Evolent Health (EVH) Risk Analysis

Our success depends on providing high-quality products and services that health care providers use to improve clinical, financial and operational performance. If we cannot adapt to rapidly evolving industry standards, technology, including AI, and increasingly sophisticated and varied partner needs, our existing technology could become undesirable or obsolete, which could harm our reputation. We must continue to invest significant resources in our personnel and technology, including AI, in a timely and cost-effective manner in order to enhance our existing products and services and introduce new high-quality products and services that existing partners and potential new partners will want. Our operating results would also suffer if our innovations are not responsive to the needs of our existing partners or potential new partners, are not appropriately timed with market opportunity, are not effectively brought to market or significantly increase our operating costs. If our new or modified product and service innovations are not responsive to partner preferences, emerging industry standards or regulatory changes, are not appropriately timed with market opportunity or are not effectively brought to market, we may lose existing partners or be unable to obtain new partners and our results of operations may suffer. In addition, should any of our partners terminate their relationship with us after implementation has begun, we would not only lose our time, effort and resources invested in that implementation, but we would also have lost the opportunity to leverage those resources to build a relationship with other partners over that same period of time. In some cases, we price our services based on expectations of long-term relationships with our partners. When a partner terminates the relationship earlier than we had expected, we lose the resources invested in that relationship as well as the upside benefits we had anticipated. We also engage third-party vendors to develop, maintain and enhance the technology we use in our solutions, and our ability to develop and implement new technologies is therefore dependent on our ability to engage suitable vendors. We may also need to license software or technology from third parties in order to maintain, expand or modify our technology-enabled services platform. However, there is no guarantee we will be able to enter into such agreements on acceptable terms or at all. The functionality of our services platforms depends, in part, on our ability to integrate with third-party applications and data management systems that our partners use and from which they obtain data. These third parties may terminate their relationships with us, change the features of their applications and platforms, restrict our access to their applications and platforms or alter the terms governing use of their applications, data management systems and application programming interfaces and access to those applications and platforms in an adverse manner.

Our services involve the collection, storage and analysis of confidential information, including intellectual property and personal information of employees, health providers and others, as well as protected health information of our partners' patients. Because of the extreme sensitivity of this information, the security and privacy features of our computer, network, and communications systems infrastructure are very important. In certain cases, we provide such information to third parties, for example, to the service providers who provide hosting services for our technology platform, and we may be unable to control the use of such information or the security and privacy protections employed by such third parties. We may be required to expend significant capital and other resources to protect against security breaches and/or privacy incidents or to alleviate problems caused by security breaches and/or privacy incidents. Despite our implementation of security and privacy measures designed to help ensure data security and compliance with applicable laws and rules, our facilities and systems, and those of our third-party vendors, are vulnerable to threats. Furthermore, our increased use of mobile and cloud technologies, including as a result of the shift to work-from-home arrangements as a result of the COVID-19 pandemic, and the conflict between Russia and Ukraine, have heightened these cybersecurity and privacy risks, including risks from cyber-attacks such as phishing, spam emails, hacking, social engineering, and malicious software including harmful malware and ransomware. Threat actors regularly attempt to gain access to our information and infrastructure through various techniques. These threats include cyber-attacks, the use of harmful malware or ransomware, security breaches, acts of vandalism or theft (including by employees), computer viruses, misplaced or lost data, programming and/or human errors, power outages, protected health information leakage from implementing third-party technology to process and share data, hardware failures or other similar events. To date we have not experienced a cybersecurity incident that has resulted in any material impact on our business strategy, results of operations, financial condition or on our ability to service our partners or run our business. However, past and future incidents, including if we are unable to effectively resolve breaches in a timely manner, could result in damage to the market perception of the effectiveness of our security and privacy measures and we could lose sales and partners, which could have a material adverse effect on our business, operations, and financial results. A cyber-attack that bypasses our, or our third-party vendors', security systems successfully could require us to expend significant resources to remediate any damage, and prevent future occurrences, interrupt our operations, damage our reputation and our relationship with our partners, expose us or other third parties to a risk of loss or misuse of confidential information, reduce demand for our products and services or subject us to significant liability through litigation as well as regulatory action. Cyber-attacks continue to evolve in sophistication and volume and