Item 1A. Risk Factors.
Our business involves a high degree of risk. You should carefully consider the risks and uncertainties described below, together with all of the other information contained in this Annual Report on Form 10-K, including our consolidated financial statements and the related notes thereto, before making a decision to invest in our common stock. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that affect us. If any of the following risks occur, our business, financial condition, operating results and prospectus could be materially and adversely affected. In that event, the price of our common stock could decline, and you could lose all or part of your investment.
Risk Factors Summary
The following are the principal risks that are applicable to our business and the shares of our common stock. Such risks are discussed in more detail below, and you should read this Risk Factors section in its entirety before deciding whether to invest in our common stock.
•We have a history of net losses and may be unable to achieve or maintain profitability.
•Our relatively limited operating history makes it difficult to evaluate our current business and future prospects.
•Our growth strategy may not prove viable and we may not realize expected results.
•If we are unable to attract new members, our revenue growth will be adversely affected.
•If we do not design and price our products properly and competitively, cannot develop new products and implement clinical initiatives, lower costs, and appropriately document members’ risk profile, or if our benefits expense estimates are inadequate, our profitability may be materially adversely affected.
•We may not be successful in maintaining or improving our Star ratings in future years, which may have a direct and substantial adverse impact on our revenue.
•If we fail to develop and maintain satisfactory relationships with care providers, our business may be adversely affected.
•As a government contractor, we risk the potential loss of CMS contracts, suspension from the Medicare Advantage program, changes to premiums paid to Medicare Advantage plans, changes to provisions for risk sharing under Medicare Part D and governmental audits and investigations, among others.
•If we fail to manage our growth effectively, we may be unable to execute our business plan, maintain high levels of service and member satisfaction or adequately address competitive challenges.
•The loss or renegotiation of certain key contracts with large independent physician associations (“IPAs”), hospitals or other provider networks, to serve our membership base could negatively impact our results.
•Security breaches, loss of data and other disruptions could compromise sensitive business or member information, or prevent access to critical information and expose us to liability.
•Disruptions in our disaster recovery systems or management continuity planning could limit our ability to operate our business effectively and adequately care for our members.
•Our business depends on our ability to effectively invest in, implement improvements to and properly maintain the uninterrupted operation and data integrity of our information technology platform.
•We may be subject to legal proceedings and litigation, including intellectual property and privacy disputes.
•Our business may be impacted if the healthcare services industry becomes more cyclical.
•If we are not able to maintain, enhance and protect our reputation and brand recognition, including through the maintenance and protection of trademarks, our business and results of operations will be harmed.
•If we are unable to obtain, maintain, protect and enforce sufficiently broad intellectual property protection, including for our trade secrets, know-how and other proprietary and internally developed information, the value of our technology could be adversely affected.
13
Table of Contents
•Third parties may initiate legal proceedings alleging intellectual property rights violations, the outcome of which would be uncertain and could have a material adverse effect on our business.
•Any restrictions on our use of, or ability to license, data, or our failure to license data and integrate third-party technologies, could have a material adverse effect on our business.
•We depend on our senior management team and other key employees, and the loss of one or more of these employees or an inability to attract and retain other highly skilled employees could harm our business.
•We have limited experience serving as a direct contracting entity with CMS under the ACO REACH program and may not be able to realize the expected benefits thereof.
•Our plans are concentrated in a limited number of U.S. states and we may not be able to establish new geographic presences.
•Competition for physicians and nurses, shortages of qualified personnel or other factors could increase our labor costs and adversely affect our revenue, profitability and cash flows.
•Our records may contain inaccurate or unsupportable information regarding risk adjustment scores of members, which could cause misstatements of revenue and subject us to penalties.
•Inaccurate estimates of incurred but not reported medical expense could adversely affect our results.
•Negative publicity regarding our industry generally could adversely affect our results of operations or business.
•Medicare Advantage funding reductions could adversely affect our results of operations.
•The healthcare industry is highly competitive, and this competition may have a material adverse effect on our business operations and financial position.
•If we are unable to offer new and innovative products and services or fail to keep pace with industry advances, technology and needs, our members may terminate memberships.
•We are a holding company with no operations of our own, and we depend on our subsidiaries for cash.
•We may be required to maintain higher statutory capital levels for our existing operations or may become subject to additional capital reserve requirements as we pursue new business opportunities.
•New laws or changes in laws or their application could increase our cost of doing business.
•We must adapt to changes in the healthcare industry and related regulations or our business may be harmed.
•Losing the services of the physicians who own our associated physician practices could jeopardize our contractual arrangements.
•Our existing indebtedness could adversely affect our business and growth prospects, particularly in an environment of rising interest rates.
•Our failure to raise additional capital or generate cash flows could reduce our ability to compete successfully.
•Our lead sponsor has significant control over our business activities, and their interests may conflict with ours or yours in the future.
•The requirements of being a public company may strain our resources and distract our management.
•Provisions of our corporate governance documents could make an acquisition of us more difficult.
•The exclusive forum provision in our certificate of incorporation may have the effect of discouraging lawsuits against our directors and officers.
•An active, liquid trading market for our common stock may not be sustained.
•Our operating results and stock price may be volatile, including as a result of economic or industry-wide factors that are beyond our control.
•A significant portion of our total outstanding shares may be sold into the market in the near future.
•Future sales of substantial amounts of common stock, or the possibility of such sales, could adversely affect stock price.
Risks Related to Our Business
We have a history of net losses, we anticipate increasing expenses in the future, and we may not be able to achieve or maintain profitability.
We have incurred net losses on an annual basis since our inception, including a net loss of $128.1 million and $148.2 million for the years ended December 31, 2024 and December 31, 2023. As of December 31, 2024, we had an accumulated deficit of $1,008.3 million.
14
Table of Contents
We expect our aggregate costs will increase substantially in the foreseeable future as we expect to invest heavily in increasing our member base, growing our provider networks, expanding our operations geographically, engaging in expanded marketing and outreach efforts, enhancing our technology, hiring additional employees, operating as a public company and acquiring companies or assets complementary to our business. These efforts may prove more expensive than we currently anticipate, and we may not succeed in increasing our revenue sufficiently to offset these higher expenses. In addition, even if we are successful in increasing our membership and consequently increasing our total revenues from premiums earned, we may not successfully and effectively predict, price and manage the medical costs of our members. To date, we have financed our operations principally from the sale of our equity, revenue from the CMS and the incurrence of indebtedness. We may not generate positive cash flow from operations or profitability in the future.
We have encountered and will continue to encounter risks and difficulties frequently experienced by growing companies in rapidly changing industries, including increasing expenses as we continue to grow our business. In addition to the expected costs to grow our business, we also expect to incur additional legal, accounting and other expenses as we continue to operate as a public company. Moreover, the investments we intend to make into growing our company may be more costly than we expect, and if we do not achieve the benefits anticipated from these investments, or if the realization of these benefits is delayed, they may not result in increased revenue or growth in our business. If our growth rate were to decline significantly or become negative, it could adversely affect our financial condition and results of operations. Furthermore, even if we achieve profitability in the future, we may not be able to sustain profitability in subsequent periods. If we are not able to maintain positive cash flow in the long term, we may require additional financing, which may not be available on favorable terms or at all and/or which would be dilutive to our stockholders. If we are unable to successfully address these risks and challenges as we encounter them, our business, results of operations and financial condition would be adversely affected. Our failure to achieve or maintain profitability could negatively impact the value of our common stock.
Our relatively limited operating history makes it difficult to evaluate our current business and future prospects and increases the risk of your investment.
Our relatively limited operating history makes it difficult to evaluate our current business and prospectus and plan for our future growth. We were founded in 2013, with most of our growth occurring in recent years. We have encountered and will continue to encounter significant risks and uncertainties frequently experienced by new and growing companies in heavily regulated and rapidly changing industries, such as determining appropriate investments for our limited resources, scaling our model and technology platform, attracting and retaining members, efficiently navigating and complying with evolving regulations, hiring, integrating, training and retaining skilled personnel, identifying and reaching agreements with reliable healthcare service providers, competing against more established competitors, unforeseen expenses and challenges in forecasting accuracy. Although we have successfully expanded our footprint outside of California and intend to continue to expand into new markets, new plans we provide or new markets we enter may not prove successful. If we are unable to increase our member enrollment, scale our platform, maintain a low cost structure, identify, reach and successfully maintain agreements with reliable healthcare service providers, successfully manage our third-party medical costs or successfully expand the range of services and benefits we offer to members, our revenue and our ability to achieve and sustain profitability would be impaired. Additional risks include our ability to effectively manage growth, process, store, protect and use personal data in compliance with governmental regulation, contractual obligations and other legal obligations related to privacy and security and manage our obligations as a healthcare plan. If our assumptions regarding these and other similar risks and uncertainties, which we use to plan our business, are incorrect or change as we gain more experience operating our business or due to changes in our industry, or if we do not address these challenges successfully, our operating and financial results could differ materially from our expectations and our business could suffer.
Our growth strategy may not prove viable and we may not realize expected results.
Our business strategy is to grow rapidly by expanding our service offerings through an array of non-traditional benefits and continuing to build out and attract network relationships in our existing markets. We also intend to expand into new markets, leveraging our AVA technology platform, which has been designed to scale and allow us to provide a predictable and replicable member experience across new markets. Our strategy hinges on our ability to satisfy our members in our existing markets, achieve and maintain high Star ratings for our plans, submit successful bids to CMS for new plans and/or in new markets, attract new members, form alliances with primary care providers, and hire physicians, nurses and other medical support staff for our in-house care delivery programs, among other factors. We also seek growth opportunities through strategic acquisitions and vertical integration, as well as through joint ventures or other strategic arrangements. We cannot guarantee that we will be successful in pursuing our growth strategy. If we fail to evaluate and execute new business opportunities properly, we may not achieve anticipated benefits and may incur increased costs.
Our growth strategy involves a number of risks and uncertainties, including that:
•we may not be able to successfully enter into contracts with local providers in existing or new markets on terms favorable to us or at all. In addition, we compete for provider relationships with many other health care plans, some of whom may have greater resources than we do. This competition may intensify due to the ongoing consolidation in the healthcare industry, which may increase our costs to pursue such opportunities;
•we may not be able to maintain and improve the satisfaction levels of our members, which could lead to decreased ratings for some of our plans in the Five Star Quality Rating System and consequently to loss of the economic incentives associated with high Star ratings, which could negatively impact our revenues;
15
Table of Contents
•we may not be able to enroll or retain a sufficient number of new members to execute our growth strategy, and we may incur substantial costs to enroll new members but may be unable to enroll a sufficient number of new members to offset those costs;
•we may not be able to realize the value of our AVA technology platform;
•we may not be able to hire or otherwise engage sufficient numbers of physicians and other staff and may fail to integrate our employees, particularly our medical personnel, into our in-house care model;
•we may not be successful in maintaining our reputation and brand in our existing markets or in establishing our reputation and brand with new members or into new markets;
•we may be unsuccessful in identifying or in executing key strategic joint ventures or other arrangements to facilitate our entry into new markets;
•when expanding our business into new states, we may be required to comply with laws and regulations that may differ from states in which we currently operate;
•when expanding into new markets, we may face competition with greater knowledge of such local markets;
•expansion into new offerings or new markets, or the acquisition of complementary businesses or assets, may require us to raise additional capital, which may not be available on desirable terms or at all; and
•depending upon the nature of the local market, we may not be able to implement our business model in every local market that we enter, which could negatively impact our revenues and financial condition.
Pursuing our growth strategy requires significant capital expenditures, the allocation of valuable management resources, and the hiring of additional personnel, and may strain our operations, and our financial and management controls and reporting systems and procedures. For a variety of reasons, we may not succeed in achieving scale, improving our operating efficiency or gaining operating leverage. Moreover, we have experienced and may in the future continue to experience attrition, which may further exacerbate these challenges. If we are unable to effectively execute our growth strategy and manage our growth, our results of operations and financial condition could be materially and adversely affected.
If we are unable to attract new members, our revenue growth will be adversely affected.
We currently derive substantially all of our revenue from CMS contracts related to our Medicare Advantage health plans. To increase our revenue, we must grow by expanding the number of members under our plans in the markets in which we currently operate and in the new markets that we intend to enter. In order to support such growth, we must continue to enroll and retain a sufficient number of new members. We have experienced significant member growth since we commenced operations; however, we may not be able to maintain this growth, and our member base could decrease rapidly or shrink over time. Even if we are successful in achieving and maintaining growth, doing so may be more costly than we anticipate, and if we are not able to manage our costs, our results could be materially adversely affected.
