10-K
UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549
FORM 10-K
(Mark One)
For the fiscal year ended December 31, 2025
OR
for the transition period from ___ to ___.
Commission file number: 001-37392
Astrana Health, Inc.
(Exact name of registrant as specified in its charter)
1668 S. Garfield Avenue, 2nd Floor, Alhambra, California91801
(Address of principal executive offices, including zip code)
Registrant’s telephone number, including area code: (626) 282-0288
Securities registered pursuant to Section 12(b) of the Act:
Title of Each Class Trading Symbol Name of Each Exchange on Which Registered
Common Stock, $0.001 par value per share ASTH The Nasdaq Stock Market LLC
Securities registered pursuant to Section 12(g) of the Act:
None
(Title of class)
Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ☐
Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Exchange Act. Yes ☐No ☒
Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐
Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐
Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.
Large accelerated filer ☒ Accelerated filer ☐
Non-accelerated filer ☐ Smaller reporting company ☐
Emerging growth company ☐
If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐
Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒
If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐
Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b).☐
Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). ☐ Yes ☒ No
The aggregate market value of common stock held by non-affiliates of the registrant, as of June 30, 2025, the last day of the registrant’s most recently completed second fiscal quarter, was approximately $1.1 billion (based on the closing price for shares of the registrant’s common stock as reported by the Nasdaq Stock Market on June 30, 2025).
As of March 5, 2026, there were 55,603,598 shares of common stock of the registrant, $0.001 par value per share, issued and outstanding, which includes 6,132,802 treasury shares that are owned by Allied Physicians of California, a Professional Medical Corporation d.b.a. Allied Pacific of California IPA (“APC”), a consolidated affiliate of Astrana Health, Inc. These shares are legally issued and outstanding but treated as treasury shares for accounting purposes.
DOCUMENTS INCORPORATED BY REFERENCE
Portions of the registrant’s definitive Proxy Statement for the 2026 annual meeting of the stockholders of the registrant are incorporated herein by reference in Part III of this Annual Report on Form 10-K to the extent stated herein. Such Proxy Statement will be filed with the Securities and Exchange Commission (the “SEC”) within 120 days of the registrant’s fiscal year ended December 31, 2025.
Astrana Health, Inc.
Form 10-K
Fiscal Year Ended December 31, 2025
Table of Contents
Page
Introductory Note 4
Note About Forward-Looking Statements 5
PART I 6
ITEM 1 Business 6
ITEM 1A Risk Factors 25
ITEM 1B Unresolved Staff Comments 61
ITEM 1C Cybersecurity 62
ITEM 2 Properties 65
ITEM 3 Legal Proceedings 65
ITEM 4 Mine Safety Disclosures 65
ITEM 6 [Reserved] 68
ITEM 7A Quantitative and Qualitative Disclosures About Market Risk 88
ITEM 8 Financial Statements and Supplementary Data 89
ITEM 9A Controls and Procedures 147
ITEM 9B Other Information 152
ITEM 9C Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 152
ITEM 10 Directors, Executive Officers and Corporate Governance 152
ITEM 11 Executive Compensation 152
ITEM 14 Principal Accounting Fees and Services 152
ITEM 15 Exhibits and Financial Statement Schedules 153
2
Glossary
The following abbreviations or acronyms that may be used in this document shall have the adjacent meanings set forth below:
AAMG All-American Medical Group
ACO REACH ACO Realizing Equity, Access, and Community Health
ADSC Advanced Diagnostic and Surgical Center, Inc.
AHMC AHMC Healthcare Inc.
AHMS Advanced Health Management Systems, L.P.
AHM Astrana Health Management, Inc. (f/k/a Network Medical Management Inc.)
APC Allied Physicians of California, a Professional Medical Corporation
APC-LSMA APC-LSMA Designated Shareholder Medical Corporation
Astrana Astrana Health Inc. (f/k/a Apollo Medical Holdings, Inc.)
CAIPA MSO CAIPA MSO, LLC
CFC Community Family Care Medical Group IPA, Inc.
CMS Centers for Medicare & Medicaid Services
DMHC California Department of Managed Health Care
HSMSO Health Source MSO Inc., a California corporation
IPA Independent Practice Association
LMA LaSalle Medical Associates
MSSP Medicare Shared Savings Program
PCCCV Primary Community Care of Central Valley, Inc.
PMIOC Pacific Medical Imaging and Oncology Center, Inc.
Sun Labs Sun Clinical Laboratories, a California corporation
VIE Variable Interest Entity
3
Table of Contents
INTRODUCTORYNOTE
Unless the context dictates otherwise, references in this Annual Report on Form 10-K to the “Company,” “we,” “us,” “our,” and similar words are references to Astrana Health, Inc., a Delaware corporation (“Astrana” or “Astrana Health”), and its consolidated subsidiaries and affiliated entities, as appropriate, including its consolidated variable interest entities (“VIEs”).
The following discussion and analysis provide information that management believes is relevant to an assessment and understanding of our results of operations and financial performance. This discussion should be read in conjunction with the consolidated financial statements and notes thereto appearing elsewhere herein, and with our prior filings with the Securities and Exchange Commission (the “SEC”).
This Form 10-K includes market data and certain other statistical information and estimates based on reports and other publications from industry analysts, market research firms, and other independent sources, as well as management’s own good faith estimates and analyses. Astrana believes these third-party reports to be reputable, but has not independently verified the underlying data sources, methodologies, or assumptions. The reports and other publications referenced are generally available to the public and were not commissioned by Astrana. Information based on estimates, forecasts, projections, market research, or similar methodologies is inherently subject to uncertainties, and actual events or circumstances may differ materially from events and circumstances reflected in this information.
The Centers for Medicare & Medicaid Services (“CMS”) has not reviewed any statements contained in this Report, including statements describing the Company’s participation in the ACO Realizing Equity, Access, and Community Health Model (“ACO REACH Model”), in the Medicare Shared Savings Program (“MSSP”), and in the ACO Long-term Enhanced ACO Design Model (“ACO LEAD Model”).
Trade names and trademarks of Astrana and its subsidiaries referred to herein, and their respective logos, are our property. This Annual Report on Form 10-K may contain additional trade names and/or trademarks of other companies, which are the property of their respective owners. We do not intend our use or display of other companies’ trade names and/or trademarks, if any, to imply an endorsement or sponsorship of us by such companies, or any relationship with any of these companies.
4
Table of Contents
NOTE ABOUT FORWARD-LOOKING STATEMENTS
This Annual Report on Form 10-K contains “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995, Section 27A of the Securities Act of 1933, as amended (the “Securities Act”), and Section 21E of the Securities Exchange Act of 1934, as amended (the “Exchange Act”). All statements other than statements of historical fact are “forward-looking statements” for purposes of federal and state securities laws, including, but not limited to, any statements about our business, financial condition, operating results, plans, objectives, expectations, and intentions; any projections of earnings, revenue, earnings before interest, taxes, depreciation, and amortization (“EBITDA”), Adjusted EBITDA, adjusted EPS - diluted, free cash flow, or other financial items, such as our projected capitation from CMS, any forward-looking guidance and our future liquidity; any statements of any plans, strategies, and objectives of management for future operations, such as the material opportunities that we believe exist for our Company; any statements concerning proposed services, developments, mergers, acquisitions, or dispositions; any statements relating to our completed Prospect acquisition; any statements with respect to dividends or stock repurchases and timing, methods, and payment of same; any statements regarding the outlook of the ACO LEAD Model, ACO REACH Model, the MSSP or strategic transactions; any statements relating to delayed payments under, or potential cuts to, Medicaid and/or Medicaid programs and/or changes in federal or state funding policies; any statements regarding management’s view of future expectations and prospects for us; any statements about prospective adoption of new accounting standards or effects of changes in accounting standards; any statements regarding our ability to remediate the material weakness in our internal control over financial reporting and maintain effective internal control over financial reporting and disclosure controls and procedures; any statements regarding potential changes to our tax structure; any statements regarding future economic conditions or performance; any statements relating to the potential impact of cybersecurity breaches or disruptions to our management information systems or widespread outages, interruptions, or other failures of operational, communication, and other systems; any statements of belief; any statements of assumptions underlying any of the foregoing; and other statements that are not historical facts. Forward-looking statements may be identified by the use of forward-looking terms, such as “anticipate,” “could,” “can,” “may,” “might,” “potential,” “predict,” “should,” “estimate,” “expect,” “project,” “believe,” “think,” “plan,” “envision,” “intend,” “continue,” “target,” “seek,” “contemplate,” “budgeted,” “will,” or “would,” and the negative of such terms, other variations on such terms or other similar or comparable words, phrases, or terminology.
Forward-looking statements involve risks and uncertainties, many of which are difficult to predict and are outside of our control, and are based on the current beliefs, expectations, and certain assumptions of management. Some or all of such beliefs, expectations, and assumptions may not materialize or may vary significantly from actual results. Such statements are qualified by important economic, competitive, governmental, and technological factors that could cause our business, strategy, or actual results or events to differ materially from those in our forward-looking statements. Factors that might cause or contribute to such differences include, but are not limited to, those discussed in this Annual Report on Form 10-K, including the risk factors discussed under the heading “Risk Factors” in Part I, Item 1A below. Although we believe the expectations reflected in our forward-looking statements are reasonable, actual results could differ materially from those projected or assumed in any of our forward-looking statements. Our future financial condition and results of operations, as well as any forward-looking statements, are subject to change. Significant risks and uncertainties could cause actual conditions, outcomes, and results to differ materially from those indicated by such statements. Any forward-looking statement made by the Company in this Form 10-K speaks only as of the date it is made. The Company undertakes no obligation to publicly update any forward-looking statement, whether as a result of new information, future developments or otherwise, except as may be required by any applicable securities laws.
5
Table of Contents
PART I
Item 1. Business
Overview
Astrana is a leading physician-centric, technology-powered, risk-bearing healthcare company. Leveraging its proprietary end-to-end technology solutions, Astrana operates an integrated healthcare delivery platform that enables providers to successfully participate in value-based care arrangements, thus empowering them to deliver accessible, high-quality care to patients in a cost-effective manner. We, together with our affiliated physician groups and consolidated subsidiaries and VIEs, provide coordinated outcome-based care, serving patients covered by private or public insurance provided through Medicare, Medicaid, and health maintenance organizations (“HMOs”), with a small portion of our revenue coming from non-insured patients. We provide care coordination services to each major constituent of the healthcare delivery system, including patients, families, primary care physicians, specialists, acute care hospitals, alternative sites of inpatient care, physician groups, and health plans. Our physician network consists of primary care physicians, specialist physicians, physician and specialist extenders, and hospitalists. Astrana’s common stock is listed on The Nasdaq Stock Market LLC (“Nasdaq”) and trades under the symbol “ASTH.”
Led by a leadership team with several decades of experience, we have built a company and culture focused on physicians providing high-quality medical care, population health management, and patient care coordination. Through our integrated health network of more than 20,000 contracted physicians, we were responsible for coordinating value-based care for approximately 1.6 million patients as of December 31, 2025. As a result, we believe we are well-positioned to capitalize on the shift in the U.S. healthcare industry toward value-based and results-oriented healthcare, with a focus on patient satisfaction, high-quality care, and cost efficiency. We implement and operate different innovative healthcare models, primarily including the following three reportable segments:
•
Care Partners;
•
Care Delivery; and
•
Care Enablement.
Care Partners
Our Care Partners segment is focused on building and managing high-quality and high-performance provider networks by partnering with, empowering, and investing in strong provider partners aligned on a shared vision for coordinated care delivery. Astrana meets providers where they are and enables independent providers to remain independent while succeeding in value-based care. Astrana acts as a “single payer” for our network of providers, enabling value-based care arrangements, including hospital shared-risk contracts. By leveraging our unique Care Enablement platform and ability to recruit, empower, and incentivize physicians to manage total cost of care effectively, we are able to organize partnered providers into successful multi-payer risk-bearing organizations that take on varying levels of risk, based on total cost of care across membership in all lines of business, including Medicare fee for service (“FFS”), Medicare Advantage, Medicaid, Commercial, and Exchange. These organizations make up our Care Partners segment, which consists of a network of risk-bearing organizations (“RBOs”) that encompass independent practice associations (“IPAs”), accountable care organizations (“ACOs”), and state-specific entities such as Restricted Knox-Keene licensed health plans (sometimes referred to as “RKKs”) in California. Through this network, our healthcare delivery entities are tasked with coordinating and providing high-quality care to patients within Astrana’s ecosystem. This helps ensure seamless continuity of care among patients in different age groups, stages of life, and life circumstances.
6
Table of Contents
An IPA is an association of independent physicians, or other organization that contracts with independent physicians. IPAs contract with HMOs, which are medical insurance groups that generally offer health care coverage to enrollees for a fixed annual fee, on a negotiated per capita rate, flat retainer fee, or negotiated FFS basis. Our affiliated IPAs comprise a network of independent providers, including primary care physicians, specialists, and other providers, who collectively care for patients. Our IPAs contract with various HMOs and other licensed healthcare service plans—such as Restricted Knox-Keene licensed health plans, as defined in the California Knox-Keene Health Care Service Plan Act of 1975, as amended (the “Knox-Keene Act”), to provide physician services to their enrollees, typically under capitated arrangements. Each HMO negotiates a fixed amount per member per month (“PMPM”) that is to be paid to our IPAs. In return, the IPAs arrange for the delivery of healthcare services by contracting with physicians or professional medical corporations for primary care, specialty care, and other ancillary services. Our IPAs assume the financial risk of the cost of delivering certain healthcare services in excess of the fixed amounts received from health plans. Some of the risk is transferred to the contracted physicians or professional corporations and some is subject to stop-loss provisions in the contracts with the HMOs. With our owned RKKs in California, we can assume full financial responsibility, including both professional and institutional risk, for the medical costs of our members under the plans, which allows our Care Partners to manage a full spectrum of care.
