Fortrea Holdings Inc. (FTRE) Risk Factors

Even though we do not and will not order healthcare services or bill directly to Medicare, Medicaid, or other third-party payers, certain federal, state, and foreign healthcare laws and regulations pertaining to healthcare fraud and abuse, including anti-kickback and anti-inducement laws related to the furnishing of healthcare items and services, are and will be applicable to our business. Such laws also include "sunshine act" legislation in various jurisdictions that require us to track and report on payments and other transfers of value to certain healthcare professionals, providers and institutions. Because of the breadth of these laws and the narrowness of available statutory and regulatory exceptions, it is possible that some of our business activities could be subject to challenge under one or more of such laws. If we or our operations are found to be in violation of any of the laws described above or any other governmental regulations that apply to us, we may be subject to penalties, including civil and criminal penalties, damages, fines, imprisonment of employees or others acting on our behalf, and the curtailment or restructuring of our operations, any of which could materially adversely affect our ability to operate our business, our financial results, and our reputation.

We assist pharmaceutical, biotechnology and medical device companies in navigating the regulatory approval process. Changes in regulations such as a relaxation in regulatory requirements or the introduction of simplified approval procedures, or an increase in regulatory requirements that we have difficulty satisfying or that make our services less competitive, could eliminate or substantially reduce the demand for our services. Also, if government efforts to contain drug and medical product and device costs impact profits from such items, or if health insurers were to change their practices with respect to reimbursement for those items, some of our customers may spend less, or reduce their growth in spending on R&D. In the U.S., for example, the Inflation Reduction Act includes provisions authorizing government negotiated pricing for certain drugs and other price restrictions that may have the effect of reducing pharmaceutical and biotechnology manufacturer revenue and investments in the development of new drugs. In addition, implementation of healthcare reform legislation that adds costs could limit the profits that can be made from the development of new drugs and medical products and devices. This could adversely affect R&D expenditures by such companies, which could in turn decrease the business opportunities available to us both in the U.S. and other countries. New laws or regulations may create a risk of liability, increase our costs or limit our service offerings.

We may become subject in the ordinary course of business to material legal actions related to, among other things, commercial and contract disputes, data and privacy issues, professional liability, employee-related matters,and intellectual property disputes. Legal actions could result in substantial monetary damages as well as damage to our reputation with customers, which could have a material adverse effect upon our business.

As a result of the Spin, there are several significant areas where the liabilities of Labcorp became our obligations. Our separation and distribution agreement with Labcorp provides for indemnification obligations designed to make us financially responsible for substantially all liabilities that may exist relating to our business, whether incurred prior to or after the Spin, and whether known or unknown at the time of the Spin, as well as those obligations of Labcorp assumed by us pursuant to the separation and distribution agreement. As we are required to indemnify Labcorp under the circumstances set forth in the separation and distribution agreement, or meaningful unknown liabilities surface, we may be subject to substantial liabilities. In addition, provisions of law may impose certain of Labcorp's liabilities on us. For example, under the Code and the related rules and regulations, each corporation that was a member of the Labcorp consolidated U.S. federal income tax group during a taxable period or portion of a taxable period ending on or before the effective date of the Spin is severally liable for the U.S. federal income tax liability of the Labcorp consolidated U.S. federal income tax group for that taxable period. Consequently, if Labcorp is unable to pay the consolidated U.S. federal income tax liability for a pre-Spin period, we could be required to pay the amount of such tax, which could be substantial and in excess of the amount allocated to us under the tax matters agreement. Similar rules may apply for state, local, and non-U.S. tax purposes. Other provisions of law establish similar liability for other matters, including U.S. federal laws governing tax-qualified pension plans, as well as other contingent liabilities.

