HealthStream (HSTM) Risk Factors

We collect and store personal data and sensitive information, including intellectual property, Protected Health Information (PHI) as defined under HIPAA and other individually identifiable health information, provider credentialing and privileging data, education records, and other sensitive personal information, on our networks. In addition, there are a variety of other national, foreign, and international laws and regulations that apply to the collection, use, retention, protection, security, disclosure, transfer, and other processing of personal data, including, but not limited to: the Family Educational Rights and Privacy Act (FERPA), the European Union's General Data Protection Regulation (GDPR), the United Kingdom's General Data Protection Regulation (which implements the GDPR into U.K. law), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Australia's Privacy Act 1988, and New Zealand's Privacy Act 2020. In addition, various states, including California, Virginia, Colorado, Utah, and Connecticut, have passed data privacy laws, and federal lawmakers have proposed additional legislation. The laws and regulations to which we are subject are rapidly evolving and changing and could have an adverse effect on our operations. Companies' obligations and requirements under these laws and regulations are subject to uncertainty in how they may be interpreted by government authorities and regulators. The costs of compliance with, and the other burdens imposed by, these and other laws or regulatory actions may increase our operational costs, affect our customers' willingness to permit us to use and store personal data and sensitive information, prevent us from selling our products or services, and/or affect our ability to invest in or jointly develop products. We may be exposed to litigation, including through private rights of action, regulatory fines, penalties, or other sanctions and damage to our reputation if the personal, confidential, or proprietary information of our customers is not handled in compliance with these laws or is otherwise mishandled or misused by us or any of our suppliers, ecosystem partners, counterparties, or other third parties, or if such third parties do not have appropriate controls in place to protect such personal, confidential, or proprietary information. We may also face audits or investigations by one or more domestic or foreign government agencies relating to our compliance with these regulations. The secure maintenance of personal data and sensitive information is critical to our business operations. As a result, the continued development and enhancement of controls, processes, and practices designed to protect our information systems from attack, damage, or unauthorized access remain a priority for us. If the security measures that we use to protect personal data and sensitive information, or other data of our customers and business relations, are ineffective, we may lose users of our services, which could reduce our revenue, tarnish our reputation, and subject us to significant liability. In addition, if our subcontractors, subprocessors, or various other vendors and service providers on which we rely fail or if they fail to use adequate security or data protection processes or use personal data and sensitive information in an unpermitted or improper manner, we may be liable for losses as a result of their breach and, as a result, we may incur damage to our reputation. Additionally, our costs and efforts associated with obtaining and maintaining certain certifications related to data privacy and protection may also increase, to the extent we are able to obtain or maintain such certifications at all. The current cyber threat environment presents increased risk for all companies, including companies in our industry, and cyberattacks have become increasingly frequent, sophisticated, and difficult to detect. While we have implemented multiple layers of security measures to protect personal data and sensitive information that we collect and store, there is no assurance that these security measures will not be circumvented, including by new technological developments. Moreover, advanced new attacks that may be directed at us or our third-party vendors create risk of cybersecurity incidents, including ransomware, malware, and phishing incidents. We may also be subject to attacks in which malicious actors seek to, and potentially succeed in, exploiting our products or services as a vector to compromise the security or integrity of our customers, partners, or vendors. Additionally, in the current environment, it has become increasingly prevalent for malicious actors to target vendors, such as ourselves, as a means through which to gain unauthorized access to the systems and sensitive information of organizations such as healthcare providers, which comprise our primary customer base. In addition, the rapid evaluation and increased adoption of artificial technologies may heighten our cybersecurity risks by making cybersecurity attacks more difficult to detect, contain, and mitigate. Further, the audit processes, penetration and vulnerability testing, and controls used within our production platforms may not be sufficient to identify and prevent errors or deliberate misuse. Moreover, our software, databases, and servers may contain vulnerabilities or irregularities that lead to computer viruses, physical or electronic attacks, and similar disruptions. Further, we may be at increased risk because we outsource certain services or functions to, or have systems that interface with, third parties. Our contracts with service providers typically require them to implement and maintain