We are focused on the Medicare-eligible population and face competition from other plans in the enrollment of Medicare-eligible potential members. If we are unable to obtain CMS contracts for new plans or in new markets and convince the Medicare-eligible population of the benefits of our plans, or if potential or existing members prefer a plan offered by one of our competitors, we may not be able to effectively implement our growth strategy. Our ability to attract new members will depend on a variety of factors, including the following:
•our ability to create new plans and/or ancillary benefits;
•our ability to achieve and maintain high Star ratings for each of our plans;
•our ability to effectively promote our plans in our existing markets and the new markets we intend to enter;
•our allocation of management and financial resources toward efforts to grow our membership in certain markets;
•the extent to which eligible beneficiaries shop for MA plans in the markets we enter;
•our ability to establish relationships with provider groups and other key market constituencies;
•our competitor’s products and pricing strategies;
•our ability to establish and grow our reputation and brand in new and existing markets;
•the extent to which the overall pool of MA-eligible beneficiaries continues to grow and the extent to which the historical trend of increased MA market penetration continues;
•if our strategic partners terminate or fail to renew our current contracts or we fail to enter into contracts with new strategic partners; and
•regulatory changes affecting the overall pool of MA-eligible beneficiaries and our ability to navigate the applicable regulatory requirements.
16
Table of Contents
In addition, our growth strategy is partially dependent on beneficiaries electing to move from fee-for-service to one of our Medicare Advantage plans, or electing to move from their current Medicare Advantage plan and selecting us as their Medicare Advantage plan. In certain instances, original Medicare or other insurers’ MA plans may be more attractive to a consumer than our MA plans. For example, though our PPO members are enrolled in plans that enable them to visit any doctor participating in Medicare who will see them, our HMO plans have restrictions on the network of doctors that HMO members can see, and in some markets other providers participating in Medicare may choose to see no MA members or only MA members participating in specific plans. It is also possible that original Medicare or other insurers’ MA plans may offer broader physician networks in particular markets or highly competitive benefits, in which case those plans may be more attractive to some consumers than our MA plans. When the time to choose an MA plan comes, newly Medicare-eligible consumers may also choose to continue with their current insurer which was offered by their employer instead of transitioning to one of our plans.
For a majority of individuals, plan enrollment selections for Medicare Advantage are made during an annual enrollment period from October into December of each year; therefore, our ability to grow our member population is dependent in substantial part on our ability to successfully enroll members during the annual enrollment period and to convince such individuals not to subsequently change that election. If our ability to market and sell our MA plans is constrained during an enrollment period for any reason, such as technology failures, reduced allocation of resources, any inability to timely employ, license, train, certify and retain employees and contractors and agents to sell plans, interruptions in the operation of our website or systems, or disruptions caused by other external factors, such as natural disasters or civic disorder, we could acquire fewer new members than expected or suffer a reduction in the number of our existing members.
Our inability to enroll new members and retain existing members would harm our ability to execute our growth strategy and may have a material adverse effect on our business operations and financial position.
If we do not design and price our products properly and competitively, if we are unable to develop new products and implement clinical initiatives to provide a better healthcare experience for our members, lower costs, and appropriately document the risk profile of our members, or if our estimates of benefits expense are inadequate, our profitability may be materially adversely affected.
We use a substantial portion of our revenues to pay the costs of healthcare services delivered to our members by third-party providers. These costs include claims payments, capitation payments to providers (predetermined amounts paid to cover services), administrative costs and various other costs incurred to provide health insurance coverage to our members. These costs also include estimates of future payments to hospitals and other providers for medical care provided to our members. Generally, premiums in the healthcare business are fixed for one-year periods and we are required by federal law to spend a fixed amount of these premiums on healthcare services, covered benefits and quality improvement efforts. Accordingly, costs we incur in excess of our benefit cost projections generally are not recovered in the contract year through higher premiums and our ability to enhance the profitability of our plans depends in significant part on our ability to estimate the costs of our future benefit claims and other expenses. We make these estimates using actuarial methods and assumptions based upon claim payment patterns, medical inflation, historical developments, including claim inventory levels and claim receipt patterns, and other relevant factors. We also record benefits payable for future payments. We continually review estimates of future payments relating to benefit claims costs for services incurred in the current and prior periods and make necessary adjustments to our reserves, including premium deficiency reserves where appropriate. However, these estimates involve extensive judgment and have considerable inherent variability that is sensitive to claim payment patterns and medical cost trends. Many factors may and often do cause actual healthcare costs to exceed what was estimated and used to set our premiums. These factors may include:
•increased use of medical facilities and services;
•increased cost of such services;
•increased use or cost of prescription drugs, including specialty prescription drugs;
•the introduction of new or costly treatments, including new technologies;
•the extent to which providers in our network follow appropriate care recommendations and carry out effective care coordination and care management;
•our membership mix;
•the extent to which members decline to seek out appropriate preventative care or follow their physicians’ care and healthful living recommendations;
•variances in actual versus estimated levels of cost associated with new products, benefits or lines of business, product changes or benefit level changes;
•changes in the demographic characteristics of an account or market;
•changes or reductions of our utilization management functions such as preauthorization of services, concurrent review or requirements for physician referrals;
•catastrophes, including acts of terrorism, public health epidemics, or severe weather (e.g., hurricanes and earthquakes), which may increase both use and cost of medical services and cause members to delay obtaining services, affecting their long-term health;
17
Table of Contents
•medical cost inflation; and
•government mandated benefits, member eligibility criteria, or other legislative, judicial, or regulatory changes.
Key to our operational strategy is the implementation of clinical initiatives that we believe provide a better healthcare experience for our members, lower the cost of healthcare services delivered to our members, and appropriately document the risk profile of our members. Our profitability and competitiveness depend in large part on our ability to leverage our technology platform, AVA, to optimize and appropriately manage healthcare costs by, among other things, proactively managing member care.
Increases or decreases in staff and provider-related expenses, any costs associated with exiting products, additional investment in new products and in the expansion of clinical and technological capabilities as part of our integrated care delivery model, investments in health and well-being product offerings, acquisitions, new taxes and assessments, and implementation of regulatory requirements may increase our operating expenses. Any failure to adequately price our products or estimate sufficient benefits payable or effectively manage our operating expenses may result in a material adverse effect on our results of operations, financial position, and cash flows.
Premium increases, introduction of new product designs, and our relationships with our providers in various markets, among other issues, could also affect our membership levels. Other actions that could affect membership levels include our possible exit from or entrance into markets, or the termination of a large contract. If we do not compete effectively in our markets, if we set rates too high or too low in highly competitive markets to keep or increase our market share, if membership does not increase as we expect, if membership declines, or if we lose membership with favorable medical cost experience while retaining or increasing membership with unfavorable medical cost experience, our results of operations, financial position, and cash flows may be materially adversely affected.
We may not be successful in maintaining or improving our Star ratings in future years, which may have a direct and substantial adverse impact on our revenue.
CMS measures the quality of Medicare Advantage plans through a Five Star Quality Rating System. The Star Rating system considers various measures adopted by CMS, including, among others, quality of care, preventative services, chronic illness management and member satisfaction. The achievement of Star ratings of 4-Star or higher qualifies Medicare Advantage plans for an increase in the benchmark against which they bid (potentially increasing premium payments). As of January 1, 2025, approximately 98% of our members are enrolled in rated plans that have a 4.0 Star rating or greater for the 2025 rating year / 2026 payment year. However, we may not be able to maintain or improve upon these Star ratings in future years. Failure to maintain satisfactory quality and performance measures may negatively affect our premium rates, impede our ability to compete for new business in existing or new markets or result in the termination of our contracts, or affect our ability to enter into new CMS contracts or expand the service area of current health plans. Star ratings are an important component of how MA beneficiaries select an MA plan, both during each annual enrollment period and throughout each year. Low Star ratings may reduce our membership, if members choose to enroll in higher-rated plans.
Various factors may make it difficult for us to maintain or increase our Star ratings. For example, there are numerous providers that serve our plans, and we engage multiple third-party vendors to provide supplemental plan benefits. We may have limited success in obtaining quality health care outcomes and satisfactory member experiences from these providers and vendors. As a result of our dependence upon these relationships, we may have limited ability to directly influence the overall quality rating of our plans. Additionally, our higher concentration of minority members and members residing in socioeconomically disadvantaged neighborhoods generally may make it more difficult for us to achieve and maintain high Star ratings as compared to our competitors, given the well-documented health disparities among different minority and socioeconomic groups. CMS has attempted to address some of this disparity, but the efforts may not work as intended or be sufficient to address the difficulties of serving varying member populations.
CMS updates and makes changes to the Star ratings annually. Changes implemented by CMS with respect to the Five Star Quality Rating System have, in the past, and could, in the future, negatively impact our Star ratings. For example, in rating year 2024, CMS removed performance outliers from the calculation of non-Consumer Assessment of Healthcare Providers and Systems (“non-CAHPS data”) measure rating cut points using the Tukey outlier deletion method. This change increased cut points overall, making it more difficult to achieve and maintain high Star ratings. In the 2025 Star ratings, only seven MA-Part D contracts earned a 5-star rating, a significant decrease from 31 in 2024, 57 in 2023, and 74 in 2022.
Additionally, CMS continues to make changes to Star Ratings methodology that could negatively impact our Star Ratings in future years. For example, in April 2024, CMS finalized changes to the measures used in the Star ratings, the calculation of the Categorical Adjustment Index and the Health Equity Index for contracts undergoing consolidation, and the weights assigned to certain measures. These and future adjustments to the Star rating methodology may have a negative impact on our Star ratings.
In addition, audits of our performance for past or future periods may result in downgrades to our Star ratings. For example, if a CMS audit finds that a particular issue of noncompliance impacts the data source for a Star measure, the Star measure may be reduced if the data set is deemed inaccurate or biased. Accordingly, our plans may receive a lower Star rating and may not be eligible for full level quality bonus payments, which could adversely affect the benefits we can offer, reduce membership and/or reduce profit margins. Also, CMS has the authority to terminate contracts that have had a rating of less than three Stars for three consecutive years, whereas Medicare Advantage plans with five Stars are permitted to conduct enrollment throughout almost the entire year. Because low quality ratings can potentially lead to the termination of one or more of our contracts we may not be able to prevent the potential termination of a plan or a shift of members to other plans based upon quality issues, which could, in turn, have a material adverse effect on our business, results of operations, financial condition and cash flows.
18
Table of Contents
If we fail to develop and maintain satisfactory relationships with care providers to service our members, our business may be adversely affected.
Our success requires that we maintain and grow our provider networks and contract with providers and medical facilities in new markets in order to meet CMS requirements relating to network adequacy. We contract with a variety of physicians, nurses, hospitals, clinics and other third-party providers to deliver healthcare and related services to our members. Our plans encourage or require our customers to use these contracted providers. A key component of our integrated care delivery strategy is to increase the number of providers who share medical cost risk with us or have financial incentives to deliver high quality medical services in a cost-effective manner. In order to retain our members and attract additional membership, our provider networks, including those physicians participating in Medicare and willing to see our patients but with whom we have not contracted, must be not only adequate, but attractive, providing Medicare-eligible beneficiaries access to the providers and facilities that they want.
In any particular market, providers could refuse to contract with us, demand higher payments, or take other actions that could result in higher healthcare costs for us, less desirable outcomes for members or difficulty meeting regulatory or accreditation requirements, including network adequacy requirements. In some markets, certain providers, particularly hospitals, physician specialty groups, physician/hospital organizations, or multi-specialty physician groups, may have significant market positions and negotiating power. In addition, physician or practice management companies, which aggregate physician practices for administrative efficiency and marketing leverage, may compete with us in certain circumstances. If these providers refuse to contract with us, use their market position to negotiate unfavorable contracts with us or place us at a competitive disadvantage, or do not enter into contracts with us that encourage the delivery of quality medical services in a cost-effective manner, our ability to market products or to be profitable in those areas may be adversely affected.
In some situations, we have capitation contracts with individual or groups of primary care providers and specialists for an actuarially determined, fixed fee per month to provide a basket of required medical services to our members. The inability of providers to properly manage costs under these capitation arrangements could result in the financial instability of these providers and the termination of their relationship with us. In addition, payment or other disputes between a primary care provider and specialists with whom the primary care provider contracts could result in a disruption in the provision of services to our members or a reduction in the services available to our members. The financial instability or failure of a primary care provider to pay other providers for whom they have taken professional risk for services rendered could lead those other providers to demand payment from us even though we have made our regular fixed payments to the primary care provider. Providers with whom we contract may not properly manage the costs of services, maintain financial solvency or avoid disputes with other providers. Even if we contract with sufficient numbers of providers in our markets, we may be required, from time to time, to work with providers with whom we do not contract and who are not included in our networks. This can increase our medical costs, as there is no pre-negotiated rate that we pay the provider and no incentive for the provider to control costs.