may remain undetected for an extended period. In addition, techniques used to obtain unauthorized access to information or to sabotage information technology systems change frequently, including as a result of emerging technologies, such as AI and machine learning. Cybersecurity threat actors are increasingly targeting employees, contractors, service providers and third parties through various techniques that involve social engineering and/or misrepresentation. We have also seen, and will continue to see, industry-wide vulnerabilities, such as the Log4j vulnerability reported in December 2021, which have and could in the future affect our or other parties' systems. We expect to continue to experience such vulnerabilities in the future. The costs of attempting to protect against cybersecurity risks and the costs of responding to cyber-attacks are significant. This could require us to expend significant resources to continue to modify or enhance our protective measures and to remediate any damage. While we maintain insurance covering certain security and privacy damages and claim expenses, we may not carry insurance or maintain coverage sufficient to compensate for all liability and such insurance may not be available for renewal on acceptable terms or at all, and in any event, insurance coverage would not address the reputational damage that could result from a security incident. New data security and privacy laws and regulations are being enacted rapidly. The scope and applicability of these laws are inconsistent, uncertain, and subject to evolving court and regulatory interpretation. As such, we may not be able to timely comply with such requirements, and such requirements may not be compatible with our current processes. For example, the FTC began enforcing the Health Breach Notification Rule in 2023, resulting in multi-year consent orders that imposed strict reporting and compliance obligations in addition to fines. Additionally, many states (including California, Utah, Colorado, Virginia, Connecticut, Washington, and several others) have passed laws that regulate how covered businesses collect, use, and disclose personal information. These laws impose data minimization and retention requirements and grant consumers broad rights with respect to their personal information, including opt out and deletion rights. Evaluating and updating our processes in light of these laws could be time consuming and expensive, and the failure to timely implement required changes could subject us to liability for noncompliance, including potential liability in the form of consumer class action lawsuits in certain states.

The market for our solutions is fragmented, competitive and characterized by rapidly evolving technology standards, customer needs and the frequent introduction of new products and services. Our competitors range from smaller niche companies to large, well-financed and technologically-sophisticated entities. Our services solutions compete based on several factors, including breadth, depth and quality of product and service offerings, ability to deliver clinical, financial and operational performance improvement using products and services, quality and reliability of services, ease of use and convenience, brand recognition and the ability to integrate services with existing technology. Some of our competitors are more established, benefit from greater brand recognition, have larger client bases and have substantially greater financial, technical and marketing resources. The entrance or expansion of these larger companies in the managed healthcare industry (including our customers who have in-sourced or who may choose to in-source healthcare services) could increase the competitive pressures we face and could limit our ability to maintain or increase our rates. If this happens, our profitability could be adversely affected. In addition, if we do not adequately respond to these competitive pressures, it could cause us to be unable to maintain our current contracts or obtain new contracts. Other competitors have proprietary technology that differentiates their product and service offerings from ours. Our competitors are constantly developing products and services that may become more efficient or appealing to our existing partners and potential partners. Additionally, some health care information technology providers have begun to incorporate enhanced analytical tools and functionality into their core product and service offerings used by health care providers, including with the use of AI or machine learning. As a result of these competitive advantages, our competitors and potential competitors may be able to respond more quickly to market forces, take advantage of acquisitions and other opportunities more readily, undertake more extensive marketing campaigns for their brands, products and services, more successfully utilize developing technology, including data analytics, AI and machine learning, and make more attractive offers to our existing partners and potential partners. We also compete on the basis of price. We are subject to pricing pressures as a result of, among other things, competition within the industry, consolidation of health care industry participants, practices of managed care organizations, government action and financial stress experienced by our partners. If our pricing experiences significant downward pressure, our business will be less profitable and our results of operations will be adversely affected. We cannot be certain that we will be able to retain our current partners or expand our partner base in this competitive environment. If we do not retain current partners or expand our partner base, or if we have to renegotiate existing contracts, our business, financial condition and results of operations will be harmed. Moreover, we expect that competition will continue to increase as a result of consolidation in both the health care information technology and health care industries. If one or more of our competitors or potential competitors were to merge or partner with another of our competitors, the change in the competitive landscape could also adversely affect our ability to compete effectively and could harm our business, financial condition and results of operations.