An ACO is an organization that participates in one or more payment and delivery models sponsored by the Centers for Medicare & Medicaid Services (“CMS”) that provide high-quality and affordable care to Medicare FFS patients. The CMS programs allow provider groups to assume financial risk and potentially achieve a higher reward from participation in the respective program’s attribution-based risk-sharing model. For the year ended December 31, 2025, the Company’s ACOs participated in the ACO REACH Model and the Medicare Shared Savings Program (“MSSP”).
Care Delivery
Our Care Delivery segment is a patient-centric, data-driven organization focused on delivering high-quality and accessible care, serving approximately 1.6 million patients annually. As medical care has been increasingly delivered in clinic settings, many integrated health networks also operate healthcare facilities primarily focused on the diagnosis and/or care of outpatients, including those with chronic conditions such as heart disease and diabetes, to meet the primary healthcare needs of local communities. Our Care Delivery organization spans over 60 locations and includes:
•
Primary care clinics, including post-acute care services and an acute care hospital facility;
•
Specialty care clinics and inpatient services, including cardiac care, endocrinology, and ophthalmology, as well as hospitalist and intensivist services; and
•
Ancillary service providers, such as urgent care centers, outpatient imaging centers, ambulatory surgery centers, full-service labs, and a specialty pharmacy.
We evaluate our Care Partners network based on specialty and geographic location, and then strategically engage in efforts to build or acquire practices and provider groups to address any gaps. This ensures that patients have access to high-quality care. Our ability to establish Care Delivery organizations tailored to specific markets enables us to scale effectively as we enter into new markets.
Care Enablement
Our Care Enablement segment represents a comprehensive platform that integrates clinical, operational, financial, and administrative information, all powered by our proprietary technology suite. Our Care Enablement tools are leveraged across our Care Partners and Care Delivery lines of business as well as third-party providers outside of our Astrana ecosystem. Our Care Enablement segment provides solutions to payers and providers, including independent physicians, providers, and medical groups, as well as ACOs. The Company’s platform meets providers and payers wherever they are on the spectrum of total cost of care, offering solutions for FFS entities and to providers open to taking upside and downside risks on professional and institutional spending, and across all patient types, including Medicare, Medicaid, Commercial, and Exchange-insured patients. This segment includes the Company’s wholly owned subsidiaries that operate as management services organizations (“MSOs”),
7
Table of Contents
to provide non-medical services under long-term management and/or administrative services agreements (“MSAs”) with RBOs and other providers. By leveraging our Care Enablement platform, providers and payers can improve their ability to deliver high-quality care to their patients and achieve better patient, clinical, and financial outcomes.
Population health management (“PHM”) seeks to improve health outcomes by monitoring and identifying individual patients, aggregating data, and providing a comprehensive clinical picture of each patient. PHM is a central trend within healthcare delivery, which includes the aggregation of patient data across multiple health information technology resources, the analysis of that data into a single, actionable patient record, and the actions through which care providers can improve both clinical and financial outcomes. When combined with effective care coordination, data-driven approaches can better connect patients to providers and resources, resulting in streamlined care delivery, improved clinical outcomes, and lower costs. A successful PHM platform requires a robust care and risk management infrastructure, a cohesive delivery system, and a well-managed partnership network.
Under established MSAs, our MSOs have authority over various non-medical decisions related to ongoing business operations and provide services that include, but are not limited to:
•
Physician recruiting;
•
Physician and health plan contracting;
•
Care management, including utilization management, medical management, and quality management;
•
Provider relations;
•
Member services, including annual wellness evaluations;
•
Claims processing;
•
Pre-negotiating contracts with specialists, labs, imaging centers, nursing homes, and other vendors;
•
Revenue cycle management; and
•
Credentialing.
Integrated Health Network
An integrated health network that is able to pool a large number of patients, such as the Company and its affiliated physician groups, is positioned to take advantage of industry trends, meet patient and government demands, and benefit from cost advantages resulting from its scale of operation and integrated approach of care delivery. In addition, an integrated health network with years of managed care experience can leverage its expertise and sizeable medical data to identify specific treatment strategies and interventions, improve the quality of medical care, and lower costs. Many integrated health networks, including the Company and its affiliated physician groups, have also established physician performance metrics that allow them to monitor quality and service outcomes achieved by participating providers, to reward efficient, high-quality care delivered to members, and to initiate improvement efforts for providers whose performance can be enhanced.
Our RBOs, with more than 20,000 contracted healthcare providers, have agreements with various health plans, hospitals, and other HMOs, pursuant to which we were responsible for coordinating the care of approximately 1.6 million patients, as of December 31, 2025. These covered patients are comprised of managed care members whose health coverage is provided either through their employers, acquired directly from a health plan, or as a result of their eligibility for Medicaid or Medicare benefits. Our managed patients benefit from an integrated approach that places physicians at the center of patient care and utilizes sophisticated risk management techniques and clinical protocols to provide high-quality, cost-effective care. To implement a patient-centered, physician-centric experience, we also have other integrated and synergistic operations, including (i) MSOs that
8
Table of Contents
provide management and other administrative services to our Care Partners segment, (ii) primary care clinics, (iii) multi-specialty care clinics and medical groups, and (iv) ancillary service providers.
Human Capital
As of December 31, 2025, Astrana, its subsidiaries, and consolidated VIEs had approximately 3,000 employees. None of our employees are members of a labor union, and we have not experienced any work stoppage.
We are committed to supporting the professional development of our employees, providing competitive compensation and benefits and a safe and inclusive workplace that enables employees to achieve their full potential. We measure employee engagement on an ongoing basis to create a more innovative, productive, and profitable company. Results from engagement surveys are used to implement programs and processes designed to support employee retention and satisfaction. The Company believes a workplace that promotes fairness and opportunity fosters innovation and cultivates an environment filled with unique perspectives and growth. Respect for human rights is fundamental to the Company’s business and its commitment to ethical business conduct.
Our dedication to employee growth is reflected in the various learning and development programs offered at Astrana. We have internal learning and development programs as well as a professional development reimbursement program, to empower employees to enhance their skill sets and provide opportunities for advancement within the Company. Our learning and development programs include a comprehensive portfolio of enterprise programs designed to strengthen leadership capabilities, improve operational performance, and support organizational integration across the Company. We further expanded employee development by creating educational newsletters and enhancing compliance and system-training pathways. These efforts advanced workforce readiness, supported smoother transitions during organizational changes, and reinforced our commitment to developing talent that drives long-term growth.
We actively promote and support employees who seek to donate their time, talents, and resources to make a positive impact on their communities and charitable causes. In 2025, Astrana contributed to several charitable organizations, including Susan G. Komen and Eisner Health, and Astrana employees participated in volunteer efforts with the Los Angeles Dream Center and Los Angeles Mission.
Organization
We operate through our wholly owned subsidiaries and their consolidated entities, including consolidated VIEs. Our wholly owned subsidiaries include MSOs, ACOs, RKKs, and a hospital. Our MSOs operate within our Care Enablement segment and are in the business of providing management services. Our ACOs operate within our Care Partners segment and participate in CMS programs. Our RKKs operate within our Care Partners segment and allow us to assume both institutional and professional risk in providing medical services to members. Our hospital, operating within the Care Delivery segment, is consolidated and wholly owned by us. Our other consolidated VIEs include IPAs operating within our Care Partners segment, and the clinics and ancillary service providers operating within our Care Delivery segment. We consolidate a VIE if we have both power and benefits—that is, (i) we have the power to direct the activities of a VIE that most significantly influence the VIE’s economic performance, and (ii) we have the obligation to absorb losses of, or the right to receive benefits from, the VIE that could potentially be significant to the VIE.
Some states have laws that prohibit the corporate practice of medicine. In such states, the IPA must be owned by a licensed physician or physicians. Business entities with non-physician owners, such as Astrana and its subsidiaries, are prevented from practicing medicine, employing physicians to practice medicine, or exercising control over medical decisions by physicians. These laws are generally referred to as the corporate practice of medicine laws. States with corporate practice of medicine laws permit only physicians to practice medicine, exercise control over medical decisions, or engage in certain arrangements with physicians, such as fee-splitting.
9
Table of Contents
Due to these laws, the Company maintains long-term MSAs with our affiliated IPAs and medical groups, each of which is owned and operated by physicians only and employs or contracts with additional physicians to provide medical services to the patients. Astrana Health Management, Inc. (“AHM”), a wholly owned subsidiary of the Company, has entered into MSAs with several affiliated IPAs, including Allied Physicians of California, a Professional Medical Corporation, d.b.a. Allied Pacific of California IPA (“APC”). APC arranges for the delivery of healthcare services by contracting with physicians or professional medical corporations for primary care and specialty care services and assumes the financial risk of the cost of delivery of these healthcare services. The physicians in the IPA are exclusively in control of, and responsible for, all aspects of the practice of medicine for enrolled patients. In accordance with relevant accounting guidance, APC has been determined to be a VIE of AHM, as AHM is its primary beneficiary with the ability, through majority representation on the APC Joint Planning Board and otherwise, to direct the activities (excluding clinical decisions) that most significantly affect APC’s economic performance. Therefore, APC and its wholly owned subsidiaries and VIEs are consolidated in the accompanying financial statements.
Certain state laws prohibit a professional corporation that has more than one shareholder from serving as a shareholder in another professional corporation. As a result, the Company cannot directly own shares in another professional corporation. However, an exception to such regulations permits a professional corporation that has only one shareholder to own shares in another professional corporation. In reliance on this exception, the Company has designated certain key personnel as the nominee shareholder of professional corporations that hold controlling and non-controlling ownership interests in several medical corporations. Via a Physician Shareholder Agreement with the nominee shareholder, the Company has the ability to designate another person as the equity holder of the professional corporation. In addition, these entities are managed by our wholly owned MSOs via MSAs. In accordance with relevant accounting guidance, the Company consolidates the professional corporations and their consolidated medical corporations in the accompanying financial statements.
See Note 18 — “Variable Interest Entities (VIEs)” to our consolidated financial statements under Item 8 in this Annual Report on Form 10-K for information on our entities that qualify as consolidated VIEs.
Investments
We have invested in several entities in the healthcare industry. Our equity method investments range from 25.0% to 51.0% equity interest in entities that operate similarly to our Care Partners, Care Delivery and Care Enablement segments. These investments are accounted for under the equity method as the Company has the ability to exercise significant influence, but not control, over operations. Our investments in privately held entities consist of investments ranging from 2.8% to 10.0% and include a Simple Agreement for Future Equity (“SAFE”) that, upon certain triggering events, grants the Company has rights to equity.
Certain businesses and assets of Prospect Medical Holdings, Inc. (collectively, “Prospect”) (such acquisition, the “Prospect Acquisition”)
On July 1, 2025, we completed the previously announced Prospect acquisition for a purchase price of $674.9 million. Prospect is a physician-centric risk-bearing healthcare company that operates an integrated healthcare delivery platform enabling a network of over 11,000 providers to successfully participate in value-based care arrangements and empowering them to deliver accessible, high-quality care to patients in a cost-effective manner. Prospect enables providers to deliver payer-agnostic, patient-centered care across different lines of business. Prospect also operates a California Restricted Knox-Keene-licensed health plan, an MSO, a specialty pharmacy, and a fully-accredited acute care hospital. The acquisition significantly expanded our provider network and enhanced our ability to offer increased access, quality, and value to our members.
10
Table of Contents
Our Industry
Industry Overview
U.S. healthcare spending has increased steadily over the past two decades. CMS estimates that total U.S. healthcare expenditures are expected to grow at an average annual rate of 5.8% from 2024 to 2033, and will reach $8.6 trillion by 2033. Health spending is projected to grow 1.5% faster than the U.S. gross domestic product per year on average over 2024–2033, and as a result, the healthcare share of gross domestic product is expected to grow from 17.6% in 2023 to 20.3% in 2033. Medicare spending increased by 7.8% to $1.1 trillion, and Medicaid spending increased by 6.6% to $931.7 billion in 2024, which accounted for 21% and 18% of total health expenditures, respectively. Private health insurance spending increased by 8.8% to $1.6 trillion in 2024, accounting for 31% of total health expenditures. Medicare spending is expected to have the fastest growth (7.9% per year for 2024–2033), primarily due to projected enrollment growth.
Managed care health plans were developed in the U.S., primarily during the 1980s to mitigate the rising cost of providing healthcare to populations covered by health insurance. These managed care health plans enroll members through their employers in connection with federal Medicare benefits or state Medicaid programs. As a result of the prevalence of these health plans, many seniors now becoming eligible for Medicare have been interacting with managed care companies through their employers for more than 30 years. Individuals now turning 65 are likely more familiar with the managed care setting than previous Medicare populations. The healthcare industry, however, is highly regulated by various government agencies and heavily relies on reimbursement and payments from government-sponsored programs such as Medicare and Medicaid. Companies in the healthcare industry, therefore, have to organize, operate around, and face challenges from idiosyncratic laws and regulations.