Our ability to develop and maintain satisfactory relationships with providers and facilities may also be negatively impacted by factors not associated with us, such as changes in Medicare programs and other pressures on healthcare providers, including consolidation activity among hospitals, physician groups, and other healthcare providers. We may be unable to contract with new providers, facilities and other entities in our current markets or new markets in which we enter or renew any contracts we maintain with existing providers or facilities on favorable terms, if at all. If we are unable to enter into new contracts or maintain contracts with providers or facilities in certain markets, we may be unable to meet network adequacy requirements, which would prevent us from serving such markets and could have a material adverse effect on our business, financial condition and results of operations.
If we fail to manage our growth effectively, we may be unable to execute our business plan, maintain high levels of service and member satisfaction or adequately address competitive challenges.
We have experienced, and may continue to experience, rapid growth and organizational change, which has placed, and may continue to place, significant demands on our management and our operational and financial resources. Additionally, our organizational structure may become more complex as we improve our operational, financial and management controls, as well as our reporting systems and procedures. We may require significant capital expenditures and the allocation of valuable management resources to grow and change in these areas. We must rapidly scale our technology platform, effectively increase our headcount and expand our provider networks, and we must continue to effectively train and manage our employees and partners. We will be unable to manage our business effectively if we are unable to alleviate the strain on resources caused by growth in a timely and successful manner. If we fail to effectively manage our anticipated growth and change, the quality of our services may suffer, which could negatively affect our brand and reputation and harm our ability to attract and retain members and employees.
In addition, as we expand our business, it is important that we continue to maintain a high level of member service and satisfaction. As our member base continues to grow, we will need to expand our product and service offerings and our network of partners to provide personalized member service. If we are not able to continue to provide high quality products, benefits and medical care with high levels of member satisfaction, our reputation, as well as our business, results of operations and financial condition could be adversely affected.
19
Table of Contents
The healthcare industry is highly competitive. There are many other healthcare plans and healthcare service providers, many of which have a longer operating history and substantially more resources, and there are few barriers to entry in the healthcare industry. This competition may have a material adverse effect on our business operations and financial position.
We compete directly with national, regional and local Medicare Advantage organizations for members and healthcare providers. Competition in our markets involves rapidly changing technologies, diverse and evolving regulatory requirements and industry expectations, new product offerings and constantly changing member and physician preferences and user requirements. We currently face competition from a range of companies, including other incumbent MA providers and health insurance companies. Many of the other companies currently providing health insurance coverage and healthcare services, particularly national insurers such as United Health, Aetna, Humana and Cigna, have been in business longer and/or have substantially more resources than we do. Other companies could enter the healthcare industry in the future and divert some or all of our business. We also face competition from traditional Medicare.
Our ability to compete successfully varies from location to location and depends on a number of factors, including the number of competing plans in the local market and the types of services available at local clinical facilities, the demographics of each market and our ability to generate offerings that meet the needs of that population, our local reputation for providing quality care to members, the commitment and expertise of the providers in our network and our in-house medical staff, our local service offerings and community programs and the cost of care in each locality. If we are unable to attract members, our revenue and profitability will be adversely affected. Some of our competitors may have greater recognition and may be more established in particular communities than we are, and they may have greater financial and other resources than we have. Competing Medicare Advantage plans may also offer different programs or services than we do, which, combined with the foregoing factors, may result in our competitors being more attractive to our current members or potential members. While health plans compete on the basis of many factors, including service and the quality and depth of provider networks, we expect that price will continue to be a significant basis of competition. Furthermore, while we budget for improvements in our products and services to keep them competitive in their respective markets, to the extent that competitive forces cause related expenditures to increase in the future, our financial condition may be negatively affected. In addition, in certain instances our relationships with providers are not exclusive and our competitors have established or could seek to establish relationships with such providers. Additionally, as we expand into new geographies, we may encounter competitors with stronger relationships or recognition in the community in such new geography, which could give those competitors an advantage in retaining current members and obtaining new members, which may have a material adverse effect on our business operations and financial position.
Our failure to compete effectively may result in fewer plans being offered; a reduction in plan benefits; reduced services; a loss of existing members or inability to grow membership; fewer physician users; reduced revenues; lower gross margins; and loss of market share. Any failure to meet and address these factors would harm our business, results of operations and financial condition.
We have entered into certain key contracts with large independent physician associations, hospitals and other provider networks to serve our membership base. The loss or renegotiation of any of these contracts could negatively impact our results.
Our provider network includes key contracts with certain large independent physician associations (“IPAs”), hospitals and other provider networks, which are critical to serving our membership base. Although we typically seek to enter into contracts spanning three or more years, after a specified period, certain of these contracts, including existing contracts with some of our largest IPA partners, hospitals or other providers, may terminate by their own terms or through notice of non-renewal. In the ordinary course of business, including in connection with renewals or extensions of these agreements, we engage in active discussions and renegotiations with these counterparties in respect of the solutions we provide and the terms of our agreements. The loss of any of our largest IPA partnerships, hospitals or other provider networks or the renegotiation of any of these contracts could adversely affect our results of operations, as this may alter the attractiveness of our provider network, result in more out-of-network claims costs and/or increase the payments we make to these counterparties.
Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our members, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation.
In the ordinary course of our business, we collect, store, process, transfer, disclose and otherwise use sensitive data, including PHI and PII relating to our employees, members and others. We also process and store, and use third-party service providers to process and store, substantial amounts of sensitive information, including intellectual property, confidential information and other proprietary business information. We manage and maintain such sensitive data and information utilizing a combination of on-site systems, managed data center systems and cloud-based computing center systems.
We are highly dependent on information technology networks and systems, including the internet, to securely process, transmit and store this sensitive data and information. Security breaches of this infrastructure, including physical or electronic break-ins, computer viruses, ransomware, attacks by hackers and other malicious actors and similar breaches, and employee or contractor error, negligence or malfeasance, can create system disruptions, shutdowns or unauthorized disclosure or modifications of such sensitive data or information, causing PHI or other PII to be accessed or acquired without authorization or to become publicly available. We utilize a third-party operated 24x7 security operations center that continuously monitors the security and privacy posture of our systems and have implemented the HITRUST Alliance's Common Security Framework as part of our certification by HITRUST; however, we cannot provide assurance that these measures will protect us from all cybersecurity threats and risks. As our third-party service providers
20
Table of Contents
manage important aspects of the collection, storage, processing and transmission of employee, user and member information, and other confidential and sensitive information, we rely on them to perform functions that have material cybersecurity risks. Because of the sensitivity of the PHI, other PII and other sensitive information we and our service providers collect, store, transmit, and otherwise process and use, the security of our technology platform and other aspects of our services, including those provided or facilitated by our third-party service providers, are important to our operations and business strategy. Measures taken to protect our systems, those of our contractors or third-party service providers, or the PHI, other PII, or other sensitive information we or contractors or third-party service providers process or maintain (including our requirement that our third-party service providers enter into business associate agreements or other required security agreements, if applicable), may not adequately protect us from the risks associated with the collection, storage, processing and transmission of such sensitive data and information. For example, we may be required to expend significant capital and other resources, such as in the performance of ongoing risk assessments of our and our third-party service providers’ information systems, to protect against security breaches or to alleviate problems caused by security breaches. Because cyber-attacks are becoming more sophisticated and frequent and the techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not identified until they are launched against a target, despite the implementation of security measures, we or our third-party service providers may be unable to anticipate these techniques or to implement adequate protective measures.
A security breach or privacy violation that leads to disclosure or unauthorized use or modification of, or that prevents access to or otherwise impacts the confidentiality, security, or availability of, member information, including PHI or other PII, or other sensitive information we or our contractors or third-party service providers maintain or otherwise process, could harm our reputation and brand, compel us to comply with breach notification laws, and cause us to incur significant costs for remediation, fines, penalties, providing notification to individuals. We would need to identify and implement measures intended to repair or replace systems or technology and to prevent future occurrences, and we could face potential increases in insurance premiums. This is of particular risk when considering tight integration with third-party service providers who manage or provide parts of our information systems. If we are unable to prevent or mitigate such security breaches or privacy violations or implement satisfactory remedial measures, or if it is perceived that we have been unable to do so, our operations could be disrupted, we may be unable to provide access to our systems, and we could suffer a loss of members. We may also suffer loss of reputation, adverse impacts on member and investor confidence and financial loss, and we would be exposed to the risk of governmental investigations or other actions, regulatory or contractual penalties, and other claims and liabilities, including liability under laws and regulations that protect the privacy of member information or other personal information, such as HIPAA. In addition, security breaches and other inappropriate access to, or acquisition or processing of, information can be difficult to detect, and any delay in identifying such incidents or in providing any notification of such incidents may lead to increased harm.
Any such breach or interruption of our systems or those of any of our third-party service providers could also result in the compromise of our trade secrets and other proprietary information, which could adversely affect our business and competitive position. While we maintain insurance covering certain security and privacy damages and claim expenses, we may not carry insurance or maintain coverage sufficient to compensate for all liability and in any event, insurance coverage would not address the reputational damage that could result from a security incident.
Our service offering is driven by our core operating technology platform, AVA, allowing us to access and analyze comprehensive member data quickly, generating insights and alerts using such data and making recommendations to members and practitioners. AVA and the other systems or networks used in our business may experience an increase in attempted cyber-attacks, targeted intrusion, ransomware and phishing campaigns seeking to take advantage of shifts to employees and healthcare providers working remotely using their household or personal internet networks.
A data breach could result in incorrect or delayed medical recommendations and prescriptions, missed alerts and missed opportunities to intervene for our members on a timely basis. Unauthorized access, loss or dissemination could also disrupt our operations, including our ability to perform our services, access member health information, collect, process, and prepare company financial information, provide information about our current and future services and engage in other member and clinician education and outreach efforts. Any of the foregoing could have a material adverse effect on our business, results of operations and financial condition.
Disruptions in our disaster recovery systems or management continuity planning could limit our ability to operate our business effectively and adequately care for our members.
Our information technology systems facilitate our ability to conduct our business. The functioning of AVA, our technology platform, is critical to our ability to adequately care for our members and drive health outcomes. While we have disaster recovery systems and business continuity plans in place and such plans are reviewed annually as part of our third-party HITRUST certification, there may be disruptions in our disaster recovery systems or the failure of these systems to operate as expected. Such events could, depending on the magnitude of the problem, adversely affect our operating results and the health of our members by limiting our capacity to effectively monitor and control our operations. Despite our implementation of a variety of security measures, our information technology systems could be subject to physical or electronic break-ins or disruptions from unauthorized tampering, fires, power loss, telecommunication failures or any weather-related disruptions where our headquarters is located or at locations that host portions of our technology platform. In addition, in the event that a significant number of our personnel were unavailable in the event of a disaster, our ability to effectively conduct business and adequately care for our members could be adversely affected.
As a government contractor, we are exposed to risks that may materially adversely affect our business, including the potential loss of CMS contracts, significant changes to the Medicare Advantage and/or Part D programs, potential suspension from participating in
21
Table of Contents
the Medicare Advantage program, changes to the risk-adjustment model used to determine the premiums paid to Medicare Advantage plans, changes to provisions for risk sharing under Medicare Part D and risks related to governmental audits and investigations, among others.
A significant portion of our revenue relates, directly or indirectly, to the Medicare Advantage program, which accounted for substantially all of our total revenue for the year ended December 31, 2024. Participating in the Medicare Advantage program exposes us to various risks, as described further below.
•As of January 1, 2025, under our contracts with CMS, we provided health insurance coverage to approximately 209,900 individual Medicare Advantage members. Our continued participation in the Medicare Advantage program through these and other contracts is not guaranteed. Our CMS contracts are subject to annual renewal, and CMS must also annually approve our bids for the plans we intend to offer under each contract. The loss of these and other CMS contracts or significant changes to the terms thereof may have a material adverse effect on our business, results of operations and financial condition.
•Either Congress or CMS may at any time enact significant changes to the Medicare Advantage program, and these changes may materially impact our profitability. For example, there may be changes to the amount or calculation of our premium payments, the mandated member benefits, or member eligibility criteria without corresponding increases in our premium payments, or the timing of payments. We have no control over these changes, including when or how frequently they are made. In addition, CMS annually establishes benchmark payment rates for Medicare Advantage organizations, and these rates may decrease or not keep pace with our expected medical costs. Any of these, or other, changes to the Medicare Advantage program and our payment rates may have a material adverse effect on our business, results of operations and financial condition.
•CMS may terminate our Medicare Advantage contracts if there is credible evidence that we have committed or participated in false, fraudulent, or abusive activities, including the submission of false or fraudulent data. Additionally, we may be subject to scrutiny under the federal False Claims Act (the “FCA”) for the alleged submission of fraudulent information. As a recipient of federal money, we may be subject to qui tam litigation brought by individuals who seek to sue on behalf of the government, alleging that the recipient submitted false claims to the government. Litigation of this nature is filed under seal to allow the government an opportunity to investigate and to decide if it wishes to intervene and assume control of the litigation. If the government does not intervene, the lawsuit is unsealed, and the individual may continue to prosecute the action on his or her own.
