Evolent Health Inc

Our significant business risks are described in Part I, Item 1A. “Risk Factors” to our 2023 Form 10-K. These risk factors are supplemented for the item described below. The risks and uncertainties we describe are not the only ones facing us. Additional risks and uncertainties not presently known to us or that we currently deem immaterial may also impair our business or operations. Any adverse effect on our business, financial condition or operating results could result in a decline in the value of our securities and the loss of all or part of your investment.

We rely on Internet infrastructure, bandwidth providers, data center providers, other third parties and our own systems for providing services to our partners and operating our business, and any failure or interruption in the services provided by these third parties or our own systems could expose us to litigation, negatively impact our relationships with partners, adversely affect our brand and our business.

Our ability to deliver our solutions, particularly our cloud-based solutions, is dependent on the development and maintenance of the infrastructure of the Internet and other telecommunications services by third parties. This includes maintenance of a reliable network connection with the necessary speed, data capacity and security for providing reliable Internet access and services and reliable telephone and facsimile services. As a result, our information systems require an ongoing commitment of significant resources to maintain and enhance existing systems and develop new systems in order to keep pace with continuing changes in information technology, emerging cybersecurity risks and threats, evolving industry and regulatory standards and changing preferences of our partners.

Our services are designed to operate without interruption in accordance with our service level commitments. However, we have experienced limited interruptions in these systems in the past, including server failures that temporarily slow down the performance of our services, and we may experience more significant interruptions in the future. We rely on internal systems as well as third-parties, including bandwidth and telecommunications equipment providers, to provide our services and operate our business. We do not maintain redundant systems or facilities for some of these services. Interruptions in these systems, whether due to system failures, computer viruses, physical or electronic break-ins or other catastrophic events, could affect the security or availability of our services and prevent or inhibit the ability of our partners to access our services. These systems may be at greater risk of interruption as a result of increased use of mobile and cloud technologies, including as a result of the shift to work from home arrangements as a result of the COVID-19 pandemic.

In the event of a catastrophic event with respect to one or more of these systems or facilities, we may experience an extended period of system unavailability, which could result in substantial costs to remedy those problems or negatively impact our relationship with our partners, our business, results of operations and financial condition. To operate without interruption, both we and our service providers must guard against:

•damage from fire, power loss and other natural disasters;

•telecommunications failures;

•software and hardware errors, failures and crashes;

•security breaches, computer viruses and similar disruptive problems; and

•other potential interruptions.

Any disruption in the network access, telecommunications or co-location services provided by third-party vendors or any failure of or by third-party vendors’ systems or our own systems to handle current or higher volume of use could significantly harm our business. Similarly, disruptions of service to other third parties or to our customers can negatively impact our ability to serve our clients and run our business. For example, in February 2024, Change Healthcare, a subsidiary of UnitedHealth Group and the largest clearinghouse for medical claims in the U.S., was the subject of a cyberattack that required it to take offline its computer systems that handled electronic payments and insurance claims. As a result of the outage, we had reduced visibility into setting our claims reserve for the three months ended March 31, 2024. Similar events could occur in the future, and the impact to our business could be material.

We exercise limited control over third-parties, which increases our vulnerability to problems with services they provide. Any errors, failures, interruptions or delays experienced in connection with these third-party technologies and information services or our own systems could negatively impact our relationships with partners and adversely affect our business and could expose us to third-party liabilities. Although we maintain insurance for our business, the coverage under our policies may not be adequate to compensate us for all losses that may occur. In addition, we cannot provide assurance that we will continue to be able to obtain adequate insurance coverage at an acceptable cost.

The reliability and performance of our Internet connection may be harmed by increased usage or by denial-of-service attacks. The Internet has experienced a variety of outages and other delays as a result of damages to portions of its infrastructure, and it could face outages and delays in the future. These outages and delays could reduce the level of Internet usage as well as the availability of the Internet to us for delivery of our Internet-based services.