We believe that maintaining and enhancing our reputation and brand recognition is critical to our relationships with existing partners and to our ability to attract new partners. The promotion of our brands may require us to make substantial investments and we anticipate that, as our market becomes increasingly competitive, these marketing initiatives may become increasingly difficult and expensive. Our marketing activities may not be successful or yield increased revenue, and to the extent that these activities yield increased revenue, the increased revenue may not offset the expenses we incur and our results of operations could be harmed. In addition, any factor that diminishes our reputation or that of our management, including failing to meet the expectations of our partners, or any adverse publicity or litigation involving or surrounding the Company or one of our joint venture partners, investors or strategic alliance partners could make it substantially more difficult for us to attract new partners. Similarly, because our existing partners often act as references for us with prospective new partners, any existing partner that questions the quality of our work or that of our employees could impair our ability to secure additional new partners. Therefore, financial adversity of our partners' affiliated health plans may adversely affect our reputation. In addition, negative publicity resulting from any adverse government payer audit could injure our reputation. More broadly, we and our partners may also suffer negative reputational impact as a result of our involvement in utilization management, adverse determinations, prior authorizations, clinical decision support and similar matters. If we do not successfully maintain and enhance our reputation and brand recognition, our business may not grow and we could lose our relationships with partners, which would harm our business, results of operations and financial condition.

Health care laws and regulations are rapidly evolving and may change significantly in the future, including as a result of the Trump administration, which could adversely affect our financial condition and results of operations. We are subject to regulation by both CMS and state agencies with respect to certain services we provide relating to Medicaid, Medicare, and ACA programs and to our payers. Medicare is a federal program that provides hospital and medical insurance benefits to persons aged 65 and over, as well as certain other individuals. More than half of Medicare beneficiaries are enrolled in private MA plans that offer an alternative to traditional Medicare and are regulated by CMS and financed through Medicare and beneficiary premiums and cost-sharing Medicaid programs are jointly funded by federal and state governments and are administered by states under an approved plan that provides hospital and other health care benefits to qualifying individuals. Roughly three quarters of Medicaid beneficiaries are served by private Medicare MCOs. As we increase our exposure to Medicare and Medicaid businesses through new and existing partners, we increase our exposure to changes in government policy with respect to and regulation of the Medicaid and Medicare programs in which we and our partners participate. Because some of our partners are participants in governmental programs, our services have in the past and may again in the future be subject to periodic surveys and audits by governmental entities or contractors for compliance with Medicare and other standards and requirements. As a result of surveys or audits, we may incur fines and penalties and could be excluded from participating in one or more programs or institute other sanctions against us if we fail to comply with CMS regulations or Medicare and Medicaid contractual requirements. The regulations and requirements applicable to us and other participants in Medicaid and Medicare programs are complex and subject to change. In particular, prior authorization standards and requirements, including Medicaid and Medicare programs, have come under increased scrutiny at the state and federal level. Many states have proposed, and some have passed, bills which prescribe how providers and services which meet certain approval rates become exempt from prior authorization for a period of time, widely known as "gold carding". Most recently, the state of Illinois passed a law requiring guidance on gold carding to be adopted; the new law would exempt qualifying providers from prior authorization on all services subject to review for the year in which they qualify. MAOs utilization management practices have been the focus of a 2022 report by the Department of Health and Human Services Office of Inspector General as well as new final rules by (CMS-4201-F and