Ontrak (OTRK) Risk Factors

Our federal net operating loss carry forwards ("NOLs") have an indefinite life. These NOLs may be used to offset future taxable income, to the extent we generate any taxable income, and thereby reduce or eliminate our future federal income taxes otherwise payable. Section 382 of the Internal Revenue Code imposes limitations on a corporation's ability to utilize NOLs if it experiences an ownership change as defined in Section 382. In general terms, an ownership change may result from transactions increasing the ownership of certain stockholders in the stock of a corporation by more than 50% over a three-year period. In the event that an ownership change has occurred, or were to occur, utilization of our NOLs would be subject to an annual limitation under Section 382 determined by multiplying the value of our stock at the time of the ownership change by the applicable long-term tax-exempt rate as defined in the Internal Revenue Code. Any unused annual limitation may be carried over to later years. We have experienced ownership changes in the past and can continue to experience ownership changes under Section 382 as a result of events in the past or the issuance of shares of common or preferred stock, or a combination thereof. As a result of such ownership changes, the use of our NOLs, or a portion thereof, against our future taxable income may be subject to an annual limitation under Section 382, which may result in expiration of a portion of our NOLs before utilization.

In providing administrative services to healthcare providers and operating our treatment programs, we may collect, use, disclose, maintain and transmit patient information in ways that will be subject to many of the numerous state, federal and international laws and regulations governing the collection, use, disclosure, storage, privacy and security of patient-identifiable health information, including the administrative simplification requirements of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (HIPAA) and the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH). The HIPAA Privacy Rule restricts the use and disclosure of certain patient information ("Protected Health Information" or "PHI"), and requires safeguarding that information. The HIPAA Security Rule and HITECH establish elaborate requirements for safeguarding PHI transmitted or stored electronically. HIPAA applies to covered entities, which may include healthcare facilities and also includes health plans that will contract for the use of our programs and our services. HIPAA and HITECH require covered entities to bind contractors that use or disclose protected health information (or "Business Associates") to compliance with certain aspects of the HIPAA Privacy Rule and all of the HIPAA Security Rule. In addition to contractual liability, Business Associates are also directly subject to regulation by the federal government. Direct liability means that we are subject to audit, investigation and enforcement by federal authorities. HITECH imposes breach notification obligations requiring us to report breaches of "Unsecured Protected Health Information" or PHI that has not been encrypted or destroyed in accordance with federal standards. Business Associates must report such breaches so that their covered entity customers may in turn notify all affected patients, the federal government, and in some cases, local or national media outlets. We may be required to indemnify our covered entity customers for costs associated with breach notification and the mitigation of harm resulting from breaches that we cause. If we are providing management services that include electronic billing on behalf of a physician practice or facility that is a covered entity, we may be required to conduct those electronic transactions in accordance with the HIPAA regulations governing the form and format of those transactions. Services provided under our Ontrak solution not only require us to comply with HIPAA and HITECH but also Title 42 Part 2 of the Code of Federal Regulations ("Part 2"). Part 2 is a federal, criminal law that severely restricts our ability to use and disclose drug and alcohol treatment information obtained from federally-supported treatment facilities. Our operations must be carefully structured to avoid liability under this law. Our Ontrak solution qualifies as a federally funded treatment facility which requires us to disclose information on members only in compliance with Title 42. In addition to the federal privacy regulations, there are a number of state laws governing the privacy and security of health and personal information. The penalties for violation of these laws vary widely and the area is rapidly evolving. In 2018, California passed the California Consumer Privacy Act (the "CCPA"), which gives consumers significant rights over the use of their personal information, including the right to object to the "sale" of their personal information. In 2020, Californians voted to enact the California Privacy Rights Act (CPRA), which amends the CCPA by expanding consumers' rights in their personal information and creating a new governmental agency to interpret and enforce the statute. Most provisions of the CPRA will become effective on January 1, 2023. While information covered by HIPAA is generally exempt from the applicability of the CCPA as amended by the CPRA, the rights of consumers under the CCPA may restrict our ability to use personal information in connection with our business operations. The CCPA also provides a private right of action for certain security breaches. In 2019, New York passed a law known as the SHIELD Act, which expands data breach reporting obligations and requires companies to have robust data security programs in place. More recently, New York and other states, including Washington, have introduced significant privacy bills, and Congress is debating federal privacy legislation, which if passed, may restrict our business operations and require us to incur additional costs for compliance. In addition, several foreign countries and governmental bodies, including the E.U., Brazil and Canada, have laws and regulations concerning the collection and use of personally identifiable information obtained from their residents, including identifiable health information, which are often more restrictive than those in the U.S. laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure and security of personally identifiable information, including health information, identifying, or which may be used to identify, an individual, such as names, email addresses and, in some jurisdictions, Internet Protocol (IP) addresses, device identifiers and other data. Although we currently conduct business only in the United States of America, these laws and regulations could become applicable to us in the event we expand our operations into other countries. These and other obligations may be modified and interpreted in different ways by courts, and new laws and regulations may be enacted in the future. Within the EEA, the General Data Protection Regulation ("GDPR") took full effect on May 25, 2018, superseding the 1995 European Union Data Protection Directive and becoming directly applicable across E.U. member states. The GDPR includes more stringent operational requirements for processors and controllers of personal data (including health information) established in and outside of the EEA, imposes significant penalties for non-compliance and has broader extra-territorial effect. As the GDPR is a regulation rather than a directive, it applies throughout the EEA, but permits member states to enact supplemental requirements if they so choose. Noncompliance with the GDPR can trigger fines of up to the greater of €20 million or 4% of global annual revenues. Further, a Data Protection Act substantially implementing the GDPR was enacted in the U.K., effective in May 2018. It remains unclear, however, how U.K. data protection laws or regulations will develop in the medium to longer term and how data transfers to and from the U.K. will be regulated in light of the U.K.'s withdrawal from the E.U. In addition, some countries are considering or have enacted legislation requiring local storage and processing of data that could increase the cost and complexity of delivering our services. We believe that we have taken the steps required of us to comply with laws governing the privacy and security of personal information, including health information privacy and security laws and regulations, in all applicable jurisdictions, both state and federal. However, we may not be able to maintain compliance in all jurisdictions where we do business. In addition, to the extent we disclose such information to our third-party service providers in the course of our business, we may be indirectly liable for their misuse or other unauthorized disclosure of such personal information (including health information). Failure to maintain compliance, or changes in state or federal privacy and security laws could result in civil and/or criminal penalties and could have a material adverse effect on our business, including significant reputational damage associated with a breach. Under HITECH, we are subject to prosecution or administrative enforcement and increased civil and criminal penalties for non-compliance, including a four-tiered system of monetary penalties. We are also subject to enforcement by state attorneys general who were given authority to enforce HIPAA under HITECH, and who have authority to enforce state-specific data privacy and security laws. If regulations change, if we expand the territorial scope of our operations, or if it is determined that we are not in compliance with privacy regulations, we may be required to modify aspects of our program, which may adversely affect program results and our business or profitability.