Many health plans recognize both the opportunity for growth from adding members, as well as the potential risks and costs associated with managing additional members. Many health plans subcontract a significant portion of the responsibility for managing patient care to an integrated health network such as Astrana and our affiliated physician groups. These integrated healthcare systems offer a comprehensive medical delivery system, sophisticated care management expertise, and infrastructure to more efficiently provide for the healthcare needs of the population enrolled with that health plan. While reimbursement models for these arrangements vary around the U.S., health plans often prospectively pay the integrated healthcare system a fixed capitation payment, which is frequently based on a percentage of the amount received by the health plan. In the aggregate, capitation payments to integrated healthcare systems represent a prospective budget from which the system manages the care-related expenses on behalf of the population enrolled with that system. To the extent that these systems manage such expenses under the capitated levels, the system realizes an operating profit. On the other hand, if the expenses exceed projected levels, the system will realize an operating deficit. Since premiums paid represent a substantial amount per person, there is a significant revenue opportunity for an integrated health network that can effectively manage healthcare costs for the capitated arrangements entered into by its affiliated physician groups.
Industry Trends and Demand Drivers
We believe that the healthcare industry is undergoing a significant transformation, and the demand for our offerings is driven by the confluence of a number of fundamental healthcare industry trends, including:
Shift to Value-Based and Results-Oriented Models. According to the 2024 National Health Expenditure Historical Data prepared by CMS, healthcare spending in the U.S. increased by 7.2% to $5.3 trillion in 2024, representing 18.0% of the U.S. Gross Domestic Product. CMS projects healthcare spending in the U.S. to increase at an average rate of 5.8% for 2024-2033 and to reach approximately $8.6 trillion by 2033. To address this expected significant rise in healthcare costs, the U.S. healthcare market is seeking more efficient and effective methods of delivering care. The FFS reimbursement model has arguably played a major role in increasing the level and growth rate of healthcare spending. In response, the public and private sectors are shifting away from the FFS reimbursement model toward value-based, capitated payment models designed to incentivize value and quality at an individual patient level.
11
Table of Contents
Increasingly Patient-Centered. More patients are becoming actively involved and are taking an informed role in how their healthcare is delivered, resulting in the healthcare marketplace becoming increasingly patient-centered, and thus requiring providers to deliver team-based, coordinated, and accessible care to stay competitive.
Added Complexity. In the healthcare space, more sophisticated technology has been employed, new diagnostics and treatments have been introduced, research and development have expanded, and regulations have multiplied. This expanding complexity drives a growing and continuous need for integrated care delivery systems.
Integration of Healthcare Information and Emphasis on Health Services & Technology Growth. Across the healthcare landscape, a significant amount of data is generated daily, driven by patient care, payment systems, regulatory compliance, and record keeping. As the amount of healthcare data continues to grow, it becomes increasingly important to connect disparate data and apply insights in a targeted manner in order to better achieve the goals of higher quality and more efficient care.
Our Revenue Streams
Our revenue reflected in the accompanying consolidated financial statements includes revenue generated by our subsidiaries and consolidated entities. Our revenue streams are diversified among our various operations, and multi-year renewable contractual arrangements are as follows:
•
Capitation revenue;
•
Risk pool settlements and incentives;
•
Management fee income;
•
FFS revenue; and
•
Other revenue.
Capitation Revenue
Our capitation revenue consists primarily of capitated fees for medical services we provide under capitated arrangements made directly with various managed care providers, including HMOs. Under the capitated model, an HMO pays the IPA a capitation payment and assigns the IPA the responsibility for providing physician services required by patients. The IPA physicians are exclusively in control of, and responsible for, all aspects of the practice of medicine for enrolled patients. Capitation revenue for our Restricted Knox-Keene licensed health plan consists of “global” capitation arrangements, whereby the Restricted Knox-Keene licensed health plan accepts financial risk for hospital and other institutional services in addition to professional medical services (whereas IPA capitation contracts are typically limited to accepting financial risk for professional medical services). Most HMO agreements have an initial term of two years, renewing automatically for successive one-year terms. The HMO agreements generally allow either party to terminate the HMO agreements without cause, typically with a four to six-month advance notice and provide for a termination for cause by the HMO at any time.
Capitation revenue is typically prepaid to us monthly based on the number of enrollees who select us as their healthcare provider. Capitation is a fixed payment amount per patient per unit of time paid in advance for the delivery of healthcare services, whereby the service providers are generally liable for excess medical costs. The actual amount paid is determined by the range of services provided, the number of patients enrolled, and the period of time during which the services are provided. Capitation rates are generally based on local costs and average service utilization. Additionally, Medicare pays capitation using a “Risk Adjustment” model, which compensates managed care organizations and providers based on the health status (acuity) of each individual enrollee. Health plans and providers with higher acuity enrollees will receive more, and those with lower acuity enrollees will receive less. Under the Risk Adjustment model, capitation is determined based on health severity, which is measured using patient encounter data, and is thus paid on an interim basis based on data submitted for the enrollee for the preceding year and is adjusted in subsequent periods after the final data is compiled.
12
Table of Contents
PMPM-managed care contracts generally have a term of one year or longer. All managed care contracts have a single performance obligation that constitutes a series of services for the provision of managed healthcare services for a population of enrolled members for the duration of the contract. The transaction price for PMPM contracts is variable, as it primarily includes PMPM fees associated with unspecified membership that fluctuates throughout the contract term. In certain contracts, PMPM fees also include adjustments for items such as performance incentives, performance guarantees, and risk sharing.
Through our ACOs, we participate in the Global Risk track with Total Care Capitation (“TCC”) in the ACO REACH Model sponsored by CMS. Under the ACO REACH Model, we recruit a group of Participant and Preferred (in-network) Providers. Based on the Participant Providers that join our ACO, CMS grants us a pool of Traditional Medicare patients (beneficiaries) to manage (the “Aligned Beneficiaries”). Our Aligned Beneficiaries will receive services from physicians and other medical service providers that are both in-network and out-of-network. Under TCC, CMS estimates average in-network monthly expenditures for our ACOs’ Aligned Beneficiaries and pays that projected amount to us in monthly installments. We are then responsible for paying our in-network providers for all Medicare-covered services they provided to our Aligned Beneficiaries. In addition, we bear risk on all Medicare expenditures (both in-network and out-of-network), excluding drug expenditures covered by Medicare Part D, based on a budgetary benchmark established with CMS. Claims from out-of-network providers are processed and paid by CMS. Our shared savings or losses in managing our beneficiaries are generally determined annually after reconciliation with CMS. Pursuant to our risk-share agreement with CMS, we are eligible to receive the surplus (shared savings) or are liable for the deficit (shared losses) according to the budgetary benchmark established by CMS based on our efficiency, or lack thereof, in managing the expenditures associated with our Aligned Beneficiaries. Using the most recent CMS data, the Company estimates the potential savings or deficit for the performance year. We also recognize the budgetary benchmark established by CMS, net of any ACO REACH program discounts and adjustments, as revenue. The risk track we elect with CMS determines our maximum shared savings or losses. Under the Global Risk track, we are responsible for 100% of shared savings or losses up to 25% of the total budgetary benchmark established by CMS, with adjusted risk corridors taking effect for any proportion of shared savings/losses exceeding 25% of the benchmark—for savings/losses of 25–35% of the benchmark, we assume 50% risk responsibility, for savings/losses 35%–50% of the benchmark we assume 25% of the risk responsibility, and for savings/losses exceeding 50% of the benchmark, we assume only 10% of the risk responsibility. We recognize revenue related to the ACO Reach Model within capitation revenue in our consolidated statements of income because of the similar shared characteristics to our other capitation revenue. Revenue is recorded on a gross basis and is comprised of capitated fees for medical services provided, for which the Company is assigned the responsibility and management.
Risk Pool Settlements and Incentives
Our affiliated IPAs may enter into hospital shared-risk capitation arrangements with certain health plans and local hospitals, where the hospital is responsible for providing, arranging, and paying for institutional risk, and the IPA is responsible for providing, arranging, and paying for professional risk. Under a hospital shared-risk pool-sharing agreement, the IPA generally receives a percentage of the net surplus from the affiliated hospital’s risk pools with health plans after deductions for the affiliated hospital’s costs. In contrast, deficits, if any, are not payable until and unless (and only to the extent) risk-sharing surpluses are generated. At the termination of the hospital shared-risk pool-sharing agreement, any accumulated deficit will be extinguished. Advance settlement payments are typically made quarterly in arrears if there is a surplus. Risk pool settlements under arrangements with health plans and hospitals are recognized using the most likely amount methodology, and amounts are included in revenue only to the extent that it is probable that a significant reversal of cumulative revenue will not occur once any uncertainty is resolved. The receivables related to these risk pool arrangements incorporate estimates of the affiliated hospitals’ claims costs, including incurred but not reported (“IBNR”) claims, which include actuarial methods based on utilization of healthcare services, historical payment patterns, cost trends, seasonality, changes in membership, and other factors.
13
Table of Contents
Under capitated arrangements with certain HMOs, our affiliated IPAs may participate in one or more health plan shared-risk arrangements relating to the provision of institutional services to enrollees. They can earn additional revenue or incur losses based on enrollee utilization of institutional services. Health plan shared-risk capitation arrangements are entered into with certain health plans, that are administered by the health plan, in which the IPA is responsible for rendering professional services but the health plan does not enter into a capitation arrangement with a hospital; therefore, the health plan retains the institutional risk. Health plan shared-risk deficits, if any, are not payable until and unless (and only to the extent) risk-sharing surpluses are generated. At the termination of the HMO contract, any accumulated deficit will be extinguished. Final settlement of health plan shared-risk pools for prior contract years generally occurs in the third or fourth quarter of the following year. The Company has limited insight into the amount and timing of the health plans’ shared-risk payments. These amounts are considered to be fully constrained and only recorded when such payments can be reasonably estimated and to the extent that it is probable that a significant reversal will not occur once such settlement occurs.
In addition to risk-sharing revenues, we also receive incentives under “pay-for-performance” programs for quality medical care, based on various criteria. As an incentive to promote quality care, certain HMOs have designed quality incentive programs and commercial generic pharmacy incentive programs to compensate us for our efforts to improve the quality of services and to promote the efficient and effective use of pharmacy supplemental benefits provided to HMO members. The incentive programs track specific performance measures and calculate payments to us based on the performance measures. The Company’s incentives under “pay-for-performance” programs are recognized using the most likely methodology.
We also participate in the MSSP through our ACOs. The MSSP has multiple risk tracks, and Astrana currently participates in the ENHANCED risk track. Under the MSSP Model, Astrana recruits a group of Participant and Preferred (in-network) Providers. Based on the Participant Providers that join our ACO, CMS grants the Company a pool of Traditional Medicare patients (beneficiaries) to manage (the “MSSP Aligned Beneficiaries”). The Company’s MSSP Aligned Beneficiaries will receive services from physicians and other medical service providers, both in-network and out-of-network. CMS continues to pay participants and preferred providers on an FFS basis for Medicare-covered services provided to MSSP Aligned Beneficiaries. The Company continues to bear risk on all Medicare expenditures (both in-network and out-of-network), excluding drug expenditures covered by Medicare Part D, based on a budgetary benchmark established with CMS. Astrana’s shared savings or losses in managing the Company’s beneficiaries are generally determined on an annual basis after reconciliation with CMS. Pursuant to Astrana’s risk-share agreement with CMS, the Company is eligible to receive the surplus (“shared savings”) or is liable for the deficit (“shared losses”) according to the budgetary benchmark established by CMS based on Astrana’s efficiency, or lack thereof, in managing the expenditures associated with the Company’s MSSP Aligned Beneficiaries. The Company estimates the shared service revenue by analyzing the activities during the relevant time period, taking into account the agreed-upon benchmarks, metrics, performance criteria, and attribution criteria, as well as any other contractually defined factors. Revenue is not recorded and is constrained until the shared service revenue can be reasonably estimated by the Company and to the extent that it is probable that a significant reversal will not occur once any uncertainty associated with the variable consideration is subsequently resolved. Due to its similar shared characteristics, we recognize MSSP revenue within risk pool settlements and incentives revenue in our consolidated statements of income and recognize these revenues on a net basis.
Management Fee Income
Management fee income encompasses fees paid for management, provider access, physician advisory, healthcare staffing, enrollment outreach, administrative, and other non-medical services we provide to IPAs, ACOs, hospitals, health plans, and other healthcare providers. Our MSOs enter into management service agreements with terms generally ranging from one to thirty years and may include renewal terms, although they may be terminated earlier under the terms of the applicable contracts. Management fees may be billed at agreed-upon hourly rates, as percentages of gross revenue or fee collections, as amounts fixed on a monthly, quarterly, or annual basis, as a fixed payment amount per enrollee, or as cost recovery assessments based on the specific or allocated expenditures related to the managed entities. The revenue may include variable arrangements that measure factors such as hours staffed, patient visits, or collections per visit against benchmarks and, in certain cases, may be subject to achieving quality metrics or fee collection targets.
14
Table of Contents
FFS Revenue
FFS revenue represents revenue earned under contracts in which we bill and collect the professional component of charges for medical services rendered by our affiliated hospital, contracted physicians, and employed physicians. Under the FFS arrangements, both our clinics and hospital bill and collect from third-party payers and patients for patient care services provided, while our clinics additionally collect from hospitals.
Other Revenue
Other revenue primarily encompasses revenue earned from maternity care and Hospital Quality Assurance Fee Program (“HQAF”). Other revenue is recognized when services are rendered, or over the period, generally on a monthly basis, in which the Company is obligated to provide services.
Our Key Payers
A limited number of payers represent a significant portion of our net revenue. For the years ended December 31, 2025, 2024, and 2023, four payers accounted for an aggregate of 59.8%, 66.2%, and 61.7% of our total net revenue, respectively.
