Veradigm (MDRX) Risk Analysis

We depend on independent content and service providers for communications and information services and for some of the benefits we provide through our software applications and services, including the maintenance of managed care pharmacy guidelines, drug interaction reviews, the routing of transaction data to third-party payers and the hosting of our applications. Our ability to rely on these services could be impaired as a result of the failure of such providers to comply with applicable laws, regulations and contractual covenants or as a result of events affecting such providers, such as power loss, telecommunication failures, software or hardware errors, computer viruses and similar disruptive problems, fire, flood and natural disasters. Any such failure or event could adversely affect our relationships with our clients and damage our reputation. This could materially and adversely impact our business, financial condition and operating results. We may have no means of replacing content or services on a timely basis or at all if they are inadequate or in the event of a service interruption or failure. We also rely on independent content providers for the majority of the clinical, educational and other healthcare information that we provide. In addition, we depend on our content providers to deliver high quality content from reliable sources and to continually upgrade their content in response to demand and evolving healthcare industry trends. If these parties fail to develop and maintain high quality, attractive content, the value of our brand and our business, financial condition and operating results could be materially and adversely impacted.

As a participant in the healthcare industry, our operations and relationships, and those of our clients, are regulated by a number of foreign, federal, state and local governmental entities. The impact of this regulation on us is direct, to the extent we are ourselves subject to these laws and regulations, and is also indirect, both in terms of the level of government reimbursement available to our clients and in that, in a number of situations, even if we are not directly regulated by specific healthcare laws and regulations, our products must be capable of being used by our clients in a manner that complies with those laws and regulations. The ability of our clients to comply with laws and regulations while using our solutions could affect the marketability of our products or our compliance with our client contracts, or even expose us to direct liability under the theory that we had assisted our clients in a violation of healthcare laws or regulations. Because our business relationships with physicians, hospitals and other provider clients are unique and the healthcare IT industry as a whole is relatively young, the application of many state and federal regulations to our business operations and to our clients is uncertain. It is possible that a review of our business practices or those of our clients by courts or regulatory authorities could result in a determination that could adversely affect us. See the risk factor entitled "The failure by Practice Fusion to comply with the terms of its settlement agreements with the U.S. Department of Justice (the "DOJ") could have a material and adverse impact on our business, results of operations and financial condition, and, even if Practice Fusion complies with those settlement agreements, the costs and burdens of compliance could be significant, and we may face additional investigations and proceedings from other governmental entities or third parties related to the same or similar conduct underlying the agreements with the DOJ." Furthermore, as we expand our business globally, we become subject to comparable laws and regulations in each non-United States jurisdiction in which we operate, which creates additional risks. See the risk factor entitled "Our business is subject to the risks of global operations." Specific risks include, but are not limited to: Healthcare Fraud. Federal and state governments continue to enhance regulation of and increase their scrutiny over practices involving healthcare fraud perpetrated by healthcare providers and professionals whose services are reimbursed by Medicare, Medicaid and other government healthcare programs. Any determination by a regulatory, prosecutorial or judicial authority that any of our activities involving our clients, vendors or channel partners violate any of these laws could subject us to civil or criminal penalties, require us to change or terminate some portions of our business, require us to refund a portion of our license or service fees or disqualify us from providing services to clients doing business with government programs, any of which could have a material adverse effect on our business, financial condition and operating results. Even an unsuccessful challenge by regulatory or prosecutorial authorities could result in adverse publicity, require a costly response from us and have a material adverse effect on our business, financial condition and operating results. Patient Information. Our business is subject to rules, particularly HIPAA and HITECH, and contractual obligations relating to the privacy and security of PHI that we and our subcontractors may have access to as part of the operation of our business. These rules and obligations have increased the cost of compliance and could subject us to additional enforcement actions and contractual liability, which could further increase our costs and adversely affect the way in which we do business. The penalties for a violation of HIPAA or HITECH are significant and could have an adverse impact upon our business, financial condition and operating results, if such penalties ever were imposed. If we or our subcontractors do not follow procedures and policies for the handling of PHI, or if those procedures and policies are not sufficient to prevent the unauthorized disclosure of PHI, we could be subject to civil and/or criminal liability, fines and lawsuits, termination of our client contracts or our operations could be shut down. Moreover, because all HIPAA standards and HITECH implementing regulations and guidance are subject to change or interpretation, we cannot predict the full future impact of HIPAA, HITECH or their implementing regulations on our business and operations. Additionally, certain state privacy laws are not preempted by HIPAA and HITECH and may impose independent obligations upon our clients or us. Additional legislation governing the acquisition, storage and transmission or other dissemination of health record information and other personal information, including social security numbers and other identifiers, continues to be proposed and come into force at the state level. There can be no assurance that changes to state or federal laws will not materially restrict the ability of providers to submit information from patient records using our products and services. Electronic Prescribing. The use of our software by physicians to perform a variety of functions, including electronic prescribing, which refers to the electronic routing of prescriptions to pharmacies and the ensuing dispensation, is governed by state and federal law, including fraud and abuse laws. States have differing prescription format requirements, which we have programmed into our software. There is significant variation in the laws and regulations governing prescription activity, as federal law and the laws of many states permit the electronic transmission of certain controlled prescription orders, while the laws of several states neither specifically permit nor specifically prohibit the practice. Restrictions exist at the federal level on the use of electronic prescribing for controlled substances and certain other drugs. However, some states (most notably New York) have passed complementary laws governing the use of electronic prescribing tools in the use of prescribing opioids and other controlled substances, and we expect this to continue to be addressed with regulations in other states. In general, regulations in this area impose certain requirements which can be burdensome and evolve regularly and may adversely affect our business model. Electronic Health Records. A number of important federal and state laws governing the use and content of EHRs may affect the design of such technology. As a company that provides EHRs to a variety of providers of healthcare, our systems and services must be designed in a manner that facilitates our clients' compliance with these laws. We cannot predict the content or effect of possible changes to these laws or new federal and state laws that might govern these systems and services. We may also be subject to future legislation and regulations concerning the development and marketing of healthcare software systems or requirements related to product functionality. These could increase the cost and time necessary to market new services and could affect us in other respects not presently foreseeable. Furthermore, several of our products are certified by an ONC-approved certifying body as meeting the standards for functionality, interoperability and security under HITECH. Our failure to maintain this certification or otherwise meet industry standards could adversely impact our business. HITECH identified the "meaningful use" of interoperable EHRs throughout the United States health care delivery system as a critical national goal. By using certified EHR technology and submitting information on the quality of care and other measures to the Secretary of Health & Human Services, eligible healthcare professionals and hospitals have been able to qualify for an additional Medicare and Medicaid payment for the Meaningful Use of certified EHR technology that meets specified objectives under the EHR Incentive program. If our clients do not receive or lose expected payments from other incentive or pay for value programs, this could harm their willingness to purchase future products or upgrades, and therefore could have an adverse effect on our future revenues. Claims Transmission. Our system electronically transmits medical claims by physicians to patients' payers for approval and reimbursement. In addition, we offer revenue cycle management services that include the manual and electronic processing and submission of medical claims by physicians to patients' payers for approval and reimbursement. Federal law provides that it is both a civil and a criminal violation for any person to submit, or cause to be submitted, a claim to any payer, including, without limitation, Medicare, Medicaid and all private health plans and managed care plans, seeking payment for any services or products that overbills or bills for items that have not been provided to the patient. We have in place policies and procedures that we believe assure that all claims that are transmitted by our system and through our services are accurate and complete, provided that the information given to us by our clients is also accurate and complete. If, however, we or our subcontractors do not follow those procedures and policies, or they are not sufficient to prevent inaccurate claims from being submitted, we could be subject to liability. Medical Devices. Certain computer software products are regulated as medical devices under the Federal Food, Drug and Cosmetic Act. The Cures Act, passed in December 2016, clarified the definition of a medical device to exclude health information technology such as EHRs; however, the legislation did leave the opportunity for that designation to be revisited if determined to be necessary by changing industry and technological dynamics. Accordingly, the Food and Drug Administration (the "FDA") may become increasingly active in regulating computer software intended for use in healthcare settings. Depending on the product, we could be required to notify the FDA and demonstrate substantial equivalence to other products on the market before marketing such products or obtain FDA approval by demonstrating safety and effectiveness before marketing a product. Depending on the intended use of a device, the FDA could require us to obtain extensive data from clinical studies to demonstrate safety or effectiveness or substantial equivalence. If the FDA requires this data, we could be required to obtain approval of an investigational device exemption before undertaking clinical trials. Clinical trials can take extended periods of time to complete. We cannot provide assurances that the FDA would approve or clear a device after the completion of such trials. In addition, these products would be subject to the Federal Food, Drug and Cosmetic Act's general controls. The FDA can impose extensive requirements governing pre- and post-market conditions such as approval, labeling and manufacturing, as well as governing product design controls and quality assurance processes. Failure to comply with FDA requirements can result in criminal and civil fines and penalties, product seizure, injunction and civil monetary policies-each of which could have an adverse effect on our business.

