Amedisys (AMED) Risk Factors

There are few barriers to entry in home health and hospice markets that do not require a CON, POA or FNR. Our primary competition comes from local privately-owned, publicly-owned and hospital-owned health care providers. We compete based on the availability of personnel, the quality of services, expertise of visiting staff and, in certain instances, on the price of our services. In addition, we compete with a number of non-profit organizations and tax-supported governmental agencies that finance acquisitions and capital expenditures on a tax-exempt or tax-favorable basis or receive charitable contributions that are unavailable to us. Increased competition in the future may limit our ability to maintain or increase our market share. Further, the introduction of new and enhanced service offerings by others, in combination with industry consolidation and the development of strategic relationships by our competitors (including mergers of competitors with each other and with insurers) could cause a decline in revenue or loss of market acceptance of our services or make our services less attractive. Managed care organizations and other third-party payors continue to consolidate, which enhances their ability to influence the delivery of health care services. Consequently, the health care needs of patients in the United States are increasingly served by a smaller number of managed care organizations. These organizations generally enter into service agreements with a limited number of providers. Our business and consolidated financial condition, results of operations and cash flows could be materially adversely affected if these organizations terminate us as a provider and/or engage our competitors as a preferred or exclusive provider. In addition, should private payors, including managed care payors, seek to negotiate additional discounted fee structures or the assumption by health care providers of all or a portion of the financial risk through prepaid capitation arrangements, our business and consolidated financial condition, results of operations and cash flows could be materially adversely affected. If we are unable to react competitively to new developments, our operating results may suffer. State CON, POA or FNR laws often limit the ability of competitors to enter into a given market, are not uniform throughout the United States and are frequently the subject of efforts to limit or repeal such laws. If states remove existing CONs, POAs or FNRs, we could face increased competition in these states. There can be no assurances that other states will not seek to eliminate or limit their existing CON, POA or FNR programs, which could lead to increased competition in these states. Further, we cannot assure you that we will be able to compete successfully against current or future competitors, which could have a material adverse effect on our business and consolidated financial condition, results of operations and cash flows.

Our revenue is determined by a number of factors, including our mix of patients and the rates of payment among payors. Changes in the case mix of our patients, payment methodologies or the payor mix among Medicare, Medicaid and private payors could have a material adverse effect on our business and consolidated financial condition, results of operations and cash flows.

Our success depends on our ability to maintain our corporate reputation, including our reputation for providing quality patient care and for compliance with Medicare requirements and the other laws to which we are subject. Adverse publicity surrounding any aspect of our business, including the death or disability of any of our patients due to our failure to provide proper care, or due to any failure on our part to comply with Medicare requirements, HIPAA requirements or other laws to which we are subject, could negatively affect our Company's overall reputation and the willingness of referral sources to refer patients to us. Further, the poor performance, reputation or negative conduct of competitors may have spillover effects that adversely affect the industry and our brand.

We compete for qualified personnel with other healthcare providers. Our ability to attract and retain clinicians depends on several factors, including our ability to provide these personnel with attractive assignments and competitive salaries and benefits. We cannot be assured we will succeed in any of these areas. In addition, there are shortages of qualified health care personnel in some of our markets. As a result, we may face higher costs of attracting clinicians and providing them with more attractive benefit packages than we originally anticipated, or we may have to utilize contract clinicians, both of which could have a material adverse effect on our business and consolidated financial condition, results of operations and cash flows. In addition, if we expand our operations into geographic areas where health care providers historically have been unionized, or if any of our care center employees become unionized, being subject to a collective bargaining agreement may have a negative impact on our ability to timely and successfully recruit qualified personnel and may increase our operating costs. In some circumstances, we may have to hire contract clinicians to fulfill staffing needs, which could increase the risk of an adverse patient event. Generally, if we are unable to attract and retain clinicians, the quality of our services may decline, and we could lose patients and referral sources, which could have a material adverse effect on our business and consolidated financial condition, results of operations and cash flows.