Our Strengths and Advantages
The following are some of the material opportunities that we believe exist for our company:
Combination of Clinical, Administrative, and Technology Capabilities
We believe our key strength lies in our combined clinical, administrative, and technology capabilities. While many companies separately provide clinical, MSO, or technology support services, to our knowledge, very few organizations like ours currently provide all three types of services to approximately 1.6 million patients as of December 31, 2025.
Diversification
Through our subsidiaries, consolidated affiliates, and invested entities, we have reduced our business risk and increased revenue opportunities by diversifying our service offerings and expanding our ability to manage patient care across a horizontally integrated care network. Our revenue is spread across our operations. Additionally, with our ability to monitor and manage care within our wide network, we believe we are an attractive business partner to health plans, hospitals, IPAs, and other medical groups seeking to provide better care at lower costs.
Strong Leadership Team
Our leadership team has, collectively, several decades of experience managing physician practices, RBOs, health plans, hospitals, and health systems, a deep understanding of the healthcare marketplace and emerging trends, and a vision for the future of healthcare delivery led by physician-driven healthcare networks.
A Robust Physician Network
As of December 31, 2025, our physician network consisted of over 20,000 contracted physicians, including primary care physicians, specialist physicians, and hospitalists, through our affiliated physician groups and ACOs.
Cultural Affinities with Patients
In addition to delivering premium healthcare, we believe in the importance of providing services sensitive to local communities' needs, including their cultural affinities. This value is shared among physicians in our affiliated IPAs and medical groups and promotes patient comfort when communicating with care providers.
15
Table of Contents
Long-Standing Relationships with Partners
We have developed long-standing relationships with multiple health plans, hospitals, IPAs, and other medical groups, which have helped generate recurring contractual revenue.
Comprehensive and Effective Healthcare Management Programs
We offer comprehensive and effective healthcare management programs to patients. We have developed expertise in population health management, care coordination, and proper medical coding, resulting in improved Risk Adjustment Factor (“RAF”) scores, higher payments from health plans, improved quality metrics in both inpatient and outpatient settings, and thus, higher patient satisfaction and CMS scores. Using our proprietary risk assessment scoring tool, we have also developed a protocol for identifying high-risk patients.
Competition
The healthcare industry is highly competitive and fragmented. We compete for customers across all of our services with other healthcare management companies, including MSOs and healthcare providers, such as local, regional, and national networks of physicians, medical groups, and hospitals, many of which are substantially larger than us and have significantly greater financial and other resources, including personnel, than we have.
IPAs
Our affiliated IPAs compete with other IPAs, medical groups, and hospitals, many of which have greater finances, personnel, and other resources. In the greater Los Angeles area, such competitors include Regal Medical Group and Lakeside Medical Group, which are part of Heritage Provider Network (“Heritage”), as well as Optum, a subsidiary of UnitedHealth Group.
ACOs
Our ACOs compete with other sophisticated provider groups creating, administrating, and managing ACOs, many of which have greater financial, personnel, and other resources available to them. Major competitors of our ACOs include Privia Health and Aledade.
Outpatient Clinics
Our outpatient clinics compete with large ambulatory surgery centers and/or diagnostic centers such as RadNet and Envision Healthcare, many of which have greater financial, personnel, and other resources, as well as smaller clinics with ties to local communities. Optum (f/k/a HealthCare Partners) also has its own urgent care centers, clinics, and diagnostic centers.
Hospital
Our hospital competes with other hospitals in the same geographic area. Some competitors include Hoag Health Center and University of California-Irvine Health.
MSOs
Our technology-powered MSOs, that provide a comprehensive platform integrating clinical, operational, financial, and administrative information and provides management and administrative services, compete with other MSOs that provide similar services. Our competitors include Conifer Health Solutions, InnovAccer, Arcadia, Lightbeam Health Solutions, and Lumeris.
16
Table of Contents
Regulatory Matters
As a healthcare company, our operations and relationships with healthcare providers, such as hospitals, other healthcare facilities, and healthcare professionals, are subject to extensive and increasing regulation by numerous federal, state, and local government agencies, including the Office of Inspector General, the Department of Justice, CMS, and various state authorities. These laws and regulations are often interpreted broadly and enforced aggressively. Imposing liabilities associated with violating any of these healthcare laws and regulations could have a material adverse effect on our business, financial condition, or results of operations. We cannot guarantee that our practices will not be subject to government scrutiny or be found to violate certain healthcare laws. Government investigations and prosecutions, even if we are ultimately found to be without fault, can be costly and disruptive to our business. Moreover, changes in healthcare legislation or government regulation may restrict our existing operations, limit our expansion, or impose additional compliance requirements and costs, any of which could have a material adverse effect on our business, financial condition, or results of operations. Below are brief descriptions of some, but not all, of such laws and regulations that affect our business operations.
There are many laws and regulations that impact us, directly or indirectly; for instance, California has recently enacted laws requiring additional disclosure with respect to certain climate-related risks and greenhouse gas emissions reduction claims. Non-compliance with such laws may result in the imposition of substantial fines or penalties. In addition, the regulatory framework for artificial intelligence (“AI”) is rapidly evolving, and many federal and state governmental bodies and agencies have introduced and/or are currently considering additional laws and regulations. For example, the California Privacy Protection Agency recently finalized regulations under the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2018 (collectively, the “CCPA”), regarding the use of automated decision-making and providing disclosures to consumers regarding such use. California also enacted several new laws in 2024 that further regulate the use of AI technologies and provide consumers with additional protections around companies’ use of AI technologies, such as requiring companies to disclose certain uses of generative AI. We may also be indirectly affected by the impact of enforcement of other laws and regulations; for instance, we could experience a reduction in the number or percentage of our patients, including, without limitation, as a result of healthcare, immigration or other policies implemented by the U.S. administration, continuing legislative efforts to restrict or prohibit the use and/or availability of charitable premium assistance, or as a result of payors implementing restrictive plan designs.
Corporate Practice of Medicine
Our consolidated financial statements include our subsidiaries and VIEs. Some states have laws that prohibit business entities with non-physician owners, such as Astrana and its subsidiaries, from practicing medicine, employing physicians to practice medicine, or exercising control over medical decisions by physicians. These laws are generally referred to as corporate practice of medicine laws. States that have corporate practice of medicine laws permit only physicians to practice medicine, exercise control over medical decisions, or engage in certain arrangements with physicians, such as fee-splitting. In these states, a violation of the corporate practice of medicine prohibition constitutes the unlawful practice of medicine, which is a public offense punishable by fines and other criminal penalties. In addition, any physician who participates in a scheme that violates the state’s corporate practice of medicine prohibition may be punished (including limitation or loss of license) for aiding and abetting a lay entity in the unlawful practice of medicine.
In states that prohibit the corporate practice of medicine, Astrana maintains long-term MSAs with our affiliated IPAs and medical groups, each of which is owned and operated solely by physicians and employs or contracts with additional physicians to provide medical services. Under such MSAs, our wholly owned MSOs are contracted to provide non-medical management and administrative services, such as financial and risk management, as well as information systems, marketing, and administrative support to the IPAs and medical groups. The MSAs typically have an initial term of one to thirty years and are generally not terminable by our affiliated IPAs and medical groups except in cases of bankruptcy, gross negligence, fraud, or other illegal acts by the contracting MSO.
17
Table of Contents
Through the MSAs and the relationship with the physician-owners of our medical affiliates, we have exclusive authority over all non-medical decisions related to the ongoing business operations of those affiliates. Consequently, Astrana consolidates the revenue and expenses of such affiliates as their primary beneficiary from the date of execution of the applicable MSA. When necessary, our Vice Chairman of the Board, Dr. Thomas Lam, or a locally-licensed physician (where State laws require a physician licensed in that State) serves as nominee shareholder of affiliated medical practices on Astrana’s behalf, in order to comply with corporate practice of medicine laws and certain accounting rules applicable to consolidated financial reporting by our affiliates as VIEs. In Texas, a nonprofit health organization meeting certain criteria and approved by the Texas Medical Board is an alternative structure for compliance with corporate practice of medicine laws.
Under these arrangements, our MSOs perform only non-medical functions, do not represent to offer medical services, and do not exercise influence or control over the practice of medicine by physicians. The Medical Board of California, as well as other states’ regulatory bodies, has taken the position that MSAs that confer too much control over a physician practice to MSOs may violate the prohibition against corporate practice of medicine. Recent case law in Texas indicates that courts there will still enforce corporate practice of medicine restrictions against MSOs and other non-physician entities to protect physicians’ professional prerogatives. Some of the relevant laws, regulations, and agency interpretations in California and other states that have corporate practice prohibitions have been subject to limited judicial and regulatory interpretation. Moreover, state laws and regulatory interpretations are subject to change. Other parties, including our affiliated physicians, may assert that, despite these arrangements, Astrana and its subsidiaries are engaged in the prohibited corporate practice of medicine or that such arrangements constitute unlawful fee-splitting between physicians and non-physicians. If this occurred, we could be subject to civil or criminal penalties, our MSAs could be found legally invalid and unenforceable in whole or in part, and we could be required to restructure arrangements with our affiliated IPAs and medical groups. If we were required to change our operating structures due to determination that a corporate practice of medicine violation existed, such a restructuring might require revising our MSOs’ management fees.
False Claims Act
The False Claims Act imposes civil liability on individuals or entities that submit false or fraudulent claims for payment to the federal government. The False Claims Act provides, in part, that the federal government may bring a lawsuit against any person whom it believes has knowingly or recklessly presented, or caused to be presented, a false or fraudulent request for payment from the federal government, or who has made a false statement or used a false record to get a claim for payment approved. Private parties may initiate qui tam whistleblower lawsuits against any person or entity under the False Claims Act in the name of the federal government and may share in the proceeds of a successful suit. The federal government has used the False Claims Act to prosecute a wide variety of alleged false claims and fraud allegedly perpetrated against Medicare and state healthcare programs. By way of illustration, these prosecutions may be based upon alleged coding errors, billing for services not rendered, billing services at a higher payment rate than appropriate, and billing for care that is not considered medically necessary. The federal government has also pursued False Claims Act investigations against providers who retain Medicare overpayments for more than 60 days after the overpayment was identified. New regulations promulgated in 2024 provided additional detail regarding the investigation and identification of an overpayment. The federal government and several courts have taken the position that claims presented in violation of certain other statutes, including the federal Anti-Kickback Statute or the Stark Law, can also be considered a violation of the False Claims Act based on the theory that a provider impliedly certifies compliance with all applicable laws, regulations, and other rules when submitting claims for reimbursement. Additionally, in July 2025, the U.S. Department of Health and Human Services (“HHS”) and the U.S. Department of Justice (“DOJ”) announced the re-establishment of the HHS-DOJ False Claims Act Working Group and the group’s priority enforcement areas, including Medicare Advantage and kickbacks relating to certain products paid for by federal health care programs.
18
Table of Contents
Penalties for False Claims Act violations include substantial fines for each false claim, plus up to three times the amount of damages sustained by the government. A False Claims Act violation may provide the basis for the imposition of administrative penalties as well as exclusion from participation in governmental healthcare programs, including Medicare and Medicaid. In addition to the provisions of the False Claims Act, which provide for civil enforcement, the federal government can also use several criminal statutes to prosecute persons who are alleged to have submitted false or fraudulent claims to the government for payments.
A number of states, including the states in which we operate, have enacted laws that are similar to the federal False Claims Act. Under Section 6031 of the Deficit Reduction Act of 2005 (“DRA”), as amended, if a state enacts a false claims act that is at least as stringent as the federal statute and that also meets certain other requirements, the state will be eligible to receive a greater share of any monetary recovery obtained pursuant to certain actions brought under the state’s false claims act. As a result, a number of states have adopted laws similar to the federal False Claims Act, resulting in a corresponding increase in state false claims enforcement efforts. In addition, Section 6032 of the DRA requires entities that make or receive annual Medicaid payments of $5.0 million or more from any one state to provide their employees, contractors, and agents with written policies and employee handbook materials on federal and state false claims acts and related statutes.
Anti-Kickback Statutes
The federal Anti-Kickback Statute is a provision of the Social Security Act of 1972 that prohibits as a felony offense the knowing and willful offer, payment, solicitation, or receipt of any form of remuneration in return for, or to induce, (1) the referral of a patient for items or services for which payment may be made in whole or part under Medicare, Medicaid, or other federal healthcare programs, (2) the furnishing or arranging for the furnishing of items or services reimbursable under Medicare, Medicaid, or other federal healthcare programs, or (3) the purchase, lease, or order or arranging or recommending the purchasing, leasing, or ordering of any item or service reimbursable under Medicare, Medicaid, or other federal healthcare programs. The Patient Protection and Affordable Care Act (“ACA”) amended section 1128B of the Social Security Act to make it clear that a person need not have actual knowledge of the statute, or specific intent to violate the statute, as a predicate for a violation. The Office of Inspector General (“OIG”), which has the authority to impose administrative sanctions for violation of the statute, has adopted as its standard for review a judicial interpretation, which concludes that the statute prohibits any arrangement where even one purpose of the remuneration is to induce or reward referrals. A violation of the Anti-Kickback Statute is a felony punishable by imprisonment, criminal fines, civil fines, and three times the amount of the unlawful remuneration. A violation can also result in exclusion from Medicare, Medicaid, or other federal healthcare programs. In addition, pursuant to the changes of the ACA, a claim that includes items or services resulting from a violation of the Anti-Kickback Statute is a false claim for purposes of the False Claims Act.