If we do not comply with existing or new laws and regulations related to protecting the privacy and security of personal or health information, we could be subject to monetary fines, civil penalties or criminal sanctions. In the U.S., we may obtain health information from third parties (e.g., healthcare providers who sponsor trials) that are subject to privacy and security requirements under the Health Insurance Portability and Accountability Act of 1996,the Health Information Technology for Economic and Clinical Health Act, and their implementing regulations, collectively referred to as "HIPAA". Although we are not directly subject to HIPAA, we could be subject to criminal penalties if we knowingly obtain, use, or disclose individually identifiable health information maintained by a HIPAA covered entity in a manner that is not authorized or permitted by HIPAA. HIPAA generally requires that healthcare providers and other covered entities obtain written authorizations from patients prior to disclosing protected health information of the patient (unless an exception to the authorization requirement applies). If authorization is required and the patient fails to execute an authorization or the authorization fails to contain all required provisions, then we may not be allowed access to and use of the patient's information and our research support efforts could be impaired or delayed. Furthermore, use and disclosure of protected health information that is provided to us pursuant to a valid patient authorization is subject to the limits set forth in the authorization. Moreover, patients about whom we or our partners obtain information, as well as third parties who share this information with us, may have contractual rights that limit our ability to use and disclose the information. In addition, HIPAA does not replace federal, state, international or other laws to which we may be subject that may grant individuals even greater privacy protections. Federal and state laws that protect the privacy and security of patient information may be subject to enforcement and interpretations by various governmental authorities and courts, resulting in complex compliance issues. For example, we could incur damages under state laws, including pursuant to an action brought by a private party for the wrongful use or disclosure of health information or other personal information. We also are subject to the California Consumer Privacy Act, or the CCPA, which became effective as of January 2020, and creates individual privacy rights for California consumers and increases the privacy and security obligations of entities handling certain personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. While the majority of provision went into effect on January 1, 2023, the enforcement of the California Privacy Rights Act, or the CPRA, began as of July 1, 2023, in California. The CPRA imposes additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also creates a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. As such, additional compliance investment and potential business process changes may still be required. Similar laws have passed in Delaware, Indiana, Iowa, Montana, Oregon and Tennessee, and have been proposed in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the U.S. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. In the event that we are subject to or affected by the CCPA, the CPRA, or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition. We may also be required to comply with the data privacy and security laws of other countries in which we operate or with which we transfer and receive data. For example, in the European Economic Area, we are subject to the EU General Data Protection Regulation, and in the U.K., we are subject to the U.K. data protection regime consisting primarily of the GDPR and the U.K. Data Protection Act 2018, which include a range of compliance obligations for subject companies and imposes penalties for noncompliance of up to the greater of €20 million or 4% of worldwide revenue. We have established processes and frameworks to manage compliance with the GDPR. Potential fines and penalties in the event of a violation of the GDPR could have a material adverse effect on our business and operations. In addition, similar data protection regulations addressing access, use, disclosure and transfer of personal data have been enacted or updated in regions where we do business, including in Asia, Latin America, and Europe. We expect to make changes to our business practices and to incur additional costs associated with compliance with these evolving and complex regulations. In addition to data protection laws and regulations, government agencies are considering (or are adopting) other laws, regulations and guidelines that impact the processing of personal information. For example, the evolving landscape surrounding the use of AI and online advertising may lead to additional compliance costs and could increase our overall risk.

We send, receive and store certain personal and financial information about our customers, suppliers, investigators and employees. Our processes for the protection of this information include the utilization of third-party service providers and vendors as well as secure data transmission and storage. A compromise in our processes or systems, or those processes and systems provided to us by third-party service providers and vendors, could adversely affect our reputation with our customers and others, as well as our results of operations, financial condition and liquidity. Such a compromise could also result in litigation against us and the imposition of fines and penalties.

We develop, maintain and license software as a service and application solutions alongside licensed technology systems to implement and manage various aspects of clinical trials. These systems are used in clinical trial randomization, investigational product supply management, DCT execution and other clinical trial functions. These systems often involve integrations with third party systems. Incorrect design, programming or validation of these systems could lead to substantial data integrity or patient safety issues potentially resulting in the invalidation of the clinical trial and/or claims against us and could otherwise adversely affect our financial results.

The biopharmaceutical industry is highly competitive, and we regularly provide services to customers that are developing competing drugs. Given the adverse competitive interests, customers may discourage us from providing services to a competing customer or potential customer or limit the scope to which competitors can use our services. The loss of, or reduction in, services that we can provide to existing or potential customers may have a material adverse effect on our business, operations, or financial condition.

If any large customer decreases or terminates its relationship with us, our business, financial condition, results of operations or cash flows could be materially adversely affected. For the year ended December 31, 2023, our top ten customers based on revenue accounted for approximately 47% of our consolidated revenue and our top ten customers based on backlog accounted for approximately 53% of our total backlog. For the year ended December 31, 2023, one customer accounted for approximately 10.6% of revenue. It is possible that an even greater portion of our revenues will be attributable to a smaller number of customers in the future, including as a result of our entering into strategic provider relationships with customers. Also, consolidation in our potential customer base results in increased competition for important market segments and fewer available customer accounts. Additionally, conducting multiple clinical trials and providing other development or post-approval services for different customers in a single therapeutic class involving drugs with the same or similar chemical action may adversely affect our business if some or all of the trials or services are canceled because of new scientific information or regulatory judgments that affect the drugs as a class. Further, concentration in a particular therapeutic class could cause trials we are conducting for our customers to compete with one another for limited resources (e.g., patients, academic interest, funding), which could impact the successful completion or timely execution of these studies, and therefore our business.

The loss of key management personnel or the inability to attract and retain experienced and qualified employees and increased costs related to such personnel and employees could adversely affect the business. There is significant competition for qualified personnel in the CRO industry. In the future, if competition for the services of these professionals increases and, correspondingly, the cost of these professionals increases, we may not be able to continue to attract and retain individuals in our markets. Changes in key management, or the ability to attract and retain qualified personnel, as a result of increased competition for talent, wage growth, or other market factors (including costs) could lead to strategic and operational challenges and uncertainties, distractions of management from other key initiatives, and inefficiencies and increased costs, any of which could adversely affect our business, financial condition, results of operations, and cash flows.