CMS-0057-F). CMS-4201-F, effective calendar year 2024, imposes several requirements on MAOs with respect to their use of prior authorization. CMS-0057-F further imposes stricter medical necessity decision timeframes on federal managed care programs, effective CY 2026, as well as complex technical interface requirements, effective CY 2027, for Medicare, Medicaid, CHIP and QHPs offered on the ACA Federally Facilitated Exchange. These are intended to facilitate increased data sharing between managed care plans, enrollees and providers and streamline the prior authorization process. Congress and state and local legislatures and regulators may propose and adopt legislation or policy changes or implementations effecting additional fundamental changes with respect to Medicare, Medicaid, and exchange programs. Such changes in the law, or new interpretations of existing laws, may have a significant impact on our methods and costs of doing business. Additionally, expansion of enforcement activity could adversely affect our business and financial condition. Going forward, we expect CMS, Congress, and state agencies to continue to closely scrutinize each component of the Medicare, Medicaid, and exchange programs, as well as modify the terms and requirements of the programs. Further, since taking office in January 2025, the Trump administration has taken dramatic steps to freeze some federal funding and reduce the size of the federal workforce. It is not possible to predict the outcome of this congressional, executive regulatory activity, either of which could adversely affect us. Similarly, we cannot predict whether pending or future federal or state legislation or court proceedings will change various aspects of these programs, nor can we predict the impact those changes will have on our business operations or financial results, but the effects could be materially adverse. In addition, CMS, Congress, state legislatures and third-party payers may continue to review and assess alternative health care delivery and payment systems and may in the future propose and adopt legislation or policy changes or implementations effecting additional fundamental changes in the health care delivery system, including with respect to Medicare, Medicaid, and exchange programs. Additionally, expansion of enforcement activity could adversely affect our business and financial condition. Going forward, we expect CMS and Congress to continue to closely scrutinize each component of the Medicare program as well as modify the terms and requirements of the program. It is not possible to predict the outcome of this congressional or regulatory activity, either of which could adversely affect us. Similarly, we cannot predict whether pending or future federal or state legislation or court proceedings will change various aspects of the health care delivery system, including Medicaid and Medicare programs, nor can we predict the impact those changes will have on our business operations or financial results, but the effects could be materially adverse. Medicaid and exchange enrollment is impacted, and may fluctuate, based on a variety of factors. These include continuous enrollment requirements instituted during the COVID-19 PHE in 2021 under which Medicaid enrollment grew, and the resumption of Medicaid eligibility redeterminations, or "unwinding," that began in 2023 at the PHE's conclusion which reduced enrolled lives for some Medicaid MCOs. State may also take varying approaches to streamlining or discouraging enrollment, and income levels for eligibility may vary (particularly in non-expansion vs. expansion states). The 119th Congress and Trump Administration have been exploring potential changes to Medicaid which could include cuts to federal matching payments, work requirements, or other eligibility and enrollment changes, as well as potential changes to ACA enrollment. Enrollment decreases for our partners may decrease the number of lives on our platform and impact the revenues derived from such partners. Additional legislative and regulatory developments which may impact our business directly or indirectly through our partners include: - Health IT interoperability efforts beginning with the Health Information Technology for Economic and Clinical Health (HITECH) Act in 2009 and 21st Century Cures Act in 2016, from which we have seen an array of regulations on topics including electronic data exchange and the move to HL7 FHIR application programming interface (API) methods; prohibitions on electronic health records vendor and provider information blocking; the move to electronic or digital all-payer quality measurement; and the move to electronic prior authorization methods. - Health care price transparency efforts including No Surprises Act provisions enacted as part of the Consolidated Appropriations