Due to the breadth of the Anti-Kickback Statute’s broad prohibitions, statutory exceptions exist that protect certain arrangements from prosecution. In addition, the OIG has published safe harbor regulations that specify arrangements that are deemed protected from prosecution under the Anti-Kickback Statute, provided all applicable criteria are met. The failure of an activity to meet all applicable safe harbor criteria does not necessarily mean that the particular arrangement violates the Anti-Kickback Statute, but such arrangements may be subject to scrutiny and prosecution by enforcement agencies. We may be less willing than some competitors to take action or enter into arrangements that do not clearly satisfy the OIG safe harbors, and we may suffer a competitive disadvantage.
On December 2, 2020, in conjunction with the HHS Regulatory Sprint to Coordinated Care, the OIG finalized modifications to existing safe harbors to the Anti-Kickback Statute and added new safe harbors and a new exception to the civil monetary penalty provision prohibiting inducements to beneficiaries, the purpose of which was to remove potential barriers to more effective coordination and management of patient care and delivery of value-based care. The changes implemented by the final rules went into effect on January 19, 2021. These or other changes implemented by OIG in the future may impact our business, results of operations and financial condition.
19
Table of Contents
Some states, including states in which we operate, have enacted statutes and regulations similar to the Anti-Kickback Statute that may be applicable regardless of the payer source for the patient. These state laws may contain exceptions and safe harbors that differ from and/or are more limited than those of the federal law, and that may vary from state to state. For example, California has adopted the Physician Ownership and Referral Act of 1993 (“PORA”). PORA makes it unlawful for physicians, surgeons, and other licensed professionals to refer a person for certain healthcare services if they have a financial interest with the person or entity that receives the referral. While PORA also provides certain exemptions from this prohibition, failure to fit within an exemption in violation of PORA can lead to a misdemeanor offense that may subject a physician to civil penalties and disciplinary action by the Medical Board of California.
For example, Section 445 of the California Health and Safety Code provides that “no person, firm, partnership, association or corporation, or agent or employee thereof, shall for profit refer or recommend a person to a physician, hospital, health-related facility, or dispensary for any form of medical care or treatment of any ailment or physical condition. The imposition of a fee or charge of any such referral or recommendation creates a presumption that the referral or recommendation is for profit.” A violation of Section 445 is a misdemeanor and may subject the offender to imprisonment and/or monetary fines. Further, the California Attorney General may enjoin a violation of Section 445. Section 650 of the California Business and Professions Code contains prohibitions against self-referral and kickbacks and makes it unlawful for a “licensee,” including a physician, to pay or receive any compensation or inducement for referring patients, clients, or customers to any person or entity, irrespective of any membership or proprietary interest in or with the person or entity receiving the referral. Violation of the statute is a public offense punishable by imprisonment and/or monetary fines. Section 650 further provides that it is not unlawful for a physician to refer a patient to a healthcare facility solely because the physician has a proprietary interest or co-ownership in a healthcare facility, provided that (1) the physician’s return on investment for that proprietary interest or co-ownership is based upon the amount of capital investment or proportional ownership of the physician; and (2) the ownership interest is not based on the number or value of any patients referred. A violation of Section 650 is a misdemeanor and may subject the offender to imprisonment and/or monetary fines.
We cannot assure that the applicable regulatory authorities will not determine that some of our arrangements with physicians violate the federal Anti-Kickback Statute or other applicable laws. An adverse determination could subject us to different liabilities, including criminal penalties, civil monetary penalties, and exclusion from participation in Medicare, Medicaid, or other healthcare programs, any of which could have a material adverse effect on our business, financial condition, or results of operations.
Antitrust Laws
The federal government and most states have enacted antitrust laws that prohibit certain types of conduct deemed to be anti-competitive. These laws prohibit price fixing, market allocation, concerted refusal to deal, market monopolization, price discrimination, tying arrangements, acquisitions of competitors, and other practices that have, or may have, an adverse effect on competition. Violations of federal or state antitrust laws can result in various sanctions, including criminal and civil penalties. Antitrust enforcement in the healthcare industry is currently a priority of the Federal Trade Commission and the U.S. Department of Justice. A review or action by regulatory authorities or the courts that is negative in nature as to the relationship between us and the physician groups or IPAs that we manage or contract with, could force us to terminate those contractual relationships. We believe we are in compliance with such federal and state laws, but courts or regulatory authorities may reach a determination in the future that could adversely affect our operations.
Stark Law
The federal Stark Law, also known as the physician self-referral law, generally prohibits a physician from referring Medicare and Medicaid patients to an entity (including hospitals) providing “designated health services” if the physician or a member of the physician’s immediate family has a “financial relationship” with the entity, unless a specific exception applies. Designated health services include, among other services, inpatient hospital services, outpatient prescription drug services, clinical laboratory services, certain imaging services (e.g., MRI, CT, ultrasound), and other services that our affiliated physicians may order for their patients. The prohibition applies regardless of the reasons for the financial relationship and the referral, and therefore, unlike the federal Anti-Kickback Statute, intent to violate the law is not required. Like the Anti-Kickback Statute, the Stark Law contains
20
Table of Contents
statutory and regulatory exceptions intended to protect certain types of transactions and arrangements. Unlike safe harbors under the Anti-Kickback Statute, with which compliance is voluntary, an arrangement must comply with every requirement of a Stark Law exception, or the arrangement is in violation of the Stark Law.
Because the Stark Law and implementation regulations continue to evolve and are detailed and complex, while we attempt to structure our relationships to meet an exception to the Stark Law, there can be no assurance that the arrangements entered into by us with affiliated physicians and facilities will be found to be in compliance with the Stark Law, as it ultimately may be implemented or interpreted. The penalties for violating the Stark Law can include denial of payment for services ordered in violation of the statute, mandatory refunds of any sums paid for such services, civil penalties for each violation, double damages, and possible exclusion from future participation in the governmental healthcare programs. A person who engages in a scheme to circumvent the Stark Law’s prohibitions may face substantial fines for each applicable arrangement or scheme.
On December 2, 2020, in conjunction with HHS’s Regulatory Sprint to Coordinated Care, CMS issued a final rule intended to address the regulatory impact and burden of the Stark Law that impeded the healthcare system’s move toward value-based reimbursement. CMS added new exceptions to attempt to address potential barriers to coordinated care and value-based care. The changes implemented by the final rules went into effect on January 19, 2021. These or other changes implemented by CMS in the future may impact our business, results of operations, and financial condition.
Some states, including the states in which we operate, have enacted statutes and regulations against self-referral arrangements similar to the federal Stark Law, but which may be applicable to the referral of patients regardless of their payer source and which may apply to different types of services. These state laws may contain statutory and regulatory exceptions that are different from those of the federal law and that may vary from state to state. For example, California has adopted PORA, which makes it unlawful for physicians, surgeons, and other licensed professionals to refer a person for certain healthcare services if they have a financial interest with the person or entity that receives the referral. While PORA also provides certain exemptions from this prohibition, failure to fit within an exemption in violation of PORA can lead to a misdemeanor offense that may subject a physician to civil penalties and disciplinary action by the Medical Board of California.
An adverse determination under these state laws and/or the federal Stark Law could subject us to different liabilities, including criminal penalties, civil monetary penalties, and exclusion from participation in Medicare, Medicaid, or other healthcare programs, any of which could have a material adverse effect on our business, financial condition, or results of operations.
With regards to both the Stark Law and Anti-Kickback Statute, there is significant uncertainty regarding how the U.S. Supreme Court’s holding in Loper Bright (as defined below) (which ended so-called “Chevron deference” to agencies regarding their interpretation of federal statutes) will affect agency rules and sub-regulatory guidance as they apply to federal and state investigations related to healthcare fraud.
Health Information Privacy and Security Standards
The privacy regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended, contain detailed requirements concerning the use and disclosure of individually identifiable patient health information (“PHI”) by entities like our MSOs and affiliated IPAs and medical groups. HIPAA-covered entities must implement certain administrative, physical, and technical security standards to protect the integrity, confidentiality, and availability of certain electronic health information received, maintained, or transmitted. HIPAA also implemented standard transaction code sets and standard identifiers that covered entities must use when submitting or receiving certain electronic healthcare transactions, including billing and claim collection activities. New health information standards could have a significant effect on the manner in which we do business, and the cost of complying with new standards could be significant.
Violations of the HIPAA privacy and security rules may result in civil and criminal penalties, including a tiered system of civil money penalties. A HIPAA-covered entity must also promptly notify affected individuals where a breach affects more than 500 individuals and report annually any breaches affecting fewer than 500 individuals.
21
Table of Contents
State attorneys general may bring civil actions on behalf of state residents for violations of the HIPAA privacy and security rules, obtain damages on behalf of state residents, and enjoin further violations. Many states also have laws that protect the privacy and security of confidential personal information, which may be similar to, or even more stringent than, HIPAA. Where applicable state laws are more protective than HIPAA, we are required to comply with the stricter provisions. Some of these state laws may impose fines and penalties on violators and may afford private rights of action to individuals who believe their personal information has been misused. California’s patient privacy laws, for example, provide for monetary penalties and permit injured parties to sue for damages. Both state and federal laws are subject to modification or enhancement of privacy protection at any time.
In January 2025, the Office of Civil Rights published a proposed rule that would substantially rewrite the HIPAA Security Rule, including significant tightening of rules and updating the application of rules for new technologies.
If we fail to comply with HIPAA or similar state laws, we could incur substantial civil, monetary, or criminal penalties. We expect increased federal and state privacy and security enforcement efforts.
Knox-Keene Act and State Insurance Laws
The Knox-Keene Act is the California law that regulates managed care plans. Neither our MSOs nor their managed medical groups and IPAs hold a Knox-Keene license. Some of the medical groups and IPAs that have entered into MSAs with our MSOs have historically contracted with health plans and other payers to receive capitation payments and assumed the financial responsibility for professional services. In many of these cases, the health plans or other payers separately enter into contracts with hospitals that receive payments and assume some type of contractual financial responsibility for their institutional services. In some instances, our affiliated medical groups and IPAs have been paid by their contracting payers or hospitals for the financial outcome of managing the care costs associated with both the professional and institutional services received by patients, and have recognized a percentage of the surplus of institutional revenues less institutional expense as the medical groups’ and IPAs’ net revenues; and, under certain circumstances, may be responsible for a percentage of any shortfall in the event that institutional expenses exceed institutional revenues. While our MSOs and their managed medical groups and IPAs are not contractually obligated to pay claims to hospitals or other institutions under these arrangements, if it is determined that our MSOs or the medical groups and IPAs have been inappropriately taking financial risk for institutional and professional services without a Knox-Keene license or regulatory exemption as a result of their hospital and physician arrangements, we may be required to obtain a restricted Knox-Keene license to resolve such violations and we could be subject to civil and criminal liability, any of which could have a material adverse effect on our business, financial condition, or results of operations.
In addition, some states require ACOs to be registered or otherwise comply with state insurance laws. Our ACOs are not registered with any state insurance agency. If it is determined that we have been inappropriately operating an ACO without state registration or licensure, we may be required to obtain such registration or licensure to resolve such violations, and we could be subject to liability, which could have a material adverse effect on our business, financial condition, or results of operations.
Environmental and Occupational Safety and Health Administration Regulations
We are subject to federal, state, and local regulations governing the storage, use, and disposal of waste materials and products. Although we believe that our safety procedures for storing, handling, and disposing of these materials and products comply with the standards prescribed by law and regulation, we cannot eliminate the risk of accidental contamination or injury from those hazardous materials. In the event of an accident, we could be held liable for any resulting damages and any liability could exceed the limits or fall outside the coverage of our insurance policies, which we may not be able to maintain on acceptable terms, or at all. We could incur significant costs, and the attention of our management could be diverted to comply with current or future environmental laws and regulations. Federal regulations promulgated by the Occupational Safety and Health Administration impose additional requirements on us, including those protecting employees from exposure to elements such as blood-borne pathogens. We cannot predict the frequency of compliance, monitoring, or enforcement actions to which we may be subject as those regulations are being implemented, which could adversely affect our operations.
22
Table of Contents
Other Federal and State Healthcare Laws
We are also subject to other federal and state healthcare laws that could have a material adverse effect on our business, financial condition, or results of operations. The Health Care Fraud Statute prohibits any person from knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program, which can be either a government or private payer plan. Violation of this statute, even in the absence of actual knowledge of or specific intent to violate the statute, may be charged as a felony offense and may result in fines, imprisonment, or both. The Health Care False Statement Statute prohibits, in any matter involving a federal healthcare program, anyone from knowingly and willfully falsifying, concealing, or covering up, by any trick, scheme, or device, a material fact, or making any materially false, fictitious, or fraudulent statement or representation, or making or using any materially false writing or document knowing that it contains a materially false or fraudulent statement. A violation of this statute may be charged as a felony offense and may result in fines, imprisonment, or both. Under the Civil Monetary Penalties Law of the Social Security Act, a person (including an organization) is prohibited from knowingly presenting or causing to be presented to any United States officer, employee, agent, department, or any state agency a claim for payment for medical or other items or services where the person knows or should know (a) the items or services were not provided as described in the coding of the claim, (b) the claim is a false or fraudulent claim, (c) the claim is for a service furnished by an unlicensed physician, (d) the claim is for medical or other items or service furnished by a person or an entity that is in a period of exclusion from the program, or (e) the items or services are medically unnecessary items or services. Violations of the law may result in substantial penalties, treble damages, and exclusion from federal healthcare programs. In addition, the OIG may impose civil monetary penalties against any physician who knowingly accepts payment from a hospital (as well as against the hospital making the payment) as an inducement to reduce or limit medically necessary services provided to Medicare or Medicaid program beneficiaries. Further, except as permitted under the Civil Monetary Penalties Law, a person who offers or transfers to a Medicare or Medicaid beneficiary any remuneration that the person knows or should know is likely to influence the beneficiary’s selection of a particular provider of Medicare or Medicaid payable items or services may be liable for civil money penalties for each wrongful act.