The healthcare business in general, and the behavioral health treatment business in particular, are highly competitive and rapidly evolving. While we believe our programs are unique in many aspects and that our ability to offer customers a comprehensive and integrated behavioral health solution, including the utilization of our analytical models and innovative member engagement methodologies, will help us compete effectively, we operate in highly competitive markets. We compete with other healthcare management service organizations, care management and disease management companies, including Managed Behavioral Healthcare Organizations (MBHOs), other specialty healthcare and managed care companies, and healthcare technology companies that are offering treatment and support of behavioral health on-line and on mobile devices. Most of our competitors are significantly larger and have greater financial, marketing and other resources than us. Our competitors may develop and introduce new processes and products that are equal or superior to our programs in treating behavioral health conditions. There can be no assurance that we will be able to compete successfully, that we will have financial resources to continue to improve our offerings or that we will be successful improving them, any of which would limit our ability to maintain or increase our business share.

Approximately 96% and approximately 98% of our total revenue for the year ended December 31, 2023 and 2022, respectively, were attributable to three and four customers, respectively. Also, three customers represented 95% of our total accounts receivable as of December 31, 2022. We had no accounts receivable outstanding as of December 31, 2023. We expect that revenues from a limited number of customers will continue for the foreseeable future. Sales to these customers are made pursuant to agreements with flexible termination provisions, generally entitling the customer to terminate with or without cause on limited notice to us, and which have adversely affected our business and financial condition and results. For example, in February 2021 and August 2021 we received notices from each of our then largest customers of their intent not to continue our program, and in October 2023, we received a notice from a large customer of its intent not to continue using our services after February 2024. We may not be able to keep our key customers, or these customers may decrease their enrollment levels. Any substantial decrease or delay in revenues relating to one or more of our key customers would harm our business and financial condition and results. If revenues relating to current key customers cease or are reduced, we may not obtain sufficient enrollments from other customers necessary to offset any such losses or reductions.