adequate security controls, but we may not have the ability to effectively monitor these security measures. As a result, inadequacies of third-party security controls may not be detected until after a cybersecurity incident has occurred. For example, third-party IT vendors may not provide us with fixes or updates to hardware or software in a manner as to avoid an unauthorized loss, access, or disclosure of data or to address a known vulnerability, which may subject us to known threats and cause system failures or disruptions. Third-party vendors that store or have access to our data may not have effective controls, processes, or practices to protect our information or systems from attack, damage, or unauthorized access. These risks may be heightened in connection with employees and service providers working from remote work environments, as our dependency on certain service providers, such as video conferencing and web conferencing services, has significantly increased. In addition, to access our network, products, and services, customers and other third parties may use personal mobile computing devices that are outside of our network environment and subject to their own security risks. We are regularly the target of cybersecurity attacks and other threats that could have a security impact, and we expect to continue to experience an increase in cybersecurity threats in the future. Moreover, in spite of our security measures, we have experienced data and cybersecurity incidents from time to time in the course of our business and have handled those incidents in accordance with our internal policies and our understanding of applicable laws. There is no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident or data breach in the future that will materially affect us. In the future, data breaches or security incidents could result from a variety of circumstances and events, including third party action or inaction, system errors or downtime, employee negligence or error, malfeasance, failures during the process of upgrading or replacing software, databases, or components thereof, power outages, hardware failures, telecommunication failures, user errors, catastrophic events, or threats from malicious persons and groups, new vulnerabilities, and advanced new attacks against information systems, including those against our vendors and customers. Moreover, because the techniques used in cybersecurity attacks change frequently and may not be immediately recognized, we may experience cybersecurity incidents that remain undetected for an extended time. Any such security incidents and data breaches involving us or third parties with which we interact could result in business and operational interruptions and delays; the loss, unauthorized access, misappropriation, acquisition, use, disclosure, or corruption of data; result in our inability to access data; damage or adversely impact our information systems; damage our reputation; adversely impact our relationship with key customers and other business relations; and otherwise adversely impact our business. There can be no assurance that we will not be subject to cybersecurity incidents that bypass our security measures, result in loss of personal data or other confidential information, or disrupt our information systems or business. In addition, data and cybersecurity incidents, particularly if a large number of individuals are affected or if the compromised information is highly sensitive, could expose us and our customers to liability under privacy, security, and consumer protection laws, such as HIPAA, FERPA, and state privacy laws, and foreign data privacy regulations, or subject us to litigation under these or other laws, including common law theories. Moreover, such incidents could subject us to federal and state governmental disclosure requirements, inquiries, or enforcement, result in civil monetary penalties, settlement agreements, corrective action plans, and monitoring requirements, require us to devote significant management resources to address and respond to any such cybersecurity events, interfere with the pursuit of other important business strategies, and/or cause us to incur additional expenditures, which could be material, including to investigate such events, remedy cybersecurity problems, recover lost data, and adapt systems and practices in response to such events. Moreover, there is no assurance that any remedial actions will meaningfully limit the success of future attempts to breach our information systems or the information systems of third parties with which we interact. In addition, our cyber liability and business interruption insurance may not cover or adequately compensate us for losses that may occur in connection with any cybersecurity incident. Furthermore, we have acquired a number of companies, products, services, and technologies in recent years. Although we devote significant resources to address any security issues with respect to such acquisitions, we still may inherit additional security risks when we integrate those companies within HealthStream. Moreover, if a high-profile security breach occurs with respect to an industry peer, our customers and potential customers may lose trust in the security of our solutions in general. As threats to personal data, sensitive information, and our confidential information continue to evolve and increase, we may be required to continue to expend significant resources to maintain, modify, or enhance our internal processes, governance, or protective measures, or to investigate and remediate any security vulnerabilities. For information on our cybersecurity risk management, strategy, and governance, see Item 1C. Cybersecurity.