In addition to the state laws previously described, we may also be subject to other state fraud and abuse statutes and regulations as we continue to expand our operations. Many states have adopted a form of anti-kickback law, self-referral prohibition, and false claims and insurance fraud prohibition. The scope and interpretations of these laws vary from state to state and are enforced by state courts and regulatory authorities, each with broad discretion. Generally, state laws reach all healthcare services, not just those covered under a governmental healthcare program. Determining liability under any of these laws could result in fines, penalties, and restrictions on our ability to operate in these states. We cannot assure that our arrangements or business practices will not be subject to government scrutiny or be found to violate applicable fraud and abuse laws.
Licensure, Certification, Accreditation, and Related Laws and Guidelines
Our clinical personnel are subject to numerous federal, state, and local licensing laws and regulations relating to, among other things, professional credentialing and professional ethics. Clinical professionals are also subject to state and federal regulations regarding prescribing medication and controlled substances. Our affiliated physicians and hospitalists must satisfy and maintain their individual professional licensing in each state where they practice medicine, including California. Many states also require that nurse practitioners and physician assistants work in collaboration with or under the supervision of a physician. Each state defines the scope of practice of clinical professionals through legislation and through the respective Boards of Medicine and Nursing. Activities that qualify as professional misconduct under state law may subject our clinical personnel to sanctions or to even lose their license, and could potentially subject us to sanctions as well. Some state boards of medicine impose reciprocal discipline—that is, if a physician is disciplined for professional misconduct in one state where they are licensed, another state where they are also licensed may impose the same discipline, even though the conduct occurred in another state. Since we and our affiliated medical groups perform services at hospitals and other healthcare facilities, we may indirectly be subject to laws, ethical guidelines, and operating standards of professional trade associations and private accreditation commissions (such as the American Medical Association and The Joint Commission) applicable to those entities. Penalties for non-compliance with these laws and standards include loss of professional license, civil or criminal fines and penalties, loss of hospital admitting privileges, and exclusion from participation in various governmental and other third-party healthcare programs. In addition, our affiliated facilities are subject to state and local licensing regulations ranging from the adequacy of medical care to compliance with
23
Table of Contents
building codes and environmental protection laws. Our ability to operate profitably will depend, in part, on our and our affiliated physicians’ and facilities’ ability to obtain and maintain all necessary licenses and other approvals, and to operate in compliance with applicable healthcare and other laws and regulations that evolve rapidly. We provide home health, hospice, and palliative care, which require compliance with additional regulatory requirements. Reimbursement for palliative care and house call services is generally conditioned on clinical professionals providing the correct procedure and diagnosis codes and properly documenting both the service and its medical necessity. Incorrect or incomplete documentation and billing information, or the incorrect selection of codes for the level and type of service provided, could result in non-payment for services rendered or lead to allegations of billing fraud. We must also comply with laws relating to hospice care eligibility, development, and maintenance of care plans, and coordination with nursing homes or assisted living facilities where patients live.
Professional Liability and Other Insurance Coverage
Our business has an inherent and significant risk of claims of medical malpractice against us and our affiliated physicians. We and our affiliated physician groups pay premiums for third-party professional liability insurance that provides indemnification on a claims-made basis for losses incurred related to medical malpractice litigation in order to carry out our operations. Our physicians are required to carry first-dollar coverage with limits of liability equal to and not less than $1 million for claims based on occurrence, up to an aggregate of $3.0 million per year. Our IPAs purchase stop-loss insurance, which will reimburse them for claims from service providers on a per-enrollee basis. The specific retention amount per enrollee per policy period is $45,000 to $0.4 million for professional coverage. We also maintain workers’ compensation, director and officer, and other third-party insurance coverage, subject to deductibles and other restrictions that we believe are in accordance with industry standards. While we believe that our insurance coverage is adequate based upon claims experience and the nature and risks of our business, we cannot be certain that our insurance coverage will be adequate to cover liabilities arising out of pending or future claims asserted against us or our affiliated physician groups in the future where the outcomes of such claims are unfavorable. The ultimate resolution of pending and future claims in excess of our insurance coverage may have a material adverse effect on our business, financial position, results of operations, or cash flows.
Available Information
We maintain a website at www.astranahealth.com and make available there, free of charge, our periodic reports and current reports filed with the SEC, and any amendments to such reports, as soon as is reasonably practicable after filing or furnishing such reports with the SEC. Information contained on or accessible through, including any reports available on, our website is not a part of, and is not incorporated by reference into, this Annual Report on Form 10-K or any other report or document we file with the SEC. Any reference to our website in this Annual Report on Form 10-K is intended to be an inactive textual reference only. The SEC maintains a website at http://www.sec.gov that contains reports, proxy and information statements, and other information regarding issuers such as us that file electronically with the SEC.
24
Table of Contents
Item 1A. Risk Factors
Investing in our common stock involves a high degree of risk. You should carefully consider the risks and uncertainties described below, together with all of the other information in this Annual Report on Form 10-K, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Part II, Item 7, and our consolidated financial statements and related notes, before making a decision to invest in our common stock. Although the risks are organized by headings and each risk is discussed separately, many are interrelated. Disclosures of risks should not be interpreted to imply that the risks have not already materialized, and the risks and uncertainties described below may not be the only ones we face. If any of the risks actually occur, our business, financial condition, operating results, and prospects could be materially and adversely affected. In that event, the market price of our common stock could decline, and you could lose part or all of your investment.
Summary of Risk Factors
Our business is subject to numerous risks and uncertainties, discussed in more detail in the following section. These include, among others, the following key risks:
•
We are subject to a variety of risks relating to the Prospect Acquisition, including a material increase in our indebtedness, challenges in integrating Prospect into our operations, and risks related to the acquired hospital.
•
We may need to raise additional capital to grow, which might not be available.
•
We could be negatively impacted by uncertain or adverse economic conditions and/or public health crises.
•
Potential changes in laws, accounting principles, and regulations related to VIEs could impact our consolidation of total revenues derived from our affiliated physician groups.
•
The arrangements we have with our VIEs are not as secure as direct ownership of such entities.
•
We currently derive a substantial portion of our revenues in California and are vulnerable to changes in that state.
•
Our business strategy involves acquisitions and strategic partnerships, which can be costly, risky, and complex.
•
The Company’s complex legal structure may cause tax authorities to question our tax filing status. The Company can be adversely impacted if a tax authority does not agree with our position.
•
We may encounter difficulties in managing our growth, and the nature of our business and rapid changes in the healthcare industry make it difficult to reliably predict future growth and operating results.
•
We could experience significant losses under capitation contracts if our expenses exceed revenues.
•
If our agreements with affiliated physician groups are deemed invalid or are terminated under applicable law, our results of operations and financial condition will be materially impaired.
•
Our revenues and operations are dependent on a limited number of key payers.
•
We may be impacted by a shift in payer mix, including eligibility changes to government and private insurance programs.
•
Many of our agreements with hospitals and medical groups have limited durations, may be terminated without cause by them, and prohibit us from acquiring physicians or patients from or competing with them.
25
Table of Contents
•
The healthcare industry is intensely regulated at the federal, state, and local levels, and government authorities may determine that we fail to comply with applicable laws or regulations and take action against us. In addition, changes to federal, state, and local healthcare law, including the ACA and/or the adoption of a primarily publicly funded healthcare system, may negatively impact our business.
•
Medicaid, Medicare, or Marketplace capitation rates may be insufficient to fully cover our medical care costs and/or the rates of utilization of our members, including without limitation inpatient and outpatient costs, pharmacy costs, and behavior health care costs and the risk that rate increases do not keep pace with an accelerating medical care costs trend.
•
Federal or state legislative or regulatory changes could negatively impact us, including changes to the Medicaid program created by the One Big Beautiful Bill Act (the “OBBBA”), or changes effected through executive orders, to the Medicaid, Medicare, or Marketplace programs, including potential reductions in Medicaid funding, political attacks directed at the health insurance industry regarding managed care and prior authorization practices, the implementation of Medicaid work requirements, uncertainty regarding the status or effect of marketplace subsidies, the implementation of new program integrity rules, insufficient Medicare Advantage Rate Adjustments, new rules pertaining to Medicare risk adjustment data validation, or Amendments of the ACA.
•
We are also subject to laws and regulations not specifically targeting the healthcare industry, compliance with which could require significant expenditures, and failing to comply with such laws could result in sanctions and penalties.
•
The success of our participation in the ACO REACH Model, or any CMS or Centers for Medicare & Medicaid Services Innovation Center (“CMMI”) sponsored model, whether that be the ACO REACH Program or the ACO LEAD Program, is not guaranteed, due to political risks, uncertainties of administration, program economics, and the requirement of the Company to maintain significant capital reserves. We are also subject to similar risks related to our participation in MSSP.
•
Laws regulating the corporate practice of medicine could restrict the manner in which we are permitted to conduct our business, and the failure to comply with such laws could subject us to penalties and restructuring.
•
We may be materially impacted by breaches or compromises of our information security systems or the compromise of our downstream providers’ security systems, and are subject to additional risks related to technology and data privacy, including risks relating to our use of artificial intelligence.
•
Cyberattacks, ransomware incidents, or other privacy or data-security events affecting either us or our third-party vendors that could lead to the unauthorized disclosure of protected information or cause operational disruptions.
•
Our ability to effectively manage operations, including developing and maintaining adequate internal systems and controls relating to, among other things, authorizations, approvals, and provider payments, the overall performance of our care-management initiatives, and our financial reporting, including remediation of the identified material weakness in a timely manner.
•
Controls imposed by Medicare, Medicaid, and private payers designed to reduce inpatient services and associated costs may reduce our revenues.
•
If our affiliated physician groups or risk-bearing entities are not able to satisfy applicable state regulations related to financial solvency and operational performance, they could become subject to sanctions, and their ability to do business in the states in which they are operating could be limited or terminated.
•
We may face lawsuits not covered by insurance, and related expenses may be material.
•
Risks related to ownership of our common stock.
26
Table of Contents
Risks Relating to the Prospect Acquisition.
Financing the Prospect Acquisition resulted in an increase in our indebtedness, which could adversely affect us, including by decreasing our business flexibility and increasing our interest expense.
To provide additional financial flexibility for the Company, in connection with the execution of the Purchase Agreement, the Company entered into the Second Amended and Restated Credit Agreement with Truist Bank, which, among other things, provides for a five-year delayed draw term loan credit facility of up to $745.0 million, of which $707.3 million was drawn down in connection with financing the Prospect Acquisition.
This increase in our indebtedness may, among other things, reduce our flexibility to respond to changing business and economic conditions or to fund capital expenditures or working capital needs. In addition, the amount of cash required to pay interest on our increased indebtedness, and thus the demands on our cash resources, materially increased as a result of the indebtedness to finance the Prospect Acquisition. The Second Amended and Restated Credit Agreement contains various events of default (including failure to comply with the covenants under agreement), and, upon an event of default, the lenders could declare all amounts outstanding to be immediately due and payable and terminate all commitments to extend further credit or require us to seek amendments that would provide for terms more favorable to our lenders, which we may have to accept under the circumstances. The lenders could also foreclose on the secured collateral under the Second Amended and Restated Credit Agreement.
Any difficulties integrating Prospect’s operations could disrupt or have a material adverse effect on our current plans, business, or results of operations.
There can be no assurance that we will be able to successfully integrate the acquired operations or otherwise realize the expected benefits of the Prospect Acquisition (including operating and other cost synergies). Difficulties in integrating the acquired operations into the Company may result in the Company performing differently than expected, in operational challenges, or in the failure to realize anticipated run-rate cost synergies and efficiencies in the expected timeframe or at all, in which case the anticipated benefits of the Prospect Acquisition may not be realized fully, or at all, or may take longer than expected to be realized. Further, it is possible that there could be a loss of our and/or the Sellers’ key employees, disruption of our or the Sellers’ ongoing business, unexpected issues, higher than expected costs, and an overall integration process that takes longer than originally anticipated. The integration of the acquired operations may result in material challenges, including the diversion of management’s attention from ongoing business concerns; retaining key management and other employees; retaining or attracting business and operational relationships; maintaining a positive reputation and retaining patients and providers; the possibility of faulty assumptions underlying expectations regarding the integration process and associated expenses; consolidating corporate and administrative infrastructures, including internal controls, and eliminating duplicative operations; coordinating geographically separate organizations; unanticipated issues in integrating information technology, communications and other systems; and potential unknown liabilities, or unforeseen expenses relating to integration. In addition, we could become exposed to legal claims, governmental investigations, or regulatory actions arising from the Sellers’ activities before the completion of the Prospect Acquisition. These lawsuits, claims, audits, or investigations, regardless of their merit or outcome, could adversely affect our financial condition, reputation, and future business expansion. The occurrence of any of these risks could have a material adverse effect on our business, results of operations, financial condition or cash flows.
We acquired a hospital as part of the Prospect Acquisition, which is a new business for us and could subject us to additional risks and challenges. Our failure to effectively manage such related risks and challenges could adversely affect our business, operating results, and financial condition.