•CMS uses a risk-adjustment model which adjusts premiums paid to Medicare Advantage organizations according to the health status of covered members. The risk-adjustment model, which CMS implemented pursuant to the Balanced Budget Act of 1997 and the Benefits Improvement and Protection Act of 2000 (“BIPA”), generally pays more where a plan’s membership has higher expected costs. Under this model, amounts paid to Medicare Advantage organizations are based, in part, on actuarially determined bids, which include a process whereby our prospective payments are based on our estimated cost of providing standard Medicare-covered benefits to an enrollee with a “national average risk profile.” That baseline payment amount is adjusted to reflect the health status of our enrolled membership. Under the risk-adjustment methodology, all Medicare Advantage organizations must collect and submit the data from hospital inpatient, hospital outpatient, and physician services to CMS within prescribed deadlines. The CMS risk-adjustment model uses the diagnosis data to calculate the risk-adjusted premium payment to Medicare Advantage organizations, which CMS adjusts for coding pattern differences between the health plans and the government fee-for-service program. In certain cases, we rely on providers, including certain providers in our network who are our employees, to code their claim submissions with appropriate diagnoses, which we send to CMS as the basis for our payment received from CMS under the actuarial risk-adjustment model. We also rely on these providers to document appropriately all medical data, including the diagnosis data submitted with claims, and we rely on our technology platform to aggregate, organize, interpret and report such data. In addition, we conduct medical record reviews as part of our data and payment accuracy compliance efforts, to more accurately reflect diagnosis conditions under the risk adjustment model. These compliance efforts include the internal contract level audits described in more detail below, as well as ordinary course reviews of our internal business processes.
CMS and the Office of the Inspector General of Health and Human Services (“HHS-OIG”), are continuing to perform audits of various companies’ selected Medicare Advantage contracts related to this risk adjustment diagnosis data. We refer to these audits as Risk-Adjustment Data Validation Audits (“RADV audits”). RADV audits review medical records in an attempt to validate provider medical record documentation and coding practices which influence the calculation of premium payments to Medicare Advantage organizations.
In 2012, CMS released a “Notice of Final Payment Error Calculation Methodology for Part C Medicare Advantage Risk Adjustment Data Validation (RADV) Contract-Level Audits.” The payment error calculation methodology provided that, in calculating the economic impact of audit results for a Medicare Advantage contract, if any, the results of the RADV audit sample would be extrapolated to the entire Medicare Advantage contract. Additionally, the estimated payment error rate identified during the audit would be compared to a similar audit of the government’s traditional FFS Medicare program. We refer to the process of accounting for errors in fee-for-service claims as the “FFS Adjuster.” This comparison of RADV audit results to the FFS error rate is necessary to
22
Table of Contents
determine the economic impact, if any, of RADV audit results because the government used the traditional fee-for-service Medicare program data set, including any attendant errors that are present in that data set, to estimate the costs of various health status conditions and to set the resulting adjustments to Medicare Advantage plans’ payment rates in order to establish actuarial equivalence in payment rates as required under the Medicare statute. CMS already makes other adjustments to payment rates based on a comparison of coding pattern differences between Medicare Advantage plans and traditional fee-for-service Medicare program data (such as for frequency of coding for certain diagnoses in Medicare Advantage plan data versus the traditional fee-for-service Medicare program dataset).
CMS released a final rule on January 30, 2023, which changes both the use of extrapolation and the application of the FFS Adjuster. Specifically, CMS will not extrapolate audit results for any audits covering payment years prior to 2018. Additionally, CMS will not apply any FFS Adjuster in RADV audits. These changes are expected to have a material impact on Medicare Advantage organizations, including us. In November 2024, CMS announced it had initiated the payment year 2018 RADV audits, and it expects to begin issuing the audit findings in mid-calendar year 2026, including instructions on how the overpayments will be collected as part of the audit.
In addition, as part of our internal compliance efforts, we routinely perform ordinary course reviews of our internal business processes related to, among other things, our risk coding and data submissions in connection with the risk-adjustment model. These reviews may also result in the identification of errors and the submission of corrections to CMS, that may, either individually or in the aggregate, be material. As such, the result of these reviews may have a material adverse effect on our results of operations, financial position, or cash flows.
•Our CMS contracts that cover members’ prescription drugs under Medicare Part D contain provisions for risk sharing and certain payments for prescription drug costs for which we are not at risk. These provisions, certain of which are described below, affect our ultimate payments from CMS.
Our losses or gains are limited by risk corridor provisions which compare costs targeted in our annual bids to our allowable costs under the plan, limited to actual costs that were incurred for the standard coverage as defined by CMS. Variances exceeding certain thresholds may result in CMS making additional payments to us or require us to refund to CMS a portion of the premiums we received (known as a “risk corridor”). We estimate and recognize an adjustment to premiums revenue related to the risk corridor payment settlement based upon pharmacy claims experience. The estimate of the settlement associated with these risk corridor provisions requires us to consider factors that may not be certain, including member eligibility differences with CMS.
Reinsurance and low-income cost subsidies represent payments from CMS in connection with the Medicare Part D program. Reinsurance subsidies represent payments for CMS’s portion of claims costs which exceed the member’s out-of-pocket threshold, or the catastrophic coverage level. Low-income cost subsidies represent payments from CMS for all or a portion of the deductible, the coinsurance and co-payment amounts above the out-of-pocket threshold for low-income beneficiaries. Monthly prospective payments from CMS for reinsurance and low-income cost subsidies are based on assumptions submitted with our annual bid. A reconciliation and settlement of CMS’s prospective subsidies against actual prescription drug costs we paid, as well as other factors, is made after the end of the applicable year.
Settlement of the reinsurance and low-income cost subsidies as well as the risk corridor payment is based on a reconciliation made approximately nine months after the close of each calendar year. This reconciliation process requires us to submit claims data necessary for CMS to administer the program. Our claims data may not pass CMS’s claims edit processes due to various reasons, including discrepancies in eligibility or classification of low-income members. To the extent our data does not pass CMS’s claim edit processes, we may bear the risk for all or a portion of the claim which otherwise may have been subject to the risk corridor provision or payment which we would have otherwise received as a low-income subsidy or reinsurance claim. In addition, in the event the settlement represents an amount CMS owes us, there is a negative impact on our cash flows and financial condition as a result of financing CMS’s share of the risk. The opposite is true in the event the settlement represents an amount we owe CMS.
•We are also subject to various other governmental audits and investigations. Under state laws, we are audited by state departments of insurance for financial and contractual compliance and by state departments of health. Audits and investigations, including audits of risk adjustment data, are also conducted by state attorneys general, CMS, HHS-OIG, the Office of Personnel Management, the Department of Justice (“DOJ”) and the Department of Labor. Findings from these audits and investigations could result in, among other things, the loss of licensure or the right to participate in the Medicare Advantage or other programs, a limitation on our ability to market or sell products, a suspension on our ability to enroll new members, a requirement to refund money to the government, the imposition of fines, penalties and other civil and criminal sanctions, or changes in our business practices. The outcome of any current or future governmental or internal investigations cannot be accurately predicted, nor can we predict any resulting penalties, fines or other sanctions that may be imposed at the discretion of federal or state regulatory authorities. Nevertheless, it is possible that any such outcome of litigation, penalties, fines or other sanctions could be substantial, and the outcome of these matters may have a material adverse effect on our results of operations, financial position, and cash flows. Responding to subpoenas, investigations and other lawsuits, claims and legal proceedings as well as defending ourselves in such matters would divert management’s attention and cause us to
23
Table of Contents
incur significant legal expense. Negative findings or terms and conditions that we might agree to accept as part of a negotiated resolution of pending or future legal or regulatory matters could result in, among other things, substantial financial penalties or awards against us, substantial payments made by us, required changes to our business practices, exclusion from future participation in the Medicare Advantage Programs and, in certain cases, criminal penalties, any of which could have a material adverse effect on us. Certain of these matters could also affect our reputation. In addition, disclosure of any adverse investigation or audit results or sanctions could negatively affect our industry or our reputation in various markets and make it more difficult for us to sell our products and services.
The Inflation Reduction Act of 2022 contains several provisions that affect the Part D program. These changes may require us to change our prescription drug offerings, reduce our profitability, and otherwise impact our financial performance.
The Inflation Reduction Act of 2022 (“IRA”), signed into law on August 16, 2022, reflects an ongoing effort to control prescription drug costs and reduce spending by the federal government. The IRA contains several provisions that impact the Part D program and that may influence our benefit design and profitability. For example, beginning in 2024, Part D plans were required to eliminate member cost-sharing in the catastrophic phase of the benefit, and beginning in 2025, the coverage gap phase was eliminated. Part D plans must now also implement a cap on member out-of-pocket spending of $2,000. These changes have the potential to increase the financial responsibility of Part D plan sponsors. Furthermore, beginning in 2025, Part D plans must offer enrollees the option to pay out-of-pocket prescription drug costs in the form of capped monthly payments instead of all at once at the pharmacy. This may increase administrative burdens for plans by requiring new payment tracking systems and risk management strategies. These changes may significantly alter the plans that we offer and may adversely affect our business, results of operations and financial condition.
We may be subject to legal proceedings and litigation, including intellectual property and privacy disputes, which are costly and could materially harm our business and results of operations.
We may be party to lawsuits and legal proceedings in or outside of the normal course of business, whether initiated by third parties or by us. These matters are often expensive and disruptive to normal business operations. We may face allegations, lawsuits and regulatory inquiries, audits and investigations regarding the denial of healthcare benefit payments, compensation or non-acceptance or termination of provider contracts, medical malpractice (based on our medical necessity decisions or brought against us on the theory that we are liable for providers’ alleged malpractice) or professional liability (in connection with the delivery of healthcare and related services to the public). We may initiate litigation or administrative proceedings, including, without limitation, to address regulatory matters or to protect our intellectual property. We may be subject to class-action lawsuits, shareholder derivative suits, or other litigation arising from alleged violations of federal or state securities laws or of Delaware corporate law. We may also face quitam allegations or lawsuits brought by individuals who seek to sue on behalf of the government including, among other allegations, resulting from coding and review practices under the Medicare Advantage risk-adjustment model.
We also may be subject to lawsuits under the FCA and comparable state laws for submitting allegedly fraudulent or otherwise inappropriate risk adjustment or Stars data. These lawsuits, which may be initiated by government authorities as well as private party relators, can involve significant monetary damages, fines, attorney fees and the award of bounties to private plaintiffs who successfully bring these suits, as well as to the government programs. In recent years, government oversight and law enforcement have become increasingly active and aggressive in investigating and taking legal action against potential fraud, waste and abuse. Fraud, waste, and abuse prohibitions encompass a wide range of activities, including kickbacks for referral of members, fraudulent coding practices, billing for unnecessary medical and/or other covered services, improper marketing and violations of patient privacy rights. The DOJ and the Department of Health and Human Services Office of Inspector General (“OIG”), have recently increased their scrutiny of healthcare payers and providers, and Medicare Advantage insurers, under the federal FCA, in particular, and there have been a number of investigations, prosecutions, convictions and settlements in the healthcare industry. The FCA provides for treble damages and significant mandatory minimum penalties for each false claim or statement. Healthcare plans and providers thus often seek to resolve these types of allegations through settlement for significant and material amounts, including in circumstances where they do not acknowledge or admit liability, to avoid the uncertainty of treble damages that may be awarded in litigation proceedings. Such settlements often contain additional compliance and reporting requirements as part of a consent decree or settlement agreement, including, for example, corporate integrity agreements.
Additionally, we may face allegations, lawsuits and regulatory inquiries, audits and investigations regarding data privacy and security, labor and employment, consumer protection and intellectual property infringement, misappropriation or other violation, including claims related to patents, publicity, trademarks, copyrights and other intellectual property or proprietary rights. We may also face allegations or litigation related to our acquisitions, securities issuances or business practices, including public disclosures about our business.
Litigation and regulatory proceedings may be protracted and expensive, and the results are difficult to predict. Certain of these matters may include speculative claims for substantial or indeterminate amounts of damages and include claims for injunctive relief. Additionally, our litigation costs could be significant. Adverse outcomes with respect to litigation or any of these legal proceedings may result in significant settlement costs or judgments, penalties and fines, or require us to modify our services or require us to stop serving certain members or geographies, all of which could negatively impact our geographical expansion and revenue growth. We may also become subject to periodic audits, which would likely increase our regulatory compliance costs and may require us to change our business practices, which could negatively impact our revenue growth. Managing legal proceedings, litigation and audits, even if we achieve favorable outcomes, is time-consuming and diverts management’s attention from our business. Accordingly, such proceedings could harm our reputation, business, financial condition, results of operations and the market price of our common stock.