Act in 2020, effective as of 2022. - Efforts to reduce prescription drug costs including the Inflation Reduction Act of 2022 which created a negotiation program for Medicare Part D and Part B drugs; redesigned the Medicare Part D drug benefit to lower patient cost sharing; and instituted other changes designed to improve patient access. While these policies may or may not have a direct impact on our business, they can change market dynamics such as Medicare Advantage growth vs. standalone Part D plans, national health expenditures and trend factors that play into benchmarks for MA and Medicare accountable care organizations (ACOs), and drug formulary and rebate negotiations. An emerging trend is intensified scrutiny by state and federal authorities with respect to the use of AI, particularly any AI systems used in utilization management. At least 40 states introduced or enacted AI legislation in 2024, more than half of which touching upon health care, and we see this trend continuing in 2025. For example, California Governor Newsom signed Senate Bill 1120 into law, which aims to safeguard patients and maintain oversight when payers use AI. A new Colorado law and guidance from the New Jersey Attorney General seek to ensure AI does not introduce discrimination or algorithmic bias. The use of AI has also been the focus of congressional inquiries and federal guidance documents. The Trump administration has rescinded the Biden administration's EO on AI and replaced it with a new EO that directs Administration leaders to solicit stakeholder input and produce a new AI Action Plan in 2025 designed to promote AI innovation primarily. It may also begin to introduce some regulatory frameworks and guardrails. We are unable to predict how these changes and other health care reform initiatives from new legislation, regulation, judicial action and/or executive action, including those described above, will ultimately impact the health care industry and what the potential impact may be on our business, financial condition, operating results and prospects. In addition to these health care laws and regulations, we are subject to various other laws and regulations, including, among others, other aspects of state insurance laws, the Stark Law relating to self-referrals, the whistleblower provisions of the False Claims Act, anti-kickback laws, antitrust laws and the privacy and data protection laws. Investigating and prosecuting healthcare fraud, waste and abuse continues to be a top priority for state and federal law enforcement entities. The focus of these efforts has been directed at Medicare, Medicaid, Health Insurance Marketplace and commercial products. Compliance with these laws may require substantial resources. We are constantly looking for ways to improve our fraud, waste and abuse detection methods. The fraud, waste and abuse laws include In the United States, there are federal and state anti-kickback laws that generally prohibit the payment or receipt of kickbacks, bribes or other remuneration in exchange for the referral of patients or other health-related business. The federal civil False Claims Act imposes liability on any person or entity who, among other things, knowingly presents, or causes to be presented, a false or fraudulent claim for payment by a federal health care program. The "qui tam" or "whistleblower" provisions of the False Claims Act allow a private individual to bring actions on behalf of the federal government alleging that the defendant has submitted a false claim to the federal government, and to share in any monetary recovery. Our activities relating to the way we sell and market our services, including our risk adjustment solution, may be subject to scrutiny under these laws. The Stark Law is relevant to our business because we frequently organize arrangements of various kinds under which (a) providers and hospitals jointly invest in and own ACOs, clinically integrated networks and other entities that engage in value-based contracting with third-party payers or (b) providers are paid by hospitals or hospital affiliates for care management, medical or other services related to value-based contracts. We evaluate when these investment and compensation arrangements create financial relationships under the Stark Law and design structures that are intended to satisfy exceptions under the Stark Law or Medicare Shared Savings Program waiver. We have identified instances of noncompliance in the past and cannot guarantee that we will not identify other instances in the future, or the outcome of any regulatory investigation into any non-compliance. If we were to become subject to litigation, liabilities or penalties under these or other laws or as part of a governmental review or audit, our business could be adversely affected.

