American Oncology Network (AONC) Risk Analysis

Changes in tax laws or their interpretation could decrease the amount of revenues we receive, the value of any tax loss carry-forwards and tax credits recorded on our balance sheet and the amount of our cash flow, and adversely affect our business, financial condition or results of operations. In addition, other factors or events, including business combinations and investment transactions, changes in the valuation of our deferred tax assets and liabilities, adjustments to taxes upon finalization of various tax returns or as a result of deficiencies asserted by taxing authorities, increases in expenses not deductible for tax purposes, changes in available tax credits, other changes in the apportionment of our income, and changes in tax rates, could also increase our future effective tax rate. In addition, our effective tax rate and tax liability are based on the application of current income tax laws, regulations and treaties. These laws, regulations and treaties are complex, and the manner which they apply to us and our diverse set of business arrangements is often open to interpretation, and can require us to take positions regarding the interpretation of applicable rules or the valuation of our assets that are subject to material uncertainty. Significant management judgment is required in determining our provision for taxes, our deferred tax assets and liabilities and any valuation allowance recorded against our net deferred tax assets. The proper tax treatment or characterization of the transactions we undertake is often subject to significant uncertainty, and the resolution of any related issues could affect the withholding tax liabilities to which we are subject or the tax deductions that we are able to claim. The tax authorities could challenge our interpretation of laws, regulations and treaties or the positions that we have taken regarding the valuation of our assets, resulting in additional tax liability or adjustment to our income tax provision. Our tax filings are subject to review or audit by various taxing authorities. As discussed above, we exercise significant judgment in determining our provision for taxes and, in the ordinary course of our business, there may be transactions and calculations where the proper tax treatment is uncertain. We may also be liable for taxes in connection with businesses we acquire. Our determinations are not binding on the IRS or any other taxing authorities, and accordingly the final determination in an audit or other proceeding may be materially different than the treatment reflected in our tax provisions, accruals and returns. An assessment of additional taxes because of an audit could have a material adverse effect on our business, financial condition, results of operations and cash flows. New income, sales, use or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time, or interpreted, changed, modified or applied adversely to us, any of which could adversely affect our business operations and financial performance. We are unable to predict what changes will occur and, if so, the ultimate impact on its business. To the extent that such changes have a negative impact on us, they may materially and adversely impact its business, financial condition, results of operations and cash flows.