24
Table of Contents
Although we maintain third-party professional liability insurance coverage and managed care errors and omissions policies, it is possible that claims against us may exceed the coverage limits of our insurance policies. Even if any professional liability loss is covered by an insurance policy, these policies typically have substantial deductibles for which we are responsible. Professional liability claims in excess of applicable insurance coverage could have a material adverse effect on our business, financial condition and results of operations. In addition, any professional liability claim brought against us, with or without merit, could result in an increase of our professional liability insurance premiums. Insurance coverage varies in cost and can be difficult to obtain, and we cannot guarantee that we will be able to obtain insurance coverage in the future on terms acceptable to us or at all. If our costs of insurance and claims increase, then our earnings could decline.
Our business may be adversely impacted if the healthcare services industry becomes more cyclical.
In the past, healthcare utilization generally has trended upward over time, regardless of minor fluctuations in the U.S. economy. We believe this trend may change, however, as consumers have been given more decision-making and spending responsibility. In turn, we believe members are making healthcare purchases on a more discretionary basis, especially for elective procedures. This could result in a more cyclical trend in healthcare utilization over the coming years and may cause short-term volatility in our operating results.
Any failure by us to manage acquisitions, joint ventures, divestitures and other significant transactions successfully may have a material adverse effect on our results of operations, financial position, and cash flows.
As part of our business strategy, we engage in discussions with third parties regarding possible investments, acquisitions, divestitures, strategic alliances, joint ventures, and outsourcing transactions and may enter into agreements relating to such transactions in order to further our business objectives. Such transactions may not always align properly with our strategic objectives and may not deliver the expected benefits within the timeframes anticipated or at all. In order to pursue our acquisition strategy successfully, we must identify suitable candidates for and successfully complete transactions, some of which may be large and complex, and manage post-closing issues such as the integration of acquired companies or employees. Integration and other risks can be more pronounced for larger and more complicated transactions, transactions outside of our core business space, or if multiple transactions are pursued simultaneously. Delays or difficulties in aligning key integration elements may result in operational disruptions, decreased productivity, and the failure to realize anticipated synergies, leading to a negative impact on financial performance. Moreover, the failure to successfully integrate acquired entities and businesses or failure to produce results consistent with the financial model used in the analysis of our acquisitions, investments, joint ventures or strategic alliances may cause asset write-offs, restructuring costs or other expenses and may have a material adverse effect on our results of operations, financial position, and cash flows. Acquisitions and joint ventures may expose us to legal and regulatory risks, including compliance with antitrust laws, contractual obligations, and other regulatory requirements. Failure to navigate these complexities may result in legal disputes, regulatory scrutiny, or financial penalties. If we fail to identify and successfully complete transactions that further our strategic objectives, we may be required to expend additional resources to expand our business organically.
If we are not able to maintain, enhance and protect our reputation and brand recognition, including through the maintenance and protection of trademarks, our business and results of operations will be harmed.
We believe that maintaining and enhancing our reputation and brand recognition is critical to our relationships with both members and providers and to our ability to attract new members. The promotion of our brand may require us to make substantial investments and we anticipate that, as our market becomes increasingly competitive, these marketing initiatives may become increasingly difficult and expensive. Moreover, our current marketing efforts to date have been limited to certain geographic regions and markets where our business operates to facilitate the efficient use of resources. If we grow nationally, we will need to spend additional resources to build strong national brand recognition and our efforts may not be effective. Our marketing activities may not be successful or yield increased revenue, and to the extent that these activities yield increased revenue, the increased revenue may not offset the expenses we incur and our results of operations could be harmed.
Any factor that diminishes our reputation or that of our management, including failing to meet the expectations of or provide quality service to our members, or any adverse publicity or litigation involving or surrounding us or our management, could make it substantially more difficult for us to attract new members and retain existing members. Similarly, because our existing members often act as references for us with prospective new members, any existing member that questions the quality of our care could impair our ability to secure additional new members. In addition, negative publicity resulting from any adverse government audit could injure our reputation. If we do not successfully maintain and enhance our reputation and brand recognition, our business may not grow and we could lose our relationships with members or providers, which would harm our business, results of operations and financial condition.
The registered or unregistered trademarks or trade names that we own may be challenged, infringed, circumvented, diluted, declared generic, lapsed or determined to be infringing on or dilutive of other marks. We may not be able to protect our rights in these trademarks and trade names, which we need in order to build name recognition with members, providers and other partners. In addition, third parties may in the future file for registration of trademarks similar or identical to our trademarks. If they succeed in registering or developing common law rights in such trademarks, and if we are not successful in challenging such third-party rights, we may not be able to use these trademarks to commercialize our technologies in certain relevant jurisdictions. If we are unable to establish name recognition based on our trademarks and trade names, we may not be able to compete effectively and our brand recognition, reputation and results of operations may be adversely affected.
25
Table of Contents
Our business depends on our ability to effectively invest in, implement improvements to and properly maintain the uninterrupted operation and data integrity of our information technology platform and other business systems.
Our business is highly dependent on maintaining effective information systems, including our AVA platform, as well as the integrity and timeliness of the data we use to serve our members, support our in-house care teams and external providers and operate our business. Because of the large amount of data that we collect and manage, it is possible that hardware failures or errors in our systems could result in data loss or corruption or cause the information that we collect to be incomplete or contain inaccuracies that our in-house care teams, external providers and other partners regard as significant. If our data were found to be inaccurate or unreliable due to fraud or other error, or if we, or any of the providers we engage, were to fail to maintain information systems and data integrity effectively, we could experience operational disruptions that may impact our members, in-house care teams and external providers and other partners and hinder our ability to provide products and services, retain and attract members, manage our member risk profiles, report timely and accurate financial results and maintain regulatory compliance, among other things.
Natural disasters or widespread civic disruptions could also cause our third-party data center hosting facilities and cloud computing platform providers, which are critical to our infrastructure, to shut down their business, experience security incidents that impact our business, delay or disrupt performance or delivery of services, or experience interference with the supply chain of hardware required by their systems and services, any of which could materially adversely affect our business. Limitations on access or disruptions to services provided by some of the external care providers upon which our platform and business operations rely could interrupt our ability to provide our platform, decrease the productivity of our workforce and provider networks, and significantly harm our business operations, financial condition and results of operations.
Our information technology strategy and execution are critical to our continued success because our technology platform is at the center of our business model. We must continue to invest in long-term solutions that will enable us to anticipate member needs and expectations, enhance the member experience, act as a differentiator in the market and protect against cybersecurity risks and threats. Our success is dependent, in large part, on maintaining the effectiveness of existing technology systems and continuing to deliver and enhance technology systems that support our business processes in a cost-efficient and resource-efficient manner. Increasing regulatory and legislative changes will place additional demands on our information technology infrastructure that could have a direct impact on resources available for other projects tied to our strategic initiatives. In addition, continued trends toward greater member engagement and increased regulatory scrutiny in healthcare require new and enhanced technologies. Connectivity among technologies is becoming increasingly important. We must also develop new systems to meet current market standards and keep pace with continuing changes in information processing technology, evolving industry and regulatory standards and member needs. Failure to do so may present compliance challenges and impede our ability to deliver products and services in a competitive manner. Further, because system development projects are long-term in nature, they may be more costly than expected to complete and may not deliver the expected benefits upon completion. Our failure to effectively invest in, implement improvements to and properly maintain the uninterrupted operation and data integrity of our information technology and other business systems could adversely affect our business, financial condition and results of operations.
If we are unable to obtain, maintain, protect and enforce intellectual property protection for our technology or if the scope of our intellectual property protection is not sufficiently broad, others may be able to develop and commercialize technology substantially similar to ours, and our ability to successfully commercialize our technology may be adversely affected.
Our business depends on internally developed technology and content, including software, databases, confidential information and know-how, such as the AVA platform, the protection of which is crucial to the success of our business. We rely on a combination of trademark, trade secret and copyright laws and confidentiality procedures and contractual provisions to protect our intellectual property rights in our internally developed technology and content. We may, over time, increase our investment in protecting our intellectual property through additional trademark, patent and other intellectual property filings that could be expensive and time-consuming. Effective trademark, trade secret, copyright and other intellectual property protection is expensive to develop and maintain, both in terms of initial and ongoing registration requirements and the costs of defending our rights. These measures, however, may not be sufficient to offer us meaningful protection. Additionally, we do not currently hold a patent or other registered or applied for intellectual property protection for AVA. If we are unable to protect our intellectual property and other proprietary rights, particularly with respect to AVA, our competitive position and our business could be harmed, as third parties may be able to commercialize and use technologies and software products that are substantially the same as ours without incurring the development and licensing costs that we have incurred. Any of our owned or licensed intellectual property rights could be challenged, invalidated, circumvented, infringed, misappropriated or otherwise violated, our trade secrets and other confidential information could be disclosed in an unauthorized manner to third parties, or our intellectual property rights may not be sufficient to permit us to take advantage of current market trends or otherwise to provide us with competitive advantages, which could result in costly redesign efforts, discontinuance of certain offerings or other competitive harm.
Monitoring unauthorized use of our intellectual property is difficult and costly. From time to time, we seek to analyze our competitors’ services, and may in the future seek to enforce our rights against potential infringement, misappropriation or other violation. However, the steps we have taken to protect our intellectual property rights may not be adequate to prevent infringement, misappropriation or other violation of our intellectual property. We may not be able to detect unauthorized use of, or take appropriate steps to enforce, our intellectual property rights. Any inability to meaningfully protect our intellectual property rights could result in harm to our ability to compete and reduce demand for our technology. Moreover, our failure to develop and properly manage new intellectual property could adversely affect our market positions and business opportunities. Also, some of our services rely on technologies and software developed
26
Table of Contents
by or licensed from third parties, and we may not be able to maintain our relationships with such third parties or enter into similar relationships in the future on reasonable terms or at all.
Uncertainty may result from changes to intellectual property legislation and from interpretations of intellectual property laws by applicable courts and agencies. Accordingly, despite our efforts, we may be unable to obtain, maintain, protect and enforce the intellectual property rights necessary to provide us with a competitive advantage. Our failure to obtain, maintain, protect and enforce our intellectual property rights could therefore have a material adverse effect on our business, financial condition and results of operations.
If we are unable to protect the confidentiality of our trade secrets, know-how and other proprietary and internally developed information, the value of our technology could be adversely affected.
We may not be able to protect our trade secrets, know-how and other internally developed proprietary information, including in relation to the AVA platform, adequately. Although we use reasonable efforts to protect this internally developed information and technology, our employees, consultants and other parties (including independent contractors and companies with which we conduct business) may unintentionally or willfully disclose our trade secrets or other proprietary information or technology to competitors. Enforcing a claim that a third party illegally disclosed or obtained and is using any of our internally developed information or technology is difficult, expensive and time-consuming, and the outcome is unpredictable. In addition, courts outside the United States are sometimes less willing to protect trade secrets, know-how and other proprietary information. We rely, in part, on non-disclosure, confidentiality and assignment-of-invention agreements with our employees, independent contractors, consultants and companies with which we conduct business to protect our trade secrets, know-how and other intellectual property and internally developed information. We may fail to enter into such agreements with all applicable parties, and such agreements may not be self-executing, or they may be breached and we may not have adequate remedies for such breach. Moreover, third parties may independently develop similar or equivalent proprietary information or reverse-engineer or otherwise gain access to our trade secrets, know-how and other internally developed information. Any of the foregoing could have a material adverse effect on our business, financial condition and results of operations.
Any restrictions on our use of, or ability to license, data, or our failure to license data and integrate third-party technologies, could have a material adverse effect on our business, financial condition and results of operations.
We depend upon licenses from third parties for some of the technology and data used in AVA, our core operating technology platform. We may be unsuccessful in maintaining those licenses, and in such an event, it is possible that alternative technology may not be available for license on favorable terms or at all. Moreover, we expect that we may need to obtain additional licenses from third parties in the future in connection with the development of our applications. In addition, we obtain a portion of the data that we use from government entities, public records, external healthcare providers and other partners. We believe that we have all rights necessary to use the data that is incorporated into our services. We cannot, however, assure you that our licenses for information will allow us to use that information for all potential or contemplated applications.
In addition, our ability to continue to offer an integrated healthcare experience to our members depends on maintaining AVA, which is partially populated with data disclosed to us by our members, the physicians in our network and our other partners with their consent. If these members, physicians and other partners revoke their consent for us to maintain, use, de-identify and share this data, consistent with applicable law, our data assets could be degraded.
In the future, data providers could withdraw their data from us or restrict our usage for any reason, including if there is a competitive reason to do so, if legislation is passed restricting the use of the data or if judicial interpretations are issued restricting use of the data that we currently use to support our services. In addition, data providers could fail to adhere to our quality control standards in the future, causing us to incur additional expense to appropriately utilize the data. If a substantial number of data providers were to withdraw or restrict their data, or if they fail to adhere to our quality control standards, and if we are unable to identify and contract with suitable alternative data suppliers and integrate these data sources into our service offerings, our ability to provide appropriate services to our members would be materially adversely impacted, which could have a material adverse effect on our business, financial condition and results of operations.