United States healthcare system reform at both the federal and state level could increase government involvement in healthcare, reconfigure reimbursement rates and otherwise change the business environment of our clients and the other entities with which we have a business relationship. We cannot predict whether or when future healthcare reform initiatives at the federal or state level or other initiatives affecting our business will be proposed, enacted or implemented or what impact those initiatives may have on our business, financial condition or operating results. Our clients and the other entities with which we have a business relationship could react to these initiatives and the uncertainty surrounding these proposals by curtailing or deferring investments, including those for our products and services. Additionally, government regulation could alter the clinical workflow of physicians, hospitals and other healthcare participants, thereby limiting the utility of our products and services to existing and potential clients and curtailing broad acceptance of our products and services. Further examples of government involvement could include requiring the standardization of technology relating to EHRs, providing clients with incentives to adopt EHR solutions or developing a low-cost government-sponsored EHR solution, or increased enforcement activity targeting healthcare fraud and abuse.

We depend upon licenses for some of the technology used in our solutions from third-party vendors and intend to continue licensing technologies from third parties. These technologies may not continue to be available to us on commercially reasonable terms or at all. Most of these licenses can be renewed only by mutual consent and may be terminated if we breach the terms of the license and fail to cure the breach within a specified period of time. Our inability to obtain, maintain or comply with any of these licenses could delay development until equivalent technology can be identified, licensed and integrated, which would harm our business, financial condition and operating results. Most of our third-party licenses are non-exclusive, and our competitors may obtain the right to use any of the technology covered by these licenses and use the technology to compete directly with us. Our use of third-party technologies exposes us to increased risks, including, but not limited to, risks associated with the integration of new technology into our solutions, the diversion of our resources from development of our own proprietary technology and our inability to generate revenue from licensed technology sufficient to offset associated acquisition and maintenance costs. In addition, if our vendors choose to discontinue support of the licensed technology in the future or are unsuccessful in their continued research and development efforts, we may not be able to modify or adapt our own solutions.