As part of the Prospect Acquisition, we acquired a fully accredited acute care hospital based in Tustin, California, that offers various services and programs, including general and specialized surgery, orthopedics and spine surgery, rehabilitation, imaging and radiology, intensive care, and skilled nursing. We have no experience owning or operating a hospital and, as a result, may encounter significant operational challenges, including clinical risks, labor shortages, complex reimbursement environments, regulatory compliance relating to hospitals, and competition with other hospitals in the same geographic area. We will also be subject to additional risks related to the hospital, including ensuring the business complies with all applicable laws and regulations
27
Table of Contents
and retains necessary certifications. In addition, we may be unable to successfully integrate these new operations with our existing businesses. These risks and challenges could have a material adverse effect on our business, results of operations, financial condition, or cash flows. In addition, Medicaid provider tax reform has been targeted by the current administration to reduce federal Medicaid spending, and restrictions and cuts could adversely impact hospital revenues received from affected programs, as hospital and physician payment rates could be reduced, forcing hospital services to be reduced or closed.
We could incur additional costs and expenses resulting from the July 7, 2025, bankruptcy of certain Prospect asset-seller entities and from the effect of the Prospect letter agreement dated July 1, 2025.
On July 7, 2025, those entities related to Prospect that sold assets to us in the Prospect Acquisition (the “Prospect PhysicianCo Entities”) filed a voluntary petition for relief under Chapter 11 of the Bankruptcy Code, the effect of which could result in their breach or noncompliance with certain contractual obligations under the asset sale transaction, including the payment of claims owed to creditors of the Prospect PhysicianCo Entities or the maintenance of minimum levels of risk-based capital at closing. Although the asset sale transaction may shield us from liabilities of the Prospect PhysicianCo Entities to third parties, it may nevertheless be necessary for us to absorb the costs of such breach or noncompliance to protect our ongoing business interests or relationships. In such event, we would have limited to no recourse against the Prospect PhysicianCo Entities due to their bankruptcy filing, the elimination of the escrow account to cover, among other things, non-assumed liabilities of the Prospect PhysicianCo Entities, and the elimination of recourse (with certain exceptions) against the Prospect PhysicianCo Entities, as set forth in our letter agreement with Prospect dated July 1, 2025.
Risks Relating to Our General Business and Operations.
In 2019, the Company, Astrana Medical, and APC consummated a series of interrelated transactions that may expose the Company and its subsidiaries and VIEs to additional risks, including the inability to repay a significant loan in connection with such transactions.
On September 11, 2019, the Company, Astrana Medical, and APC concurrently consummated a series of interrelated transactions (collectively, the “APC Transactions”), which included a $545.0 million ten-year secured loan made by the Company to Astrana Medical, which Astrana Medical used to purchase 1,000,000 shares of Series A Preferred Stock of APC. The Company obtained the funds to make the loan to Astrana Medical (i) by entering into a credit agreement with Truist Bank, in its capacity as administrative agent for various lenders, and the lenders from time to time party thereto, for a $290.0 million senior secured credit facility (the “Credit Agreement” and the credit facility thereunder, the “Credit Facility”), and then immediately drawing down $250.0 million in cash, and (ii) by selling $300.0 million of shares of the Company’s common stock to APC, the purchase price of which was offset against $300.0 million of Astrana Medical’s purchase price for its APC Series A Preferred Stock.AHM guaranteed the obligations of the Company under the Credit Facility. Both the Company and AHM have granted the lenders a security interest in all of their assets, including, without limitation, in all stock and other equity issued by their subsidiaries (including the shares of AHM) and all rights with respect to the loan to Astrana Medical. The Credit Agreement was subsequently amended and restated on June 16, 2021 (as amended, the “Amended Credit Agreement”) and, in February 2025, the Company entered into the Second Amended and Restated Credit Agreement, which, among other things, provides for (a) a five-year revolving credit facility to the Company of $300.0 million, which includes a letter of credit sub-facility of up to $100.0 million and a swingline loan sub-facility of $25.0 million, (b) a five-year term loan A credit facility to the Company of $250.0 million and (c) a five-year delayed draw term loan credit facility to the Company of up to $745.0 million, of which $707.3 million was drawn down.
28
Table of Contents
The APC Transactions may expose the Company, its subsidiaries and its VIEs to additional risks, including without limitation, the following: Astrana Medical may never be able to repay the loan from the Company; even if Astrana Medical does not, or cannot repay the loan, the Company will be obligated to pay principal and interest on the Second Amended and Restated Credit Facility; the lenders under the Second Amended and Restated Credit Facility have been granted a first priority perfected security interest over all of the assets of the Company and its subsidiaries, and such lenders have the right to foreclose on those assets if the Company defaults on its obligations under the Second Amended and Restated Credit Facility; a disconnect could arise between APC achieving net income, declaring and paying dividends to Astrana Medical, and Astrana Medical making its required payments to the Company, which disconnect could materially negatively impact the Company’s financial results and its ability to make its required payments under the Second Amended and Restated Credit Facility; APC may be prohibited from paying, or may otherwise be unable to pay, the dividends on its Series A Preferred Stock, including under the California Corporations Code; regulators could determine that the current, post-APC Transactions consolidated structure amounts to the Company violating California’s corporate practice of medicine doctrine; and the Company may be deemed an investment company, which could impose burdensome compliance requirements on the Company and restrict its future activities.
Our failure to raise additional capital or generate cash flows necessary to expand our operations and invest in new technologies in the future could reduce our ability to compete successfully and harm our results of operations.
In the future, we may require additional capital to grow our business and may have to raise additional funds by selling equity, issuing debt, borrowing funds, refinancing our existing debt, or selling assets or subsidiaries. We may not be able to obtain additional debt or equity financing on favorable terms, in a timely manner, or at all. If we raise additional equity financing, our security holders may experience significant dilution of their ownership interests. If we engage in additional debt financing, we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity or other ratios, or restrict our ability to pay dividends or make acquisitions. In addition, the covenants in our Second Amended and Restated Credit Agreement may limit our ability to obtain additional debt or issue additional equity securities, and any failure to adhere to these covenants could result in penalties or defaults that could further restrict our liquidity or limit our ability to obtain financing. Furthermore, our ability to obtain additional capital may be adversely impacted by factors beyond our control, such as the market demand for our securities, the state of financial markets generally, and other relevant factors, including potential worsening global economic conditions resulting from high inflation and interest rates, ongoing supply chain disruptions and shortages, labor shortages and geopolitical conditions, and any disruptions to, or volatility in, the credit and financial markets in the United States and worldwide, including those that arise from any economic downturn or recession. If we need additional capital and cannot raise it on acceptable terms, or at all, we may not be able to, among other things, develop and enhance our patient services; continue to expand our organization; hire, train, and retain employees; respond to competitive pressures or unanticipated working capital requirements; or pursue acquisition opportunities.
The Company has a complex legal structure, and tax regulatory authorities may disagree with our positions and conclusions regarding certain tax positions, resulting in unanticipated costs or non-realization of expected benefits.
The Company has a complex legal structure, and a tax authority may disagree with tax positions that we have taken. For example, the Internal Revenue Service or another tax authority could challenge our allocation of income by tax jurisdiction and the amounts paid between our affiliated companies pursuant to our intercompany arrangements and transfer pricing policies, including amounts paid with respect to our legal structure. A tax authority may take the position that material income tax liabilities, interest, and penalties are payable by us, in which case, we could elect to contest such an assessment. Contesting such an assessment may be lengthy and costly. If we were unsuccessful in disputing the assessment, the implications could be materially adverse to us and affect our anticipated effective tax rate or operating income. We could be required to pay substantial penalties and interest where applicable. The Company is currently under examination by the Internal Revenue Service for our 2019–2022 tax returns.
29
Table of Contents
Our net operating loss carryforwards and certain other tax attributes will be subject to limitations.
If a corporation undergoes an “ownership change” within the meaning of Section 382 of the Internal Revenue Code of 1986, as amended, its net operating loss carryforwards and certain other tax attributes arising from before the ownership change are subject to limitations on use after the ownership change. In general, an ownership change occurs if a cumulative change in the corporation’s equity ownership by certain stockholders exceeds 50 percentage points over a rolling three-year period. Similar rules may apply under state tax laws. Future ownership changes could result in additional limitations on our net operating loss carryforwards. Consequently, we may not be able to utilize a material portion of our net operating loss carryforwards and other tax attributes to offset our tax liabilities, which could have a material adverse effect on our cash flows and results of operations.
The “One Big Beautiful Bill Act” could adversely affect our business and results of operations.
The OBBBA, enacted on July 4, 2025, makes significant changes to the Medicaid, Medicare, and Health Insurance Marketplace federal healthcare programs. Changes include new requirements that states must meet to maintain federal support for Medicaid programs, as well as stricter criteria that beneficiaries must meet to qualify for and maintain enrollment in federal healthcare programs. In 2025, the OBBBA reduced federal and state income tax payables, but this did not have a material impact on tax expenses/(benefits). In addition, the effect of these changes could result in reductions in our patient population and managed care enrollees that we serve across our federal healthcare program lines of business due to, among other things, more stringent eligibility requirements such as the imposition of work or community service requirements, and copayments on many services, limitation of Medicaid eligibility to certain lawfully present individuals, and the effect of immigration enforcement actions which may discourage beneficiaries from applying or reapplying for federal healthcare benefits. Loss of Medicaid benefits may also result in a higher volume of uncompensated emergency admissions of uninsured individuals at the Company’s hospital. These risks could have a material adverse effect on our business, results of operations, financial condition, or cash flows.
Uncertain or adverse economic conditions could adversely impact us.
The U.S. and global economy, as well as our business and results of operations, may be negatively impacted by a variety of factors, including inflation, variable interest rates, supply chain, and labor disruptions, tariffs and other trade barriers or restrictions, decreased consumer spending, unemployment rates, banking instability, political instability or social unrest, reduced federal and state government spending on healthcare programs, geopolitical events and uncertainty (such as the Ukraine-Russia conflict and Israel-Hamas war), any downgrades in the U.S. government’s sovereign credit rating, a prolonged shutdown of the U.S. federal government, public health crises, and an economic downturn or recession. A downturn in economic conditions could have a material adverse effect on our results of operations, financial condition, business prospects, and stock price. In addition, any potential period of extended or increased job losses in the U.S. as a result of adverse economic conditions, including economic deterioration or changes in immigration regulations, could ultimately result in a smaller percentage of our patients being covered by an employer group health plan and a larger percentage being covered by lower-paying government insurance programs or being uninsured. Historically, government budget limitations have resulted in reduced spending. Given that Medicaid is a significant component of state budgets, an economic downturn would put continued cost containment pressures on Medicaid outlays for healthcare services, including in California and other states where we operate. The existing federal deficit and continued deficit spending by the federal government could lead to reduced government expenditures, including for government-funded programs in which we participate, such as Medicare. An economic downturn and sustained unemployment may also impact the number of enrollees in managed care programs and the profitability of managed care companies, which could result in reduced reimbursement rates. Although we attempt to stay informed, any sustained failure to identify and respond to these trends could have a material adverse effect on our results of operations, financial condition, business, and prospects.
We may be required to take write-downs or write-offs, restructuring, impairment, or other charges that could have a significant negative effect on our financial condition, results of operations, and stock price.
The Company may be forced to write-down or write-off assets in the future, restructure its operations, or incur impairment or other charges that could result in losses. Even though these charges may not have an immediate impact on our liquidity, the fact that we report charges of this nature could contribute to negative market perceptions about us or our securities, and may make it difficult to obtain future financing on favorable terms or at all.
30
Table of Contents
From time to time, our intangible assets are subject to impairment testing. Under current accounting standards, our goodwill, including acquired goodwill, is tested for impairment annually and may be subject to impairment losses as circumstances change (e.g., after an acquisition). If we record an impairment loss, it could have a material adverse effect on our results of operations for the year in which the impairment is recorded.
A prolonged disruption of or any actual or perceived difficulties in the capital and credit markets may adversely affect our future access to capital, our cost of capital, and our ability to continue operations.
Our operations and performance depend primarily on economic conditions in the U.S. and in the states in which we operate, and on their impact on purchases of, or capitated rates for, our healthcare services. Our business is significantly exposed to risks associated with government spending and private payer reimbursement rates. A number of factors have negatively impacted the economy in recent years, including inflation, variable interest rates, supply chain, and labor disruptions, geopolitical events and uncertainty, unemployment rates, shutdowns of the U.S. federal government, and declines in consumer and business confidence, as well as private and government spending, together with significant reductions in the availability of and increases in the cost of credit and volatility in the capital and credit markets. Such factors have adversely affected, and could in the future adversely affect, the business and economic environment in which we operate and our profitability and could also adversely affect our patients’ spending habits, private payers’ access to capital, and governmental budgetary processes, which, in turn, could result in reduced revenue for us. The continuation or recurrence of any of these conditions may adversely affect our cash flows, results of operations, and financial condition. As economic uncertainty may persist, our patients, private payers, and government payers may alter their purchasing of healthcare services. Our patients may scale back healthcare spending, and private and government payers may reduce reimbursement rates, which may also delay or cancel consumer spending on discretionary and non-reimbursed healthcare. This uncertainty may also affect our ability to prepare accurate financial forecasts or meet specific forecasted results, and we may be unable to adequately respond to or forecast further changes in demand for healthcare services. Volatility and disruption of capital and credit markets may adversely affect our access to capital and increase our cost of capital. Should current economic and market conditions deteriorate, our ability to finance ongoing operations and our expansion may be adversely affected; we may be unable to raise the necessary funds; our cost of debt or equity capital may increase significantly; and future access to capital markets may be adversely affected.