We also integrate into our internally developed applications and use third-party software to support our technology infrastructure. Some of this software is proprietary and some is open-source software. These technologies may not be available to us in the future on commercially reasonable terms or at all and could be difficult to replace once integrated into our own internally developed applications. Most of these licenses can be renewed only by mutual consent and may be terminated if we breach the terms of the license and fail to cure the breach within a specified period of time. Our inability to obtain, maintain or comply with any of these licenses could delay development until equivalent technology can be identified, licensed and integrated, which would harm our business, financial condition and results of operations.
Our third-party licenses are generally non-exclusive and our competitors may obtain the right to use any of the data and technology covered by these licenses to compete directly with us. Our use of third-party technologies exposes us to increased risks, including, but not limited to, risks associated with the integration of new technology into our solutions, the diversion of our resources from development of our own internally developed technology and our inability to generate revenue from licensed technology sufficient to offset associated acquisition and maintenance costs. In addition, if our data suppliers choose to discontinue support of the licensed technology in the future, we might not be able to modify or adapt our own solutions.
27
Table of Contents
Our use of “open-source” software could adversely affect our ability to offer our products and services and subject us to possible litigation.
We may use open-source software in connection with our services. Companies that incorporate open-source software into their technologies have, from time to time, faced claims challenging the use of open-source software and/or compliance with open-source license terms. As a result, we could be subject to suits by parties claiming ownership of what we believe to be open-source software or claiming noncompliance with open-source licensing terms. Some open-source software licenses require users who distribute software containing open-source software to publicly disclose all or part of the source code to such software and/or make available any derivative works of the open-source code, which could include valuable proprietary code of the user, on unfavorable terms or at no cost. While we monitor the use of open-source software and try to ensure that none is used in a manner that would require us to disclose our internally developed source code, including that of our AVA platform, or that would otherwise breach the terms of an open-source agreement, such use could inadvertently occur, in part because open-source license terms are often ambiguous. In addition to risks related to license requirements, use of certain open-source software can lead to greater risks than use of third-party commercial software, as open-source licensors generally do not provide warranties or controls on the origin of software which, thus, may contain security vulnerabilities, such as the Log4j vulnerability in November 2021, or infringing or broken code. Any requirement to publicly disclose our internally developed source code or pay damages for breach of contract could have a material adverse effect on our business, financial condition and results of operations and could help our competitors develop services that are similar to or better than ours.
We depend on our senior management team and other key employees, and the loss of one or more of these employees or an inability to attract and retain other highly skilled employees could harm our business.
Our success depends largely upon the continued services of our senior management team and other key employees. We rely on our leadership team's deep expertise and industry experience in the areas of operations, product development, provision of medical services, information technology and security, marketing, and general and administrative functions. From time to time, there may be changes in our executive management team resulting from the hiring or departure of executives, which could disrupt our business. Our employment agreements with our executive officers and other key personnel do not require them to continue to work for us for any specified period and, therefore, they could terminate their employment with us at any time. Furthermore, volatility in our stock price may affect our ability to attract and retain replacements should key personnel depart.
The loss of one or more of the members of our senior management team, or other key employees, could cause disruptions in or harm to our business, and replacing any such employees would entail significant time and cost. In particular, the loss of the services of our founder and Chief Executive Officer, John Kao, could significantly delay or prevent the achievement of our strategic objectives. We currently do not have “key person” insurance on any of our employees.
Competition for highly qualified personnel is intense, especially for technology specialists and for physicians, nurses and other medical professionals who are experienced in providing care services to older adults. We have, from time to time, experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications. Many of the other Medicare Advantage plans and healthcare organizations with which we compete for experienced personnel have greater resources than we have. If we hire employees from competitors or other companies or healthcare providers, their former employees may attempt to assert that these employees or we have breached certain legal obligations, resulting in a diversion of our time and resources. If we fail to attract new personnel or fail to retain and motivate our current personnel, our business and future growth prospects could be harmed.
Our membership is concentrated in a limited number of U.S. states, and so we are subject to risks associated with our geographic concentration, including unanticipated changes in population morbidity, which could significantly increase utilization rates and medical costs.
A substantial portion of our revenue is driven by CMS payments in connection with our health plans in California, North Carolina, Nevada, Arizona and Texas, with over 94% of our members concentrated in California as of December 31, 2024. As a result, our exposure to many of the risks described herein is not mitigated by a diversification of geographic focus. Unfavorable changes in healthcare or other benefit costs or reimbursement rates or increased competition in these areas or any other geographic area where our membership becomes concentrated in the future could therefore have a disproportionately adverse effect on our operating results. Furthermore, due to the concentration of our operations in these states and in California in particular, our business may be adversely affected by economic, health or other conditions that disproportionately affect these states as compared to other states (e.g., outbreaks of infectious disease) or by natural disasters such as major earthquake, wildfire or hurricane. Any of these factors could have a significant impact on the health of a large number of our covered members, access to care may be more difficult and proposed responses, including telehealth, may not be available. Moreover, regulatory changes undertaken in response to such events could require us to cover health care costs for members for which we would not typically be responsible.
To continue to diversify our operations we will have to expand to other regions of the United States, which will require us to devote resources to identifying and exploring such perceived opportunities. We may not be able to continue to successfully expand our operations in any new geographic markets and so we may remain subject to the risks presented by our geographic concentration.
28
Table of Contents
Our management team has limited experience managing a public company.
Most members of our management team have limited experience managing a publicly traded company, interacting with public company investors and complying with the increasingly complex laws pertaining to public companies. Our management team may not successfully or efficiently manage us as a public company that is subject to significant regulatory oversight and reporting obligations under the federal securities laws and the continuous scrutiny of securities analysts and investors. These obligations and constituents require significant attention from our senior management and could divert their attention away from the day-to-day management of our business, which could adversely affect our business, results of operations and financial condition.
Competition for physicians and nurses, shortages of qualified personnel or other factors could increase our labor costs and adversely affect our revenue, profitability and cash flows.
Although we primarily contract with external providers for care delivery, we also employ physicians and other healthcare professionals to deliver in-house care. Our in-house care delivery operations are dependent on the efforts, abilities and experience of those employees. We compete with healthcare providers, hospitals, clinics, networks and other facilities in attracting physicians, nurses and medical staff to support our in-house care delivery capabilities and in recruiting and retaining qualified management and support personnel to be responsible for the daily operations of our clinical care teams.
In some markets, the lack of availability of clinical personnel, such as nurses, social workers and mental health professionals, is a significant operating issue facing all healthcare providers and others seeking to employ such personnel. Any shortage of personnel may require us to continue to enhance wages and benefits to recruit and retain qualified personnel or to contract for more expensive temporary personnel. We also depend on the available labor pool of semi-skilled and unskilled workers in each of the markets in which we operate. Our failure to recruit and retain qualified clinical and other medical personnel could have a material adverse effect on our business, financial condition and results of operations.
Any union activity that may occur among our clinical staff in the future could contribute to increased labor costs. Certain proposed changes in federal labor laws and the National Labor Relations Board’s modification of its election procedures could increase the likelihood of employee unionization attempts. Although none of our employees are currently represented by a collective bargaining agreement, to the extent a significant portion of our employee base unionizes, it is possible our labor costs could increase materially.
If our labor costs increase, we may not be able to offset these increased costs. Because a significant percentage of our revenue consists of fixed, prospective payments, our ability to pass along increased labor costs is limited. In particular, if labor costs rise at an annual rate greater than our net annual payments from CMS, our results of operations and cash flows will likely be adversely affected.
If our records, including those submitted to us by our external providers, contain inaccurate or unsupportable information regarding risk adjustment scores of members, we might overstate or understate our revenue and be subject to various penalties.
The RAF scores attributable to our members determine, in part, the revenue to which we are entitled for the provision of medical care to our members. The data we submit to CMS is based, in part, on medical charts and diagnosis codes that our in-house clinical staff and our external providers prepare and submit to us. We generally rely on our in-house and externally engaged physicians to appropriately document and support such RAF data in our medical records. We also rely on our in-house and externally engaged physicians to appropriately code claims for medical services provided to members. If the providers do not provide us with accurate and supportable coding and diagnosis information, we may not be able to accurately estimate our revenue and medical costs associated with providing care to our members. If the data suggests the members are sicker than they actually are, we may overstate our revenue and overstate our costs. If the data suggests the members are healthier than they actually are, we may understate our revenue and underestimate our costs. Erroneous and/or unsupported submissions could result in a correction or retroactive adjustment in later periods. This corrected or adjusted information may be reflected in financial statements for periods subsequent to the period in which the revenue was recorded. We might also need to refund a portion of the revenue that we received, which refund, depending on its magnitude, could have a material adverse effect on our business, financial condition and results of operations.
Additionally, CMS audits Medicare Advantage organizations for documentation to support RAF-related payments for members. The Medicare Advantage organizations ask providers to submit the underlying documentation for members that they serve. It is possible that claims associated with members with higher RAF scores could be subject to more scrutiny in a CMS or plan audit. CMS may impose penalties as a result of its audits. In addition, we could be liable for penalties to the government under the FCA that range from $5,500 to $11,000 (adjusted for inflation) for each false claim, plus up to three times the amount of damages caused by each false claim, which can be as much as the amounts received directly or indirectly from the government for each such false claim. On February 12, 2024, the DOJ issued a final rule announcing adjustments to FCA penalties, under which the per claim penalty range was increased to a range from $13,946 to $27,894 for penalties assessed after February 12, 2024 with respect to violations occurring after November 2, 2015. CMS has indicated that, for some audits of plan years beginning with 2018, payment adjustments will not be limited to RAF scores for the specific Medicare Advantage enrollees for which errors are found but may also be extrapolated to the entire Medicare Advantage plan membership.
In addition to the provisions of the FCA, which provide for civil enforcement, the federal government can use several criminal statutes to prosecute persons who are alleged to have submitted false or fraudulent claims for payment to the federal government.
Our health plans may be randomly selected or targeted for review by CMS and the outcome of such a review may result in a material adjustment in our revenue and profitability.
29
Table of Contents
A failure to accurately estimate incurred but not reported medical expense could adversely affect our results of operations.
Member care costs include estimates of future medical claims that have been incurred by the members but for which the provider has not yet billed. These claim estimates are made utilizing actuarial methods and are continually evaluated and adjusted by management, based upon our historical claims experience and other factors, including an independent assessment by a nationally recognized actuarial firm. Adjustments, if necessary, are made to medical claims expense and capitated revenues when the assumptions used to determine our claims liability change and when actual claim costs are ultimately determined.
Due to the inherent uncertainties associated with the factors used in these estimates and changes in the patterns and rates of medical utilization, materially different amounts could be reported in our financial statements for a particular period under different conditions or using different, but still reasonable, assumptions. It is possible that our estimates of this type of claim may be inadequate in the future. In such event, our results of operations could be adversely impacted. Further, the inability to estimate these claims accurately may also affect our ability to take timely corrective actions, further exacerbating the extent of any adverse effect on our results of operations.
Negative publicity regarding the managed healthcare industry generally could adversely affect our results of operations or business.
Negative publicity regarding the managed healthcare industry generally, or the Medicare Advantage program in particular, may result in increased regulation and legislative review of industry practices that further increase our costs of doing business and adversely affect our results of operations or business by:
•requiring us to change our products and services;
•increasing the regulatory, including compliance, burdens under which we operate which, in turn, may negatively impact the manner in which we provide products and services and increase our costs of providing products and services;
•adversely affecting our ability to market our products or services through the imposition of further regulatory restrictions regarding the manner in which plans and providers market to and communicate with Medicare Advantage enrollees; or
•adversely affecting our ability to attract and retain members.
Federal reductions in Medicare Advantage funding could adversely affect our financial condition and results of operations.
The majority of our revenues come from the government-subsidized Medicare Advantage program. Medicare Advantage is a federally administered program financed in part by federal funds. The federal government has instituted measures aimed at controlling the growth of and/or reducing healthcare spending, including Medicare Advantage spending. We are exposed to financial risks associated with contracting with the federal government, including but not limited to our dependence upon Congress and CMS’ robustly funding the Medicare Advantage program and the impact that delays in government payments could have on our operating cash flow and liquidity.