Our ability to achieve further marketplace acceptance for our Ontrak programs is dependent on our ability to demonstrate financial and clinical outcomes from our agreements. If we are unable to secure sufficient contracts to achieve recognition or acceptance of our Ontrak programs or if our programs does not demonstrate the expected level of clinical improvement and cost savings, it is unlikely that we will be able to achieve widespread market acceptance.

Our ability to increase our customer base and achieve broader market acceptance of our Ontrak program will depend to a significant extent on our ability to deploy our sales and marketing resources efficiently and our ability to drive our current sales pipeline to secure new customers and to cultivate customer and partner relationships to drive revenue growth in the next twelve months. We are focused on identifying and developing new customer opportunities and these efforts require us to invest significant financial and other resources. Our business and operating results will be harmed if our sales and marketing efforts do not generate significant increases in revenue in the next twelve months.

In the ordinary course of our business, we collect and store sensitive data, including legally protected patient health information, personally identifiable information about our employees, intellectual property, and proprietary business information. Our success depends in part on our ability to provide effective cybersecurity protection in connection with our digital technologies and services as well as our internal digital infrastructure. We manage and maintain our applications and data utilizing an off-site co-location facility. These applications and data encompass a wide variety of business critical information including research and development information, commercial information and business and financial information. The secure processing, storage, maintenance and transmission of this critical information is vital to our operations and business strategy, and we devote significant resources to protecting such information. Although we take measures to protect sensitive information from unauthorized access or disclosure, our information technology and infrastructure may be vulnerable to cyberattacks, viruses, breaches or interruptions due to employee error or malfeasance, breaches or interruptions due to the malfeasance or negligence of any of our third-party service providers, terrorist attacks, earthquakes, fire, flood, other natural disasters, power loss, computer systems failure, data network failure, Internet failure or lapses in compliance with privacy and security mandates. We may be subject to distributed denial of service (DDOS) attacks by hackers aimed at disrupting service to patients and customers. Our response to such DDOS attacks may be insufficient to protect our network and systems. In addition, there has been a continuing increase in the number of malicious software attacks in a wide variety of different industries, including malware, ransomware, and email phishing scams. Any successful cybersecurity incident or attack or breach could compromise our networks and the information stored there could be accessed by unauthorized parties, publicly disclosed, lost or stolen. We have measures in place that are designed to detect and respond to such incidents and breaches. Nonetheless, there can be no assurance that the protocols and systems we have designed to prevent or limit the effects of cybersecurity incidents or attacks, including our backup systems, regular data backups, security protocols, network protection mechanisms and other procedures currently in place, or that may be in place in the future, will be adequate to prevent or remedy network and service interruption, system failure, damage to one or more of our systems, data loss, security breaches or other cyberattack and data security incidents. We might be required to expend significant capital and resources to protect against or address security breaches or other cyberattack and data security incident. Any access, disclosure or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information (such as HIPAA and state data security laws), government enforcement actions and regulatory penalties. We may also be required to indemnify our customers for costs associated with having their data on our system breached. Unauthorized access, loss or dissemination could also interrupt our operations, including our ability to provide treatment, bill our customers, provide customer support services, conduct research and development activities, process and prepare company financial information, manage various general and administrative aspects of our business and damage our reputation, or we may lose one or more of our customers, especially if they felt their data may be breached, any of which could adversely affect our business. Also, even if we successfully defend our own digital technologies and services, we also rely on providers of third-party products, services, and networks, with whom we may share data and services, and who may be unable to effectively defend their digital technologies and services against cyberattack. We have experienced and will continue to experience varying degrees of cybersecurity incidents in the normal conduct of our business, including attacks resulting from social engineering such as phishing. These risks could harm our reputation and our relationships with our customers, our third party partners and our employees and may result in claims against us.