While we intend to finance strategic acquisitions and internal growth with cash flows from operations and borrowings under our revolving credit facility, we may require sources of capital in addition to those presently available to us. Uncertainty in the capital and credit markets may impact our ability to access capital on terms acceptable to us (i.e. at attractive/affordable rates) or at all, and this may result in our inability to achieve present objectives for strategic acquisitions and internal growth. Further, in the event we need additional funds and are unable to raise the necessary funds on acceptable terms, our business and consolidated financial condition, results of operations and cash flows could be materially adversely affected.

In general, all information systems, including those we host or have hosted by third parties, are vulnerable to damage or interruption from fire, flood, power loss, telecommunications failure, human error, malicious acts, break-ins and other intentional or unintentional events. Our business is also at risk from and may be materially impacted and/or disrupted by information security incidents, such as ransomware, malware, viruses, phishing, social engineering and other security events. Such incidents can range from individual attempts to gain unauthorized access to information technology systems to more sophisticated security threats. These events can also result from internal compromises, such as human error or a rogue employee or contractor, and can occur on our systems or on the systems of our partners and subcontractors. Additionally, our current information systems are subject to other non-environmental risks, including technological obsolescence, in some instances, which may create increased security and/or operational risk. Our networks, systems and devices store sensitive information, including intellectual property, proprietary business information and personal information of our patients, partners and employees. We have installed a number of protective technology systems and devices on our network, systems and point of care tablets in an attempt to prevent unauthorized access to information created, received, transmitted and maintained by us. However, healthcare companies are routinely targeted by threat actors, and no level of security can guarantee that cybersecurity incidents will not occur. In the event of a sophisticated ransomware attack, malware, viruses, phishing or social engineering, our technology may fail to adequately secure the protected health information and personal information we create, receive, transmit and maintain in our databases. In such circumstances, we may be held liable to our patients and regulators, which could result in fines, litigation or adverse publicity that could have a material adverse effect on our business and consolidated financial condition, results of operations and cash flows. Even if we are not held liable, any resulting negative publicity could harm our business and distract the attention of management. As a healthcare provider, we face increased legal and regulatory compliance risk in the event of a cyber-attack. Healthcare providers and health insurance plans must comply with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") regulations regarding the privacy and security of protected health information. The HIPAA regulations impose significant requirements on providers with regard to how such protected health information may be used and disclosed. Further, the regulations include extensive and complex requirements for providers to establish reasonable and appropriate administrative, technical and physical safeguards to ensure the confidentiality, integrity and availability of protected health information. HIPAA directs the Secretary of the United States Department of Health and Human Services ("HHS") to provide for periodic audits to ensure covered entities (and their business associates, as that term is defined under HIPAA) comply with the applicable HIPAA requirements. Entities within the U.S. that are found to be in violation of HIPAA may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. Even when providers establish reasonable and appropriate administrative, technical and physical safeguards, it is difficult to fully protect information systems from a breach or security incident. In the event a provider experiences a "breach" and protected health information is compromised, the provider is obligated under HIPAA to notify individuals, the government, and in the event the breach involves 500 or more individuals, the media. There are significant costs associated with a breach, including investigation costs, remediation and mitigation costs, notification costs, attorney fees, litigation and the potential for reputational harm and lost revenues due to a loss in confidence in the provider. We cannot predict the costs to comply with these laws or the costs associated with a potential breach of protected health information, which could have a material adverse effect on our business and consolidated financial condition, results of operations and cash flows, and our business reputation. In addition to federal regulators, state attorneys general are also enforcing proactive security protocols and reporting requirements relating to information security breaches. All 50 states and the U.S. territories have breach notification laws; some of these laws also include proactive data security requirements. In addition to state laws regarding confidentiality of medical information, several states expanded state privacy laws regarding personal information which is more broadly defined than medical information. As cyber threats continue to evolve, we may be required to expend significant capital and other resources to protect against the threat of security breaches or to mitigate and alleviate problems caused by security incidents, including unauthorized access to protected health information and personal information stored in our information systems and the introduction of computer viruses or other malicious software programs to our systems. If we don't expend capital and other resources to continually enhance our security systems, our security measures may