Many of our competitors and potential competitors have longer operating histories and significantly greater financial, technical, marketing, or other resources than we do. We encounter direct competition from both large and small companies focused on providing solutions that compete with those we offer. Given the profile and growth of the healthcare industry and the ongoing need for training, simulation, scheduling, credentialing, and other information products and services, it is likely that additional competitors will emerge. Additionally, mergers of or other strategic transactions by our competitors could weaken our competitive position. Moreover, our lack of market diversification resulting from our concentration on the healthcare industry may make us susceptible to losing market share to our competitors who also offer solutions, and in some cases a more robust suite of solutions, to a cross-section of industries. These companies may be able to respond more quickly than we can to new or changing opportunities, technologies, standards, or customer requirements. Additionally, given the evolving nature of technology, our technology enabled offerings may be disrupted by innovative or emerging technologies, such as artificial intelligence, blockchain, Web3, or quantum computing technologies, and such disruption could adversely impact our ability to compete. Further, most of our customer agreements are for terms ranging from one to five years, with no obligation to renew. The terms of these agreements may enable customers to more easily shift to one of our competitors following the expiration of the agreement.

We derive a substantial portion of our revenues from a relatively small number of customers. A termination or material modification of our agreements with any of our significant customers or a failure of these customers to renew their contracts on favorable terms, or at all, could have an adverse effect on our business.

Our future performance is substantially dependent on the continued services of our management team and our ability to attract, retain, and motivate them. The loss of the services of any of our officers or senior managers, or the inability to attract additional officers or senior managers as appropriate, could harm our business, as we may not be able to find suitable replacements. Moreover, current competitive labor market conditions may make it more difficult for us to attract and retain key management personnel. In addition, our future success will depend on our ability to attract, train, motivate, and retain other highly skilled technical, managerial, marketing, sales, and customer support personnel. We continue to face competition for certain personnel, especially for software developers, web designers, user experience and interaction designers, and sales personnel, and we may be unable to successfully attract sufficiently qualified personnel where needed. Additionally, current competitive labor market conditions have increased, and may continue to increase, our labor costs as well as the difficulty of hiring and retaining qualified personnel where needed. We have experienced in the past, and continue to experience, difficulty hiring qualified personnel in a timely manner for certain positions, and we may not be able to fill certain positions in desired geographic areas or at all. The pool of qualified technical personnel, in particular, is limited. Many of the companies with which we compete for experienced personnel have greater resources than we have and some of these companies may offer more lucrative compensation packages. We anticipate needing to continue to maintain or increase the size of our staff to support our anticipated growth, without compromising the quality of our offerings or customer service. Our inability to locate, attract, hire, integrate, and retain qualified personnel in sufficient numbers may reduce the quality of our services and impair our ability to grow and adversely impact our financial performance. A significant portion of our workforce have been working remotely since 2020 and we expect a significant portion to continue working remotely under our hybrid workplace model. If we are unable to effectively maintain this hybrid work environment long-term, then we may experience increased attrition, a less cohesive workforce, reduced performance, and less innovation, which may adversely impact our business and financial results.

For the year ended December 31, 2023, approximately 96% of our net revenue was derived from SaaS-based subscriptions and software licensing agreements. Our product and service contracts typically range from one to five years in length, and customers are not obligated to renew their contract with us after their contract term expires; in fact, some customers have elected not to renew their contract, and this risk has increased as the result of current negative macroeconomic conditions. In addition, our customers may renew at a lower price or volume level. Our customers' renewals may decline or fluctuate as a result of a number of factors, including but not limited to, their dissatisfaction with our service, a dissipation or cessation of their need for one or more of our products or services, pricing, or competitive product offerings. If we are unable to renew a substantial portion of the contracts that are up for renewal or maintain our pricing, our results of operations and financial condition could be adversely affected.

