or converted in accordance with their terms. The Convertible Notes have an initial conversion rate of 62.4 shares of common stock per $1,000 principal amount of the Convertible Notes (subject to adjustment for certain events). This represents an initial conversion price of approximately $16.04 per share.