As described below, we are required to comply with numerous federal and state laws and regulations that regulate health information that we may obtain, process or access in connection with the provision of our services. These laws and regulations, including their interpretation by governmental agencies, are subject to frequent change and could have a negative impact on our business. - HIPAA protects the privacy and security of protected health information and requires covered organizations adopt standards for the exchange of electronic protected health information. Further, the privacy regulations under HIPAA also provide patients with rights related to understanding and controlling how their protected health information is used and disclosed. As a provider of services to entities subject to HIPAA, we are directly subject to certain provisions of the regulations as a "Business Associate." If we are unable to satisfy privacy and security obligations under HIPAA regulations, we could be found to have breached our contracts with our customers. Moreover, we may be subject to investigation by the U.S. Department of Health and Human Services Office for Civil Rights ("OCR") or other regulators or government bodies for potential HIPAA noncompliance. Penalties for HIPAA noncompliance include civil and criminal penalties that could have a material adverse effect on us. In addition, OCR performs compliance audits of Business Associates in order to proactively enforce the HIPAA privacy and security standards. OCR has become an increasingly active regulator and has signaled its intention to continue this trend. OCR has the discretion to impose penalties without being required to attempt to resolve violations through informal means; further, OCR may require companies to enter into resolution agreements and corrective action plans which impose ongoing compliance requirements. OCR enforcement activity can result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal resources. - The HITECH Act, enacted as part of the American Recovery and Reinvestment Act of 2009, also known as the "Stimulus Bill," effective February 22, 2010, set forth health information security breach notification requirements and increased penalties for violation of HIPAA. The HITECH Act requires individual notification for all breaches, media notification of breaches for over 500 individuals and at least annual reporting of all breaches to the Department of Health and Human Services. Failure to comply with the HITECH Act could result in fines and penalties that could have a material adverse effect on us. - Numerous other federal and state laws that may apply to us restrict the use of and protect the privacy and security of personal information, as well as employee personal information. These include state medical privacy laws, state social security number protection laws and federal and state consumer protection laws. These various laws in many cases are not preempted by HIPAA and may be subject to varying interpretations by the courts and government agencies, creating complex compliance issues for us and our partners and potentially exposing us to additional expense, adverse publicity and liability, any of which could adversely affect our business. - Federal and state consumer protection laws are increasingly being applied by the FTC and states' attorneys general to regulate the collection, use, storage and disclosure of personal information, through websites or otherwise, and to regulate the presentation of website content. The FTC in particular is increasingly scrutinizing the collection, use, and disclosure of health information and any corresponding marketing and advertising efforts, as well as any other uses that attempt to monetize health information. There is ongoing concern from privacy advocates, regulators and others regarding data protection and privacy issues, and the number of jurisdictions with data protection and privacy laws has been increasing. Also, there are ongoing public policy discussions regarding whether the standards for de-identified, anonymous or pseudonymized health information are sufficient to adequately protect patient privacy. These discussions may lead to further restrictions on the use or disclosure of such information. There can be no assurance that these initiatives or future initiatives will not adversely affect our ability to access and use data or to develop or market current or future services. The security measures that we and our third-party vendors and subcontractors have in place to address privacy and data protection laws may not protect our facilities and systems from security breaches, acts of vandalism or theft, computer viruses, misplaced or lost data, programming and human errors or other similar events. As the cyber threat landscape continues to evolve, third-party threat actors have become increasingly sophisticated and adept at evading cybersecurity protections, and the frequency and scope of security incidents has increased. Under the HITECH Act, as a business associate, we may also be liable for privacy and security breaches and failures of our subcontractors. Even though we provide for protections through our agreements with our subcontractors, we still have limited control over their actions and practices. A breach of privacy or security of protected health information by a subcontractor may result in an enforcement action, including criminal and civil liability, against us, and/or may qualify as a breach of our client contracts. Enforcement actions against us could be costly and could interrupt regular operations, which may adversely affect our business.