We and our Network Practices collect, receive, generate, use, process, and store significant and increasing volumes of sensitive information, such as employee, individually identifiable health information and other personally identifiable information. We and our Network Practices are subject to a variety of federal and state laws and regulations, as well as contractual obligations, relating to the collection, use, storage, retention, security, disclosure, transfer, return, destruction and other processing of personal information, including health-related information. Enforcement actions and consequences for noncompliance with such laws, directives and regulations are rising, and the regulatory framework for privacy, data protection and data transfers is complex and rapidly evolving and is likely to remain uncertain for the foreseeable future. In the United States, numerous such federal and state laws and regulations, including data breach notification laws, health information privacy laws, and consumer protection laws and regulations, including those that govern the collection, use, disclosure, and protection of health-related and other personal information, could apply to our operations or the operations of our Network Practices. For example, the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, and regulations implemented thereunder, which we refer to collectively as HIPAA, imposes privacy, security and breach notification obligations on certain health care providers, health plans, and health care clearinghouses, known as covered entities, as well as business associates that perform certain services that involve creating, receiving, maintaining or transmitting individually identifiable health information for or on behalf of such covered entities. HIPAA requires covered entities, such as our Network Practices, and business associates, such as us, to develop and maintain policies with respect to the protection of, use and disclosure of protected health information, or PHI, including the adoption of administrative, physical and technical safeguards to protect such information, and certain notification requirements in the event of a data breach. Entities that are found to be in violation of HIPAA as the result of a breach of unsecured PHI, a complaint about privacy practices or an audit by HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. HIPAA also authorizes state Attorneys General to file suit on behalf of their residents. Courts may award damages, costs and attorneys' fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. Enforcement actions by HHS or state Attorneys General could result in significant financial liability and reputational harm, in addition to depleting financial resources. Numerous other state and federal laws, including consumer protection laws and regulations, govern the collection, dissemination, use, access to, confidentiality, security and processing of personal information, including health-related information, some of which are more stringent than HIPAA and many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. In addition, these laws and regulations in many cases are more restrictive than, and may not be preempted by, HIPAA and may be subject to varying interpretations by courts and government agencies. Laws in all 50 states and other United States territories have been enacted that may require businesses to provide notice to regulators or to individuals whose personal information has been accessed without authorization or disclosed as a result of a data breach. Such laws are not always consistent, and compliance in the event of a widespread data breach is costly and may be challenging. We also may be contractually required to comply with various requirements relating to privacy and security of personal information and to provide notice or take other actions in connection with a data breach, and failures to comply with such contractual requirements could result in potential contractual liability. Although we may have certain contractual protections in our contracts with third parties, such contractual protections may not be sufficient to adequately protect us from potential liability, potential harm to our reputation or the need to expend significant resources on data security and responding to an actual or perceived data breach. States are also constantly amending existing laws, requiring attention to frequently changing requirements, and we expect these changes to continue. For example, in June 2018, California enacted the California Consumer Privacy Act, or the CCPA, which became effective on January 1, 2020, and, among other things, requires covered companies to provide disclosures to California consumers, and affords such consumers certain data protection rights, including the ability to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information that may increase data breach litigation. While the CCPA includes certain exceptions for health-related information, including PHI, it still may require us to modify our data practices and policies and to incur substantial costs and expenses in an effort to comply. Further, the California Privacy Rights Act, or CPRA, recently passed in California. The CPRA will impose additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It will also create a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The majority of the provisions went into effect on January 1, 2023, and additional compliance investment and potential business process changes may be required. As required by certain laws, we publicly post documentation regarding our privacy practices concerning the collection, processing, use and disclosure of certain data. The publication of our privacy policy and other documentation that provide promises and assurances about privacy and security can subject us to potential state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices. In addition, although we endeavor to comply with our published policies and documentation, individuals could allege we have failed to do so, or we may at times actually fail to do so despite our efforts. Any failure by us, our third-party service providers or other parties with whom we do business to comply with this documentation or with laws or regulations applicable to our business could result in proceedings against us by governmental entities or others. In addition, the Federal Trade Commission, or the FTC, expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Our failure to take any steps perceived by the FTC as appropriate to protect consumers' personal information may result in claims by the FTC that we have engaged in unfair or deceptive acts or practices in violation of Section 5(a) of the FTC Act. State consumer protection laws provide similar causes of action for unfair or deceptive practices for alleged privacy, data protection and data security violations. In addition to government regulation, privacy advocates and industry groups may propose self- regulatory standards from time to time. These and other industry standards may legally or contractually apply to us, or we may elect to comply with such standards or to facilitate our customers' compliance with such standards. We expect that there will continue to be new proposed laws and regulations concerning privacy, data protection, and information security, and we cannot yet determine the impact such future laws, regulations, and standards may have on our business. New laws, amendments to or re-interpretations of existing laws and regulations, industry standards, contractual and other obligations may require us to incur additional costs and restrict our business operations. Because the interpretation and application of laws, standards, contractual and other obligations relating to privacy and data protection are still uncertain and changing, it is possible that these laws, standards, contractual and other obligations may be interpreted and applied in a manner that is inconsistent with our data management practices, our privacy, data protection or data security policies or procedures or the features of our technology. If so, in addition to the possibility of fines, lawsuits, regulatory investigations, imprisonment of company officials and public censure, other claims and penalties, significant costs for remediation and damage to our reputation, we could be required to fundamentally change our business activities and practices or modify our technology, any of which could adversely affect our business. We may be unable to make such changes or modifications in a commercially reasonable manner, or at all, and our ability to develop new software or provide new services could be limited. Any inability to adequately address privacy, data protection or information security-related concerns, even if such concerns are unfounded, or to successfully negotiate privacy, data protection or information security- related contractual terms with customers, or to comply with applicable laws and regulations, or our policies relating to privacy, data protection, and information security, could result in additional cost and liability to us, harm our reputation and brand, and adversely affect our business, financial condition and results of operations.

We and our Network Practices compete directly with national, regional and local providers of healthcare for patients and physicians. There are many other companies and individuals currently providing healthcare services, many of which have been in business longer and/or have substantially more resources. Other companies could enter the healthcare industry in the future and divert some or all of our business. If we expand to other geographies, we expect competition may change based on a number of factors, including the number of competing oncology care facilities in the local market and the types of services available at those facilities, our Network Practices' reputation for quality care of patients, the commitment and expertise of our Network Practices' medical staff, our local service offerings and community programs, the cost of care in each locality, and the physical appearance, location, age and condition of our facilities. If we are unable to attract patients to our managed clinics, our revenue and profitability will be adversely affected. Some of our competitors may have greater recognition and be more established in their respective communities than we are, and may have greater financial and other resources than we have. Competing oncology care providers may also offer larger facilities or different programs or services than our Network Practices do, which, combined with the foregoing factors, may result in our competitors being more attractive to our current patients, potential patients and referral sources. Furthermore, while we budget for routine capital expenditures at our managed clinics to keep them competitive in their respective markets, to the extent that competitive forces cause those expenditures to increase in the future, our financial condition may be negatively affected. In addition, our relationships with governmental and private third-party payors are not exclusive and our competitors have established or could seek to establish relationships with such payors to serve their covered patients. Additionally, as we expand into new geographies, we may encounter competitors with stronger relationships or recognition in the community in such new geography, which could give those competitors an advantage in obtaining new patients. Individual physicians, physician groups and companies in other healthcare industry segments, including those with which our Network Practices have contracts, and some of which have greater financial, marketing and staffing resources, may become competitors in providing health care services, and this competition may have a material adverse effect on our business operations and financial position.