For example, future levels of funding for Medicare Advantage may be affected by continuing government efforts to contain healthcare costs and may further be affected by federal budgetary constraints. Congress periodically considers reducing or reallocating the amount of money the federal government spends on healthcare programs including the Medicare Advantage program, and CMS annually sets the rates and other financial factors that influence the amount of money Medicare Advantage organizations receive from the government. Furthermore, Medicare remains subject to the automatic spending reductions imposed by the Budget Control Act of 2011 and the American Taxpayer Relief Act of 2012 (“sequestration”), subject to a 2% cap, which has been extended several times, most recently by the Consolidated Appropriations Act of 2023, and is effective through 2032 with respect to Medicare benefit payments (i.e., all payments for programs and activities under Title XVIII of the Social Security Act). Adverse economic conditions may put pressures on federal budgets as tax and other federal revenues decrease while the population that is eligible to participate in Medicare Advantage programs increases, creating more need for funding. This may require Congress and/or CMS to seek to reduce Medicare Advantage spending, which may result in reductions in funding for the Medicare Advantage program or contraction of covered benefits. A reduction (or less than expected increase), a protracted delay, or a change in allocation methodology in government funding for Medicare Advantage, as well as termination of one or more CMS contracts, may materially and adversely affect our results of operations, financial position and cash flows.
In addition, if another federal government shutdown were to occur for a prolonged period of time, CMS payment obligations, including its obligations under the Medicare Advantage program, may be delayed. If CMS fails to make payments on a timely basis, our business could suffer, and our financial position, results of operations or cash flows may be materially affected.
Delays in obtaining, or failure to obtain or maintain, governmental approvals, or moratoria imposed by regulatory authorities, could adversely affect our revenues or membership, increase costs or adversely affect our ability to bring new products and services to market as forecasted.
30
Table of Contents
The centers out of which our external providers operate and the facilities that host our AVA platform may be negatively impacted by weather and other factors beyond our control.
Our results of operations may be adversely impacted by adverse conditions affecting the centers out of which our external care providers operate, and the facilities that host our AVA platform, including severe weather events such as tornadoes and widespread winter storms, natural disasters such as earthquakes and fires, public health concerns such as infectious disease outbreaks, violence or threats of violence or other factors beyond our control. Any of these events could cause disruption of member scheduling, displacement of our members, employees and care teams, or force certain of our providers’ centers, or facilities that host our AVA platform to close temporarily. In certain geographic areas, we have a large concentration of clinics, external provider facilities, and facilities that host our AVA platform that may be simultaneously affected by adverse weather conditions or other events. Our future operating results may be adversely affected by these and other factors that disrupt the operation of the centers out of which our external providers operate and the facilities that host our AVA platform.
If we are unable to offer new and innovative products and services or our products and services fail to keep pace with advances in industry standards, technology and our members’ needs, our members may terminate or fail to renew their membership with us and our revenue and results of operations may suffer.
Our success depends on providing innovative, high-quality, customizable products and services that elevate our members’ healthcare experience and outcomes. If we cannot adapt to rapidly evolving industry standards, technology and increasingly sophisticated and varied members’ needs, our existing product and service offerings could become undesirable, obsolete or harm our reputation. In order to remain competitive, we must continue to invest significant resources in our personnel and technology in a timely and cost-effective manner in order to enhance our existing products and services and introduce new high-quality products and services that existing members and potential members will want. We are continually involved in a number of projects to develop new products and services, including the further refinement of our proprietary AVA platform. If our innovations are not responsive to the needs of our existing members or potential new members, are not appropriately timed with market opportunity, are not effectively brought to market or significantly increase our operating costs, we may lose existing members or be unable to enroll new members and our results of operations may suffer.
We are a holding company with no operations of our own, and we depend on our subsidiaries for cash.
Currently, we are a holding company and do not have any material assets or operations other than ownership of equity interests of our subsidiaries. Our operations are conducted almost entirely through our subsidiaries, and our ability to generate cash to meet our obligations or to pay dividends is highly dependent on the earnings of, and receipt of funds from, our subsidiaries through dividends, administrative expenses or intercompany loans. The ability of our subsidiaries to generate sufficient cash flow from future operations to allow us and them to make scheduled payments on our obligations will depend on their future financial performance, which will be affected by a range of economic, competitive and business factors, many of which are outside of our control. We cannot assure you that the cash flow and future earnings of our operating subsidiaries will be adequate for our subsidiaries to service their debt obligations. If our subsidiaries do not generate sufficient cash flow from future operations to satisfy corporate obligations, we may have to: undertake alternative financing plans (such as refinancing), restructure debt, sell assets, reduce or delay capital investments, or seek to raise additional capital. We cannot assure you that any such alternative refinancing would be possible, that any assets could be sold, or, if sold, of the timing of the sales and the amount of proceeds realized from those sales, that additional financing could be obtained on acceptable terms, if at all, or that additional financing would be permitted under the terms of our various debt instruments then in effect. Our inability to generate sufficient cash flow to satisfy our obligations, or to refinance our obligations on commercially reasonable terms, would have an adverse effect on our business, financial condition and results of operations. Furthermore, we and our subsidiaries may incur substantial additional indebtedness in the future that may severely restrict or prohibit our subsidiaries from making distributions, paying dividends or making loans to us.
Our ability to obtain funds from certain of our licensed subsidiaries is restricted by state insurance regulations.
Our MA plans are operated through regulated insurance subsidiaries in various states. These subsidiaries are subject to state regulations that, among other things, require the maintenance of minimum levels of statutory capital or tangible net equity, as defined by each state. The states in which our subsidiaries operate regulate the payment of dividends, loans, administrative expense reimbursements or other cash transfers to us, and limit investments to approved securities. The amount of dividends that may be paid to us by these insurance subsidiaries, without prior approval by state regulatory authorities, or ordinary dividends, is limited based on the entity’s level of statutory income and statutory capital and surplus. In some states, prior notification is provided before paying a dividend even if approval is not required. Actual dividends paid may vary due to consideration of excess statutory capital and surplus and expected future surplus requirements. We continue to maintain our levels of aggregate excess statutory capital and surplus in our state-regulated operating subsidiaries. Dividends from our non-insurance companies are generally not restricted by governmental departments of insurance. In the event that our subsidiaries are unable to provide sufficient capital to fund our obligations and allow us to pursue our objectives, our results of operations, financial position, and cash flows may be materially adversely affected.
31
Table of Contents
If we are required to maintain higher statutory capital levels for our existing operations or if we are subject to additional capital reserve requirements as we pursue new business opportunities, our cash flows and liquidity may be adversely affected.
One or more of the states in which our MA plan subsidiaries operate may raise the statutory capital or tangible net equity level we are required to maintain from time to time. Many states have adopted risk-based capital requirements based on guidelines adopted by the National Association of Insurance Commissioners, which tend to be, although are not necessarily, higher than existing statutory capital requirements. Regardless of whether a state in which we may operate has adopted risk-based capital requirements, the state departments of insurance can require our regulated insurance subsidiaries to maintain minimum levels of statutory capital or tangible net equity in excess of amounts required under the applicable state laws if they determine that maintaining additional statutory capital or tangible net equity, as applicable, is in the best interests of our beneficiaries. Any other changes in these requirements could materially increase our statutory capital requirements. In addition, as we continue to expand our plan offerings in new states, add new beneficiaries, or pursue new business opportunities, we may be required to maintain additional statutory capital. In any case, our available funds could be materially reduced, which could harm our ability to implement our business strategy.
We have limited experience serving as a participant in the ACO REACH model with CMS and may not be able to realize the expected benefits thereof.
The CMS Center for Medicare and Medicaid Innovation (“CMMI”) implemented a direct contracting model, intended to create value-based payment arrangements directly with Direct Contracting Entities (“DCEs”), which is part of CMS’s strategy to drive broader healthcare reform and accelerate the shift from original Medicare toward value-based care models. A key aspect of direct contracting is providing new opportunities for a variety of different DCEs to participate in value-based care arrangements in Medicare fee-for-service. Effective January 1, 2023, CMS replaced the DCE program with the “ACO Realizing Equity, Access, and Community Health Model” or “ACO REACH” model and designated participating entities as Accountable Care Organizations (“ACOs”).
Our participation in the CMMI program began on April 1, 2021 and, as of January 1, 2025, we had approximately 6,650 members in our arrangement with our clinician partners in California and Nevada. Our participation in the ACO REACH program is subject to annual CMS approval, and our contracts are not guaranteed to be renewed in future years. Prior to April 1, 2021, we had no experience participating in CMMI's programs and, as such, our ACO business is in the early stages of development. We are subject to the risks inherent to the launch of any new business, including the risks that we may not generate sufficient returns to justify our investment and that it may take longer or be more costly to achieve the expected benefits from this new program. In particular, we may be unable to achieve risk-like patient economics on original Medicare patients. Moreover, our financial performance under the ACO REACH model may not be similar to our performance under the DCE model.
CMMI is constantly evaluating the ACO REACH program and may revise the applicable rules and design at any time, and such changes may have a significant impact on our ability to carry out our business. Certain CMMI model methodologies, including but not limited to, allowed provider classes, beneficiary alignment, benchmark establishment, and risk score modeling, are subject to continued evaluation. For example, the ACO REACH model requires participants to meet several provisions on promoting health equity, including the creation of a health equity plan, and will introduce a health equity benchmark adjustment to payments to help support care delivery and coordination in underserved areas. ACO REACH also requires that doctors and other health care providers make up 75% of governing or voting rights on the participating accountable care organization's board. These and other requirements could materially impact our profitability.
In 2024, we entered into a management services and risk management agreement with a third-party healthcare company. The third party will be responsible for arranging and controlling the health care services provided to the ACO members, and for providing certain management and support services with respect to ACO operations. The third party will also assume specified upside and downside financial risk relative to the ACO’s performance. Due to our reliance on this third party, we may face the risk that it will fail to successfully manage the health care of these members and that it will incur significant financial losses. Although the third party is contractually liable for such losses and was required to obtain a security instrument and to provide a cash reserve backstopping such losses, there is a possibility that losses could exceed the aggregate amount of the security instrument and cash reserve. If that were to occur, we may be responsible for the excess losses.
The ACO REACH model may not be successful and may ultimately be discontinued, including as a result of decreased political support for value-based care or the ACO REACH model, or we may be unable to expand our total addressable market in the manner that we expect. Ultimately, our participation in the ACO REACH model may not be profitable to us initially or at all.
If we are unable to maintain the minimum required number of beneficiaries served by our ACO REACH model, we may become ineligible to participate in the program.
As with the DCE model, CMS requires ACO REACH participants to maintain at least 5,000 aligned Medicare fee-for-service beneficiaries prior to the start of each performance year. If for any year we fail to satisfy the minimum beneficiary alignment requirements, CMS may take remedial action, including imposition of a corrective action plan or termination of our participation in the program. Any adverse action that curtails or eliminates our ability to participate in the program may have an adverse effect on our business, financial condition and results of operations. Additionally, because preliminary performance year benchmarks are calculated prospectively for each performance year before the prior performance year is complete, CMS may retroactively adjust performance year
32
Table of Contents
benchmarks based on the finalized quality performance scores achieved by the ACO, which will impact the reimbursements achieved in the model.
We are subject to risks associated with delegating services and functions to vendors, including supplemental benefit providers and third-party brokers.
We rely on a number of vendors and other third parties to perform various functions and fulfill our obligations to CMS and members. Our ability to operate our business depends on the performance of, and continued contracts with, these vendors. The functions performed by our major vendors include, but are not limited to, information technology support, claims processing, pharmaceutical benefit management, supplemental benefits (e.g., our "black card" benefit, vision benefits, transportation benefits) and other business process outsourcing. We also rely in part on third-party brokers for the marketing and sale of our insurance plans and on our IPAs, which perform certain functions on our behalf.
Our ability to operate our business depends on the performance of these third parties. Their performance may be compromised, degraded or interrupted for a variety of reasons, some of which are outside of our control, and they may fail to meet agreed-upon service level standards. For example, if a vendor becomes disqualified by CMS from providing services in connection with a Medicare Advantage plan, we would be unable to continue to use their services. Our vendors could also experience changes in their financial health or disruptions to their own operations. We do not directly control their actions and they could violate applicable laws, rules, and regulations. In the event that these third parties render poor performance or are unwilling or unable to perform services for us in accordance with our contract and legal requirements, we may face operational difficulties, increased expenses, penalties, fines, sanctions or litigation. Although we may be able to force the vendor to indemnify us for some or all of our losses, the vendor may not ultimately be liable in contract or tort for other losses and our business and reputation may suffer nonetheless. Disputes arising from contractual disagreements, service-level disputes or changes in vendor terms and conditions may impact our ability to maintain stable and cost-effective relationships with third-party vendors.
Our reliance on third-party vendors may directly and adversely impact our health plan membership. To the extent a vendor’s inadequate performance impacts our members, their satisfaction with our health insurance plans and customer service may be diminished.