We have international operations in several countries outside of the United States, including Canada, Australia, and New Zealand. Conducting our business internationally, particularly with expansion into countries in which we have limited experience, subjects us to a variety of risks that that we do not necessarily face to the same degree in the U.S. These risks include, among others: - unexpected changes or differences in regulatory requirements, including with respect to taxes, trade laws, tariffs, export quotas, custom duties, or other trade restrictions;- differing labor regulations;- differing income and non-income based tax rates and laws;- regulations relating to data privacy and security, cross-border data transfers, and the unauthorized use of, or access to, commercial and personal information;- potential penalties or other adverse consequences for violations of anti-corruption, anti-bribery, and other similar laws and regulations, including the U.S. Foreign Corrupt Practices Act;- greater difficulty in supporting and localizing our products;- unrest and/or changes in a specific country's or region's social, political, legal, health, or economic conditions or other geopolitical developments (such as developments arising from the ongoing conflict between Russia and Ukraine, increasing tensions between China and Taiwan, and the ongoing conflict in the Middle East);- challenges inherent in efficiently managing an increased number of employees over large geographic distances, including the need to implement appropriate systems, controls, policies, benefits, and compliance programs;- currency exchange rate fluctuations;- uncertainties regarding the interpretation and enforceability of legal requirements, including limited or unfavorable intellectual property protection and the enforceability of contract rights;- competition with companies or other services that may understand local markets better than we do;- increased financial accounting and reporting burdens and complexities associated with implementing and maintaining adequate internal controls;- regulations, health guidelines, and safety protocols in foreign jurisdictions related to the pandemic; and - restrictions on repatriation of earnings.

If public health conditions related to COVID-19 significantly worsen, our business and financial results could be adversely impacted. Moreover, conditions related to COVID-19 continue to evolve, and we may not be able to predict or effectively respond to future developments. We face a wide variety of risks related to potential future public health crises, epidemics, pandemics, or similar events, including as a result of the potential impact of any such events on our healthcare customers that could in turn adversely impact us. If a new health epidemic or outbreak were to occur, our business and financial results could be adversely impacted, including in a similar or more extensive manner to how our business was adversely impacted by COVID-19. If any such event were to occur or if public health conditions in the U.S. were to significantly deteriorate, our business and financial results could be adversely affected. Our business could also be adversely impacted by catastrophic events (particularly in areas where we have office locations and/or where we have network infrastructure), such as fires, earthquakes, hurricanes, natural disasters, civil unrest, military conflicts or warfare (such as the war in the Ukraine or the conflict in the Middle East), geographic instability, terrorist attacks, pandemics or other public health emergencies, or the effects of climate change (such as drought, flooding, wildfires, increased storm severity and sea level rise).

We may be liable to third parties for the content sold or made available by us if the text, graphics, software, or other content therein violates copyright, trademark, or other intellectual property rights, if our ecosystem partners violate their contractual obligations to others by providing content that we sell or make available, or if the content is inaccurate, incomplete, or does not conform to accepted standards of care in the healthcare profession. Further, we may be liable to these ecosystem partners if we allow access or release and lose control of their intellectual property stored on our platform either due to security issues or through improper release to customers who have not paid for access to such intellectual property. We attempt to minimize these types of liabilities by requiring representations and warranties relating to our intellectual property partners' ownership of the rights to distribute as well as the accuracy of their intellectual property. We also take measures to review this intellectual property ourselves. Although our agreements with our ecosystem partners in most instances contain provisions providing for indemnification by the ecosystem partners in the event of inaccurate intellectual property, our ecosystem partners may not have the financial resources to meet these indemnification obligations. Alleged liability could harm our business by damaging our reputation, requiring us to incur legal costs in defense, exposing us to awards of damages and costs, and diverting management's attention away from our business.