Negative publicity regarding the managed healthcare industry generally may result in increased regulation and legislative review of industry practices that further increase our costs of doing business and adversely affect our results of operations or business by: - requiring us to change our products and services;- increasing the regulatory, including compliance, burdens under which we operate, which, in turn, may negatively impact the manner in which our Network Practices provide services and increase our costs of providing services;- adversely affecting our ability to market our products or services through the imposition of further regulatory restrictions; or - adversely affecting our ability to attract and retain patients.

Our operations are dependent on a concentrated number of payors with whom our Network Practices contract to provide services to patients. We generally manage our Network Practices' payor contracts on a state by state basis, entering into a separate contract in each state with the local affiliate of the relevant payor such that no one local payor contract accounts for a majority of our collective revenue. We believe that a majority of our Network Practices' revenues will continue to be derived from a limited number of key payors, which may terminate their contracts with our Network Practices or the individual Network Practice physicians credentialed by them upon the occurrence of certain events. The sudden loss of any of our network Practices' payors, or the renegotiation of any of our Network Practices' payor contracts, could adversely affect our operating results. In the ordinary course of business, we engage in active discussions and renegotiations with payors in respect of the services our Network Practices provide and the terms of our Network Practices' payor agreements. As the payors' businesses respond to market dynamics and financial pressures, and as payors make strategic business decisions in respect of the lines of business they pursue and programs in which they participate, certain of the payors may seek to renegotiate or terminate their agreements with our Network Practices. These discussions could result in reductions to the fees and changes to the scope of services contemplated by the original payor contracts and consequently could negatively impact our revenues, business and prospects. Because we rely on a limited number of payors for a significant portion of our Network Practices' revenues, we depend on the creditworthiness of these payors. The payors are subject to a number of risks including reductions in payment rates from governmental programs, higher than expected health care costs and lack of predictability of financial results when entering new lines of business, particularly with high-risk populations. If the financial condition of our Network Practices' payors declines, our financial results could be impacted. Should one or more of our Network Practices' payors declare bankruptcy, be declared insolvent or otherwise be restricted by state or federal laws or regulation from continuing in some or all of their operations, this could adversely affect our ongoing revenues, the collectability of our accounts receivable, our bad debt reserves and our net income. Although our Network Practices have long-term contracts with many payors, these contracts may be terminated before their term expires for various reasons, such as changes in the regulatory landscape and poor performance by our Network Practices and our affiliated providers, subject to certain conditions. Certain of the payor contracts are terminable immediately upon the occurrence of certain events. Certain of the payor contracts may be terminated immediately by the payor if our Network Practices lose applicable licenses, go bankrupt, lose their liability insurance or receive an exclusion, suspension or debarment from state or federal government authorities. Additionally, if a payor were to lose applicable licenses, go bankrupt, lose liability insurance, become insolvent, file for bankruptcy or become subject to exclusion, suspension or debarment from state or federal government authorities, the Network Practices' contract with such payor could in effect be terminated. In addition, certain of the payor contracts may be terminated immediately if a Network Practice becomes insolvent or file for bankruptcy. If any of the contracts with the Network Practice's payors are terminated, the Network Practice may not be able to recover all fees due under the terminated contract, which may adversely affect our operating results.

Recently, inflation has increased throughout the U.S. economy. Inflation can adversely affect us by materially increasing the costs of drugs and medical supplies, labor, administration and other costs of doing business. We may experience material increases in the cost of labor due to a nationwide shortage of nurses and other clinical staff. In an inflationary environment, cost increases may materially outpace our expectations, causing us to use our cash and other liquid assets faster than forecasted. Our ability to pass on increased costs associated with providing healthcare to Medicare and Medicaid patients is limited due to various federal, state and local laws which have been enacted that, in certain cases, limit our ability to increase prices. If this happens, we may need to raise additional capital to fund our operations, which may not be available in sufficient amounts or on reasonable terms, if at all, sooner than expected. The Company minimizes the impacts of inflation by maintaining strong relationships with its suppliers and renegotiating payor contracts where possible