Additionally, in the event that one of our agreements with a key third party terminates, we may have a difficult time bringing the contracted services in-house or contracting with another vendor. Identifying a replacement vendor, negotiating an agreement with the vendor, and transitioning services to the vendor takes significant time and resources. We may be unable to enter into agreements with replacement vendors on favorable terms, or at all. Any loss of a key vendor relationship could result in a service disruption or unavailability and harm our ability to continue to develop, maintain, and improve our products.
Risks Related to Regulation
Our business activities are subject to substantial government regulation. New laws or regulations, or legislative, judicial, or regulatory changes in existing laws or regulations or their manner of application could increase our cost of doing business and may have a material adverse effect on our results of operations; our financial position; and our cash flows.
The Health Care Reform Law and Other Current or Future Legislative, Judicial or Regulatory Changes
The Patient Protection and Affordable Care Act and The Health Care and Education Reconciliation Act of 2010 (which we collectively refer to as the “Health Care Reform Law”) enacted significant reforms to various aspects of the U.S. health insurance industry. Certain significant provisions of the Health Care Reform Law include, among others, mandated coverage requirements, mandated benefits and guarantee issuance associated with commercial medical insurance, rebates to policyholders based on minimum benefit ratios, adjustments to Medicare Advantage premiums, the establishment of federally facilitated or state-based exchanges coupled with programs designed to spread risk among insurers, and the introduction of plan designs based on set actuarial values. Some of these changes impact us and other entities that offer Medicate Advantage plans.
It is reasonably possible that the Health Care Reform Law and related regulations, as well as other current or future legislative, judicial or regulatory changes, including restrictions on our ability to manage our provider network or otherwise operate our business, or restrictions on profitability, including reviews by regulatory bodies that may compare the profitability of various products within our Medicare Advantage business and require that they remain within certain ranges of each other, increases in member benefits or changes to member eligibility criteria without corresponding increases in premium payments to us, may have a material adverse effect on our results of operations (including restricting revenue, enrollment and premium growth in certain products and market segments, restricting our ability to expand into new markets, increasing our medical and operating costs, further lowering our payment rates and increasing our expenses associated with assessments), our financial position and our cash flows.
Additionally, potential legislative changes or judicial determinations, including activities to repeal or replace the Health Care Reform Law or declare all or certain portions of the Health Care Reform Law unconstitutional, creates uncertainty for our business, and we cannot predict when, or in what form, such legislative changes or judicial determinations may occur.
33
Table of Contents
Health Insurance Portability and Accountability Act, the Health Information Technology for Economic and Clinical Health Act and Other Laws, Rules and Regulations Related to Data Privacy
We are subject to data privacy and protection laws and regulations that apply to the collection, transmission, storage and use of PHI and other PII, which among other things, impose certain requirements relating to the privacy, security and transmission of PII. The legislative and regulatory landscape for privacy and data protection continues to evolve, and there has been an increasing focus on privacy and data protection issues with the potential to affect our business. Failure to comply with any of these laws and regulations could result in enforcement action against us, including fines, public censure, claims for damages by affected individuals, damage to our reputation and loss of goodwill, any of which could have a material adverse effect on our business, financial condition, results of operations or prospects. Ongoing efforts to comply with evolving laws and regulations may be costly and require ongoing modifications to our policies, procedures and systems.
The use of individually identifiable health data by our business is regulated at federal and state levels. These laws and rules are changed frequently by legislation or administrative interpretation. Various state laws address the use and maintenance of PII. Among these state laws, which we describe in more detail below, we are most substantially affected by the California Consumer Privacy Act, which uniquely among general consumer privacy laws did not exempt employee information, business contact information, and only maintains narrow exemptions for data subject to HIPAA or the Gramm-Leach-Bliley Act. We may need to change the way we create, receive, maintain or transmit PII to comply with these state laws.
HIPAA includes administrative provisions directed at simplifying electronic data interchange through standardizing transactions, establishing uniform healthcare provider, payer, and employer identifiers, and establishing regulations aimed at protecting confidentiality and security of patient and member data. The rules preempt all inconsistent state laws unless the state law is more privacy-protective.
These regulations, in addition to other state laws, set standards for the security of electronic health information, including requirements that insurers provide customers with notice regarding how their PHI is used. Compliance with HIPAA regulations requires us to regularly monitor security risk, implement and regularly review administrative, technical and physical safeguards to protect electronic health information, and provide workforce training, among other administrative efforts. HIPAA can also expose us to additional liability for violations by our business associates (e.g., entities that provide services to health plans and providers).
The US Department of Health and Human Services, Office for Civil Rights announced on December 27, 2024, and published in the Federal Register on January 6, 2025, a Notice of Proposed Rulemaking proposing extensive modifications to the HIPAA security standards. If finalized, these modifications could entail significant additional compliance obligations and costs for HIPAA-regulated covered entities and business associates.
HIPAA imposes mandatory penalties for certain violations. In 2024, penalties for violations of HIPAA and its implementing regulations started at $141 per violation and could not exceed approximately $71,162 per violation, subject to a cap of approximately $2.1 million for violations of the same standard in a single calendar year. However, a single breach incident can result in violations of multiple standards. Additionally, the penalty amounts listed above are also due for inflation adjustments in 2025.
HIPAA also authorizes state attorneys general to file suit on behalf of their residents for statutory damages of up to $25,000. While HIPAA does not create a private right of action allowing individuals to sue in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI.
HIPAA further requires that members be notified of any unauthorized acquisition, access, use or disclosure of their unsecured PHI that compromises the privacy or security of such information, with certain exceptions related to unintentional or inadvertent use or disclosure by employees or authorized individuals. HIPAA specifies that such notifications must be made without unreasonable delay and in no case later than 60 calendar days after discovery of the breach. If a breach affects 500 patients or more, it must be reported to HHS without unreasonable delay, and HHS will post the name of the breaching entity on its public website. Breaches affecting more than 500 patients in the same state or jurisdiction must also be reported to the local media. If a breach involves fewer than 500 people, the covered entity must record it in a log and notify HHS at least annually.
We also publish statements to our members and partners that describe how we handle and protect PHI. If federal or state regulatory authorities or private litigants consider any portion of these statements to be untrue, we may be subject to claims of deceptive practices, which could lead to significant liabilities and consequences, including, without limitation, costs of responding to investigations, defending against litigation, settling claims, and complying with regulatory or court orders. Any of the foregoing consequences could have a material adverse impact on our business and our financial results.
Data privacy and security at the state level remains an evolving landscape. For example, CCPA, which came into effect on January 1, 2020, requires companies that process information on California residents to make disclosures to consumers about their data collection, use and sharing practices, allow consumers to opt out of certain data sharing with third parties and provides a cause of action for data breaches. In addition, on November 3, 2020, California voters approved amendments to the CCPA, known as the CPRA, which significantly modifies the CCPA, including by expanding consumers’ rights with respect to certain personal information and creating a state agency, the California Privacy Protection Agency (“CPPA”), to oversee implementation and enforcement efforts. The CPPA is able to finance operations through penalties issued and with the CPRA’s removal of the mandatory cure period from CCPA, we will have less warning before compliance risk results in legal action. The CPRA’s amendments became effective on January 1, 2023. The CCPA
34
Table of Contents
contains exemptions for medical information governed by the California Confidentiality of Medical Information Act, and for PHI collected by a covered entity or business associate governed by the privacy, security, and breach notification rule established pursuant to HIPAA.
The CPPA has released for public comment draft regulations on risk assessments, cybersecurity assessments, and automated decision-making technologies, which close on February 19, 2025. These regulations are the final components of the CPRA's amendments to the CCPA, which granted the CPPA the authority to pass additional regulations. These regulations in their draft form contain substantial new compliance obligations with respect to PII we process.
The CCPA has prompted a number of proposals for new federal and state-level privacy legislation. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. For example, the Virginia Consumer Data Protection Act, which became effective January 1, 2023, gives Virginia residents expanded rights to access and creates additional obligations on companies covered by the legislation, and the Nevada Privacy Law, which became effective on October 1, 2019, requires businesses to give website users the option to opt-out of the sale of their data, but is otherwise significantly more narrow than the other laws mentioned. As of February 1, 2025, general State privacy laws are in effect in California, Colorado, Connecticut, Utah, Texas, Oregon, Virginia, Montana, New Jersey, Delaware, Iowa, Nebraska, and New Hampshire. Additional general state privacy laws have been passed and will go into effect in 2025 in Tennessee, Minnesota, and Maryland, and in 2026, in Indiana, Kentucky, and Rhode Island.
While the CPRA/CCPA is an example of consumer privacy law, the NAIC’s Model Insurance Data Security Law (the "Model law") is a different type of law focused on securing insurance licensees’ information systems. Versions of this Model Law have been passed in many states and are expected to be passed in more states in the coming years. Similar to HIPAA, the Model Law requires the implementation of technical, administrative, and procedural information security practices and procedures and includes reporting requirements for data breaches. These Model Laws exist in a majority of states and are typically enforced by state insurance regulators.
It is possible that applicable laws may be interpreted and applied in a manner that is inconsistent with our practices and our efforts to comply with the evolving data protection rules may be unsuccessful. We must devote significant resources to understanding and complying with this changing landscape. Failure to comply with laws regarding privacy and security of PHI and other PII could expose us to penalties under such laws. Any such failure to comply with data protection and privacy laws could result in government-imposed fines or orders requiring that we change our practices, claims for damages or other liabilities, regulatory investigations and enforcement action, litigation and significant costs for remediation, any of which could adversely affect our business. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could have an adverse effect on our business, financial condition and results of operations.
As indicated above, there are numerous federal and state laws and regulations addressing patient and consumer privacy concerns, including notification requirements in the event of unauthorized access or theft of personal information. State statutes and regulations vary from state to state. Violations of HIPAA or applicable federal or state laws or regulations could subject us to significant criminal or civil penalties, including significant monetary penalties. We cannot yet fully determine the impact these or future laws, rules, regulations and industry standards may have on our business or operations. Any such laws, rules, regulations and industry standards may be inconsistent among different jurisdictions, subject to differing interpretations or may conflict with our current or future practices. Additionally, our customers may be subject to differing privacy laws, rules and legislation, which may mean that they require us to be bound by varying contractual requirements applicable to certain other jurisdictions. Adherence to such contractual requirements may impact our collection, use, processing, storage, sharing and disclosure of various types of information and may mean we become bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters that may further change as laws, rules and regulations evolve. Complying with these requirements and changing our policies and practices may be onerous and costly, and we may not be able to respond quickly or effectively to regulatory, legislative and other developments. These changes may in turn impair our ability to offer our existing or planned features, products and services and/or increase our cost of doing business. As we expand our customer base, these requirements may vary from customer to customer, further increasing the cost of compliance and doing business.
Our business and operations may also be subject to federal, state, and local consumer protection laws governing marketing communications, including the Telephone Consumer Protection Act, “TCPA”, which places restrictions on the use of automated tools and technologies to communicate with wireless telephone subscribers or communications services consumers generally and the CAN-SPAM Act, which regulates the transmission of marketing emails. Under the TCPA, entities using an automatic telephone dialing system to send communications must obtain prior express consent for non-marketing communications and prior express written consent for marketing communications. The TCPA has a private right of action, allowing individuals who have received unsolicited communications (phone calls, text messages or faxes) made using an “automatic telephone dialing system” to seek statutory damages of $500 per violation, or $1,500 if the violation was made willfully or knowingly. Despite our compliance efforts, we could nevertheless be forced to defend private class actions or government enforcement based on the communications we send to members.
In addition, certain of our businesses are also subject to the PCI DSS, which is a multifaceted industry security standard that is designed to protect credit card account data as mandated by payment brands and acquiring banks. We rely on vendors to assist us with PCI matters and to ensure PCI compliance. Despite our compliance efforts, we may become subject to claims that we have violated the PCI DSS or other requirements of the payment card brands, based on past, present, or future business practices, which could have an adverse impact on our business and reputation, subject us to fines and/or have a negative impact on our ability to accept credit card payments.
35
Table of Contents
As described above, substantially all of our relevant member data is maintained on our technology platform, AVA, which aggregates and provides us with access to extensive member datasets, including individually identifiable PHI. As a result, any breach of our technology platform could expose us to substantial liability under HIPAA, the HITECH Act and other applicable laws, regulations or rules. See “Risk Factors—Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our members, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation.”
Corporate Practice of Medicine and Other Laws
As a corporate entity, we are not licensed to practice medicine. Many states in which we operate through our subsidiaries limit the practice of medicine to licensed individuals or professional organizations comprised of licensed individuals, and business corporations generally may not exercise control over the medical decisions of physicians. Statutes, regulations and court decisions relating to the practice of medicine, fee-splitting between physicians and referral sources, and similar issues vary widely from state to state. While we endeavor to comply with state corporate practice of medicine laws and regulations as we interpret them, the laws and regulations in these areas are complex, changing, and often subject to varying interpretations. The interpretation and enforcement of these laws vary significantly from state to state.