be inadequate to prevent security breaches, and our business operations and reputation could be materially adversely affected by federal and state fines and penalties, legal claims or proceedings, cancellation of contracts and loss of patients if security breaches are not prevented. Our business depends on effective, secure and operational information systems that include systems provided by or hosted by external contractors, partners and other service providers. For example, our care centers depend upon information systems and software hosted by third-party vendors for patient care, accounting, billing, collections, risk management, quality assurance, human resources, payroll and other information considered to be sensitive and/or confidential, including protected health information. These third-party vendors or business associates, in the event the vendor creates, receives, transmits or maintains protected health information on our behalf, are required to comply with substantially the same HIPAA requirements as the healthcare provider. This is accomplished through the use of "Business Associate Agreements" with vendors. However, third- and fourth-party security incidents and supply-chain cyber attacks have been increasingly common, and there is no way for an organization to ensure that such incidents and attacks do not occur. The occurrence of any information system failure, breach or security incident, or a vendor's breach of the Business Associate Agreement could result in interruptions, delays, breaches of protected health information and personal information, loss or corruption of data and cessations or interruptions in the availability of these systems and the information they create, receive, transmit or maintain. An extended service outage affecting these or other vendors, particularly where such vendor is the single source from which we obtain the services, could have a material adverse effect on our business or results of operations. For example, in February 2024, UnitedHealth Group announced a cyber-attack on the information technology systems of its subsidiary, Change Healthcare, one of the largest providers of healthcare payment systems in the United States. The Change Healthcare cybersecurity incident did not impact our day-to-day operations; however, we were delayed in submitting patient claims to certain non-Medicare payors. There was minimal impact to our Medicare claim submissions as we were able to quickly redirect our Medicare claims to an alternative clearinghouse. The delays in submitting non-Medicare claims resulted in a reduction of our operating cash flow and an estimated increase to our accounts receivable of approximately $60 million during the three month-period ended March 31, 2024. Any of these events or circumstances, among others, could have an adverse effect on our business and consolidated financial condition, results of operations and cash flows, and they could harm our business reputation. If we are subject to cyber-attacks or security breaches in the future, this could result in harm to patients; business interruptions and delays; the loss, misappropriation, corruption or unauthorized access of data; litigation and potential liability under privacy, security and consumer protection laws or other applicable laws; reputational damage and federal and state governmental inquiries. Any such problems or failures and the costs incurred in correcting any such problems or failures could have a material adverse effect on our business and consolidated financial condition, results of operations and cash flows. Further, to the extent our external information technology contractors or other service providers have their own cyber-attack, security event or information technology failure, become insolvent or fail to support the software or systems we have licensed from them, our operations could be materially adversely affected. A failure to restore our information systems after the occurrence of any of these events could have a material adverse effect on our business and consolidated financial condition, results of operations and cash flows. Because of the protected health information we store and transmit, loss of electronically stored information for any reason could expose us to risk of regulatory action and litigation and possible liability and loss. Problems with, or the failure of, our technology and systems or any system upgrades or programming changes associated with such technology and systems could have a material adverse effect on our operations, patient care, data capture and integrity, medical documentation, billing, collections, assessment of internal controls and management and reporting capabilities. If we experience a reduction in the performance, reliability or availability of our information systems, our operations and ability to produce timely and accurate reports could be materially adversely affected. Our information systems and applications also require continual maintenance, upgrading and enhancement to meet our operational and security needs. Our acquisition activity requires transitions and integration of various information systems. We regularly upgrade and expand our information systems' capabilities. If we experience difficulties with the transition and integration of information systems or are unable to implement, maintain or expand our systems properly, we could suffer from, among other things, operational disruptions, regulatory investigations or audits and increases in administrative expenses. We believe we have all the necessary licenses from third parties to use technology and software that we do not own. A third-party could, however, allege that we are infringing its rights, which may deter our ability to obtain licenses on commercially reasonable terms from the third-party, if at all, or cause the third-party to commence litigation against us. In addition, we may find it necessary to initiate litigation to protect our trade secrets, to enforce our intellectual property rights and to determine the scope and validity of any proprietary rights of others. Any such litigation, or the failure to obtain any necessary licenses or other rights, could materially and adversely affect our business.