If there is a change in accounting principles or the interpretation thereof affecting the consolidation of VIEs, it could impact our consolidation of total revenues derived from our affiliated physician groups.
Our financial statements are consolidated and include the accounts of our majority-owned subsidiaries and various non-owned affiliated physician groups that are VIEs, whose consolidation is effectuated in accordance with applicable accounting rules promulgated by the Financial Accounting Standards Board (“FASB”). Such accounting rules require that, under some circumstances, the VIE consolidation model be applied when a reporting enterprise holds a variable interest (e.g., equity interests, debt obligations, certain management, and service contracts) in a legal entity. Under this model, an enterprise must assess the entity in which it holds a variable interest to determine whether it meets the criteria to be consolidated as a VIE. If the entity is a VIE, the consolidation framework next identifies the party, if any, that possesses a controlling financial interest in the VIE and then requires that party to consolidate the VIE, as it is the primary beneficiary. An enterprise’s determination of whether it has a controlling financial interest in a VIE requires a qualitative assessment and is not based solely on voting rights. If an enterprise determines the entity in which it holds a variable interest is not subject to the VIE consolidation model, the enterprise should apply the traditional voting control model, which focuses on voting rights.
In our case, the VIE consolidation model applies to our controlled, but not owned, physician-affiliated entities. However, our determination regarding the consolidation of our affiliates could be challenged, which could have a material adverse effect on our operations. In addition, in the event of a change in accounting rules or FASB’s interpretations thereof, or if there were an adverse determination by a regulatory agency or a court or a change in state or federal law relating to the ability to maintain present agreements or arrangements with our affiliated physician groups, we may not be permitted to continue to consolidate the revenues of our VIEs.
31
Table of Contents
Breaches or compromises of our information security systems or our information technology systems or infrastructure could result in exposure of private information, disruption of our business, and damage to our reputation, which could harm our business, results of operation, and financial condition.
In the ordinary course of our business, we create, receive, maintain, transmit, collect, store, use, disclose, share, and process sensitive data, including PHI and other types of personal data or personally identifiable information (collectively, “PII” and, together with PHI, “PHI/PII”) relating to our patients, employees, vendors, and others. We also contract with third-party service providers to process sensitive information, including PHI/PII, confidential information, and other proprietary business information. We depend heavily on information technology networks and systems, including the internet, to securely process PHI/PII and other sensitive data and information. Security breaches of this infrastructure, whether ours or of our third-party service providers, including physical or electronic break-ins, employee or service provider error, third-party action, including actions of foreign actors, insider attacks, phishing or denial-of-service attacks, the introduction of computer viruses and/or malicious or destructive code, ransomware or other malware, social engineering, malfeasance, other unauthorized physical or electronic access, or other vulnerabilities, could result in system disruptions, shutdowns or unauthorized access, acquisition, use, disclosure or modifications of such data or information, and could cause PHI/PII to be accessed, acquired, used, disclosed or modified without authorization, to be made publicly available, or to be further accessed, acquired, used or disclosed. Such incidents could also lead to widespread technology outages, interruptions, or other failures of operational communication or other systems globally and across companies and industries. We completed the Prospect Acquisition during 2025, and integrating the information technology, communications, and other systems could increase the risk of security breaches. To our knowledge, while we have experienced cyber incidents, we have not experienced any material breaches of our cybersecurity systems.
We use third-party service providers for important aspects of processing employee and patient PHI/PII and other confidential and sensitive data and information, and therefore rely on third parties to manage functions with material cybersecurity risks. Because we do not control our vendors or service providers and our ability to monitor their cybersecurity is limited, we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share with them or prevent any disruption arising from a technology failure, cyber-attack or other information or security breach. We depend on such parties to implement adequate controls and safeguards to protect against and report cyber incidents. If such parties fail to deter, detect or report cyber incidents in a timely manner, we may suffer from financial and other harm, including to our information, operations, performance, employees and reputation. In addition, because of the sensitivity of the PHI/PII and other sensitive data and information that we and our service providers process, the security of our technology platform and other aspects of our services, including those provided or facilitated by our third-party service providers, are important to our operations and business strategy. We have implemented certain administrative, physical, and technological safeguards to address these risks; however, such policies and procedures may not address certain HIPAA requirements or address situations that could lead to increased privacy or security risks. We may be required to expend significant capital and other resources to protect against security breaches, to safeguard the privacy, security, and confidentiality of PHI/PII and other sensitive data and information, to investigate, contain, remediate, and mitigate actual or potential security breaches, and/or to report security breaches to patients, employees, regulators, media, credit bureaus, and other third parties in accordance with applicable law and to offer complimentary credit monitoring, identity theft protection, and similar services to patients and/or employees where required by law or otherwise appropriate. Cyber-attacks are becoming more sophisticated and frequent, and we or our third-party service providers may be unable to anticipate these techniques or implement adequate protective measures against them or to prevent future attacks, and future cyber-attacks could go undetected and persist for an extended period of time. Furthermore, to the extent AI capabilities continue to improve and are increasingly adopted, they may be used to identify vulnerabilities and craft increasingly sophisticated cybersecurity attacks, including the use of generative AI to conduct more sophisticated social engineering attacks on the Company, suppliers or customers. In addition, vulnerabilities may be introduced from the use of AI by us and our third-party service providers.
32
Table of Contents
A security breach, security incident, third-party outage, or privacy violation that leads to unauthorized use, disclosure, access, acquisition, loss, or modification of, or that prevents access to or otherwise impacts the confidentiality, security, or integrity of, patient or employee information, including PHI/PII that we or our third-party service providers process, or other confidential information could harm our reputation and business, compel us to comply with breach notification laws, cause us to incur significant costs for investigation, containment, remediation, mitigation, fines, penalties, settlements, notification to individuals, regulators, media, credit bureaus, and other third parties, complimentary credit monitoring, identity theft protection, training, and similar services to participants and/or employees where required by law or otherwise appropriate, for measures intended to repair or replace systems or technology and to prevent future occurrences. In addition, security breaches and incidents, and other compromises or inappropriate access to, or acquisition or processing of, PHI/PII or other sensitive data or information can be difficult to detect, and any delay in identifying such breaches or incidents or in providing timely notification of such incidents may lead to increased harm and increased penalties. While we carry cyber insurance, we cannot be certain that our coverage will be adequate for liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim.
If we or our third-party service providers are unable to prevent or mitigate security breaches, security incidents, outages or privacy violations in the future, or if we or our third-party service providers are unable to implement satisfactory remedial measures with respect to known or future security incidents or outages, or if it is perceived that we have been unable to do so, our operations could be disrupted, we may be unable to provide access to our systems, and we could suffer a loss of patients, loss of reputation, adverse impacts on patient and investor confidence, financial loss, litigation, governmental investigations or other actions, regulatory or contractual penalties, and other claims and liability.
We rely on complex software systems and hosted applications to operate our business, and our business may be disrupted if we are unable to successfully or efficiently update these systems or convert to new systems.
We are increasingly dependent on technology systems to operate our business, reduce costs, and enhance customer service. These systems include complex software systems and third-party-hosted applications. Software systems need to be updated regularly with patches, bug fixes, and other modifications. Hosted applications are subject to service availability and the reliability of hosting environments. We also migrate from legacy systems to new systems from time to time. Maintaining existing software systems, implementing upgrades, and converting to new systems are costly and require personnel and other resources. The implementation of these systems upgrades and conversions is a complex and time-consuming project involving substantial expenditures for implementation activities, consultants, system hardware, and software, so it often requires transforming our current business and processes to conform to new systems, and therefore, may take longer, be more disruptive, and cost more than forecast and may not be successful. If the implementation is delayed or otherwise is unsuccessful, it may hinder our business operations and negatively affect our financial condition and results of operations. There are many factors that may materially and adversely affect the schedule, cost, and execution of the implementation process, including, without limitation, problems in the design and testing of new systems; system delays, malfunctions and third-party outages; the deviation by suppliers and contractors from the required performance under their contracts with us; the diversion of management attention from our daily operations to the implementation project; reworks due to unanticipated changes in business processes; difficulty in training employees in the operation of new systems and maintaining internal control while converting from legacy systems to new systems; and integration with our existing systems. Some of such factors may not be reasonably anticipated or may be beyond our control.
We may face risks associated with our use of certain AI and machine learning models.
Our business utilizes AI and machine learning technologies, to add AI-based applications to our offerings and to drive efficiencies in our business. Further, certain of our third-party vendors utilize AI and machine learning technologies in furnishing services to us. As with many technological innovations, AI presents risks and challenges that could affect its adoption, and therefore our business. Our offerings utilize, and we plan to further examine, develop and introduce machine learning algorithms, predictive analytics, and other AI technologies to offer new applications, upgrade our solutions and enhance our capabilities, among other things, to identify trends, anomalies and correlations, provide alerts and initiate business processes. If these AI or machine learning models are incorrectly designed, the performance of our products, services, and business, as well as our reputation, could suffer, or we could incur liability through the violation of laws or contracts to which we are a party.
33
Table of Contents
Additionally, we may make future investments in adopting AI and machine learning technologies across our business. AI and machine learning technologies are complex and rapidly evolving, and we face significant competition from other companies in our industry as well as an evolving regulatory landscape. Our efforts in developing AI and machine learning technologies may not succeed, and our competitors may be able to deploy such technologies faster. We may further be exposed to competitive risks related to the adoption and application of new technologies by established market participants, new entrants, and others. The speed of technological development may prove disruptive to our business if we are unable to maintain the pace of innovation.
In addition, market acceptance of AI and machine learning technologies is uncertain. These efforts, including the introduction of new products or changes to existing products, may result in new or enhanced governmental or regulatory scrutiny, litigation, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results. Changes to existing regulations, their interpretation or implementation, or new regulations could impede our use of AI and machine learning technologies and may also increase our estimated costs in this area. In addition, market acceptance of AI and machine learning technologies is uncertain, and we may be unsuccessful in our product development efforts. Any of these factors could adversely affect our business, financial condition, and results of operations. To compete effectively, we must also be responsive to technological change, potential regulatory developments, and public scrutiny.
If our internal control over financial reporting is not considered effective or material weaknesses are not remediated on a timely basis, our business and stock price could be adversely affected.
Section 404 of the Sarbanes-Oxley Act of 2002 requires us to evaluate the effectiveness of our internal control over financial reporting as of the end of each fiscal year, and to include a management report assessing the effectiveness of our internal control over financial reporting in our Annual Report on Form 10-K for that fiscal year. Section 404 also requires our independent registered public accounting firm to attest to, and report on, management’s assessment of our internal control over financial reporting. Our management, including our principal executive officer and principal financial officer, does not expect that our internal control over financial reporting will prevent all errors and fraud. A control system, no matter how well-designed and operated, can provide only reasonable, not absolute, assurance that the control system’s objectives will be met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud involving a company have been, or will be, detected. The design of any control system is based in part on certain assumptions about the likelihood of future events, and we cannot assure you that any design will succeed in achieving its stated goals under all potential future conditions. Over time, controls may become ineffective because of changes in conditions or deterioration in the degree of compliance with policies or procedures. The integration of acquisitions may also exacerbate the risks of ineffective controls. Because of the inherent limitations of a cost-effective control system, misstatements due to error or fraud may occur and go undetected.
34
Table of Contents
We identified a material weakness in our internal control over financial reporting related to our accounting for business combinations and the risks posed by changes in the business caused by growth and increased complexity, as further described in Part III. Item 9A. “Controls and Procedures” of this Form 10-K. A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. A material weakness in our internal control over financial reporting requires management and our independent registered public accounting firm to consider our internal controls as ineffective. The material weakness could adversely impact our ability to record, process, and report financial information accurately, and to prepare financial statements within the time periods specified by the rules and forms of the SEC. While we continue to take steps to enhance our disclosure controls and procedures and our internal control over financial reporting, we cannot provide any assurance that we will be able to remediate the material weakness in a timely manner, or at all, or maintain adequate controls over our financial processes and reporting in the future, or that we will not identify significant deficiencies and/or material weaknesses in our internal control over financial reporting in the future. Any failure of our internal controls could result in material misstatements in our consolidated financial statements, significant deficiencies or material weaknesses, increased costs, failure to timely meet our periodic reporting obligations, and erosion of investor confidence. Such failure could also negatively affect the market price and trading liquidity of our common stock, subject us to civil and criminal investigations and penalties and could have a material adverse effect on our business, financial condition, results of operations or cash flow.
We may be unable to renew our leases on favorable terms or at all as our leases expire, or our businesses could be negatively impacted by natural disasters and other catastrophic events, which could adversely affect our business, financial condition, and results of operations.
We operate several leased premises. There is no assurance that we will be able to continue to occupy such premises in the future. For example, we currently rent our corporate headquarters on a month-to-month basis. We could thus spend substantial resources to meet the current landlords’ demands or look for other premises. We may be unable to timely renew such leases or to do so on favorable terms, if at all. If any current lease is terminated or not renewed, we may be required to relocate our operations at substantial costs or incur increased rental expenses, which could adversely affect our business, financial condition, and results of operations. In addition, our leased locations could be impacted by natural disasters, such as wildfires, changes in climate, and other catastrophic events. Although preventative measures may help to mitigate damage from these types of catastrophic events, we cannot provide any assurance that any measures we may take will be successful, and delays in recovery may be significant. In addition, the insurance we maintain may not be adequate to cover our losses resulting from any business interruption, including those resulting from a natural disaster or other severe weather event, and recurring extreme weather events or other adverse events could reduce the availability or increase the cost of insurance.
We currently derive a substantial portion of our revenues in California and are vulnerable to changes in that state.