Our success depends largely upon the continued services of our key executive officers and recruitment of additional highly-skilled employees. From time to time, there may be changes in our senior management team resulting from the hiring or departure of executives, which could disrupt our business. Hiring executives with needed skills or the replacement of one or more of our executive officers or other key employees would likely involve significant time and costs and may significantly delay or prevent the achievement of our business objectives. In addition, competition for qualified talent in our industry is intense, particularly in the last several years. The market to build, retain and replace talent has become even more highly competitive, and many of the companies with which we compete for personnel have greater financial and other resources than we do. Recent and increasing threats to the safety of corporate officers, particularly in the healthcare industry, may put additional pressure on our ability to recruit and retain top talent, as well as the costs related thereto. We have faced and may continue to face difficulties attracting, hiring and retaining highly-skilled personnel with appropriate qualifications and may not be able to fill positions. To attract top talent, we have had to offer, and believe we will need to continue to offer, competitive compensation and benefits packages before we can validate the productivity of those employees. We have increased, and expect to continue to increase, our employee compensation levels in response to our competition, as necessary. In addition, the pressures of inflation have increased our costs of labor and may continue to do so. In addition, we believe our corporate culture has been a key contributor to our success to date. With many of our employees working remotely, we may find it difficult to maintain important aspects of our culture, which could negatively affect our ability to retain and recruit personnel who are essential to our future success and could ultimately have a negative impact on our business and our ability to execute on our strategy. In order to successfully expand our business, we must effectively recruit, integrate and motivate new and retain existing employees, while maintaining the beneficial aspects of our corporate culture. All of our employees are "at-will" employees, and their employment can be terminated by us or them at any time, for any reason and without notice. We may not be able to hire new employees quickly enough to meet our needs. If we fail to effectively manage our hiring needs and successfully integrate new employees, our efficiency and ability to meet our forecasts and our employee morale, productivity and retention could suffer, and our business and results of operations could be harmed. In addition, volatility or lack of performance in our stock price may affect our ability to attract replacements should key personnel depart.

As a non–manufacturing service business, we have to date been less impacted from laws and regulations related to sustainability concerns or other environmental, social responsibility or governance ("ESG") laws, regulations, or policies. However, we may need to incur ESG related costs indirectly in response to our customers or shareholders. Increasingly our customers and shareholders expect that we meet environmental, social responsibility, sustainability or other business policies or standards, which may be more restrictive than current laws and regulations, before they commence, or continue, doing business with us or investing in our common stock. Our compliance with these policies and related requirements could be costly, and our failure to comply could adversely affect our business relationships or reputation.

The broader U.S. economy experienced higher than expected inflationary pressures throughout 2022 related to continued supply chain disruptions, labor shortages and geopolitical instability. Inflation levels remained at elevated level through 2024. Increasing inflationary pressures may have a negative effect on our profit margins and earnings due to associated costs increases, including as a result of their impact on our customers' and other third parties' ability to pay. Additionally, we face an increasingly competitive labor market due to sustained labor shortages in part from the COVID-19 pandemic and are subject to inflationary pressures on employee wages and salaries which may increase labor costs. Failure to retain highly skilled employees due to wage inflation could have a material adverse impact on our business, results of operations or financial condition. See the risk factor captioned "Risk Factors-

An epidemic, pandemic or similar serious public health issue, and the measures undertaken by governmental authorities to address it, could significantly disrupt or prevent us from operating our business in the ordinary course for an extended period, and thereby, and/or along with any associated economic and/or social instability or distress, adversely affect our business and the business of our partners. The extent to which an epidemic, pandemic or similar serious public health issue could impact our business, results of operations, financial condition and liquidity or the business of our partners will depend on numerous evolving factors, known and unknown, that we cannot predict, including the duration and scope of the epidemic, pandemic or similar public health issue; government, business and individual actions that taken in response; the impact of the public health issue on national and global economic activity; disruption of the financial and labor markets, including the possibility of a national or global economic recession or depression; limitations on operations requiring employees to perform their duties in-person; and disruptions in the healthcare markets, including state Medicaid agencies. Additionally, the increased number of employees who work remotely during a public health emergency or outbreak could introduce additional operational risk, such as an increased vulnerability to cyber-attacks, and harm productivity and collaboration. In addition, the risks and uncertainties described elsewhere in this "Risk Factors" section may be exacerbated by an epidemic, pandemic or similar serious public health issue.