Spok Holdings (SPOK) Risk Analysis

We have significant deferred income tax assets that are available to offset future taxable income and increase cash flows from operations. The use of these deferred income tax assets is dependent on the availability of taxable income in future periods. The availability of future taxable income is dependent on our ability to profitably manage our operations to support a growing base of software revenue offset by declining wireless subscribers and revenue. To the extent that anticipated reductions in wireless operating expenses do not occur or sufficient revenue is not generated, we may not achieve sufficient taxable income to allow for use of our deferred income tax assets. The accounting for deferred income tax assets is based upon an estimate of future results, and any valuation allowance we may apply to our deferred tax assets may be increased or decreased as conditions change or if we are unable to implement certain tax planning strategies. If we are unable to use these deferred income tax assets, our financial condition and statement of operations may be materially affected. In addition, a significant portion of our deferred income tax assets relate to net operating losses. If our ability to utilize these losses is limited, due to Internal Revenue Code ("IRC") Section 382, our financial condition and statement of operations may be materially affected. For example, we maintained a valuation allowance of $2.3 million at December 31, 2023 and 2022 to reduce net deferred income tax assets as their realization did not meet the applicable more-likely-than-not criterion.

A substantial portion of our revenue comes from healthcare customers. As part of our business, we (or third parties with whom we contract) may receive, store and process our data, as well as our customers' and partners' private data and personal information. As such, our business is subject to a variety of federal, state and international laws and regulations that apply to the collection, use, retention, protection, disclosure, transfer and processing of personal data. Our software solutions may handle or have access to personal health information subject in the United States to HIPAA, HITECH and related regulations as well as legislation and regulations in foreign countries. These statutes and related regulations impose numerous requirements regarding the use and disclosure of personal health information with which we and our software solutions must comply. Our failure to accurately anticipate or interpret these complex and technical laws and regulations could subject us to civil and/or criminal liability. Such failure could adversely impact our ability to market and sell our software solutions to healthcare customers and have a material adverse impact on our software sales. In addition to personal health information, the Company may handle or have access to personal information in the European Union subject to the General Data Protection Regulation (the "GDPR"). The GDPR imposes several stringent requirements for controllers and processors of personal data and increases our obligations, including, for example, by requiring more robust disclosures to individuals, strengthening the individual data rights regime, shortening timelines for data breach notifications, limiting retention periods and secondary use of information, and imposing additional obligations when we contract third-party processors in connection with the processing of personal data. In addition, the GDPR restricts transfers of personal data outside of the European Economic Area and the UK, including to the United States, under certain scenarios. While lawful data transfer mechanisms have been proposed, there remains uncertainty, and we are exposed to potential investigations and enforcement in this area. The GDPR could limit our ability to use and share personal data or could cause our costs to increase and harm our business, financial condition, operating results and cash flows. Failure to comply with the requirements of the GDPR and the applicable European Union member states may result in fines of up to €20,000,000 or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, and other administrative penalties. To comply with the data protection rules imposed by the GDPR, we may be required to put in place additional mechanisms that could be onerous and adversely affect our business, financial condition, and operating results. Existing privacy-related laws and regulations in the United States and other countries are evolving and are subject to potentially differing interpretations, and various federal and state or other international legislative and regulatory bodies may expand or enact laws regarding privacy and data security-related matters. For example, in the U.S., the state of California enacted the California Consumer Privacy Act ("CCPA"), which came into effect in January 2020, and the California Privacy Rights Act ("CPRA"), which came into effect in January 2023, expanding upon the CCPA. The CCPA and CPRA require covered businesses to, among other things, provide certain disclosures to California consumers and afford such consumers certain privacy rights. The CCPA provides for civil penalties for violations, as well as a private right of action for certain security breaches that may increase security breach litigation. The CPRA imposes additional obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses and disclosure of sensitive personal information. The CPRA also creates a new California data protection agency authorized to issue substantive regulations and could result in increased privacy, cybersecurity and data protection enforcement. The CCPA and CPRA have spurred similar legislation in many other states, and we expect this trend to continue. In addition, customers may use our wireless services to transmit patient health information subject to HIPAA and other regulatory requirements. While we offer encrypted pagers to our customers, many customers use wireless devices provided by us that do not encrypt text messages. While we disclaim liability for customer non-compliance with HIPAA and other privacy requirements, there remains some risk we could be held responsible for privacy violations by our customers. There can be no assurance that the security and testing measures we take relating to our offerings and operations will prevent all security breaches and data loss that could harm our business or the businesses of our customers and partners. These risks may increase as we continue to grow our services and offerings and as we receive, store and process more of our customers' data. Actual or perceived vulnerabilities may lead to regulatory investigations, claims against us by customers, partners or other third parties, or costs, such as those related to providing customer notifications and fraud monitoring. There can be no assurance that any provisions in our customer agreements limiting our liability will be enforceable or effective under applicable law. In addition, the cost and operational consequences of implementing further data protection measures could be significant. The data privacy and protection-related laws and regulations to which we are subject are evolving, with new or modified laws and regulations proposed and implemented frequently, and existing laws and regulations subject to new or different interpretations. Any failure by us to comply with data privacy- and protection-related laws and regulations could result in enforcement actions, significant penalties or other legal actions against us or our customers or suppliers. An actual or alleged failure to comply, which could result in negative publicity, reduce demand for our offerings, increase the cost of compliance, require changes in business practices that result in reduced revenue, restrict our ability to provide our offerings in certain locations, result in our customers' inability to use our offerings and prohibit data transfers or result in other claims, liabilities or sanctions, including fines, and could have an adverse effect on our business, financial condition, operating results and cash flows.

Software products, such as those we offer, may contain defects, vulnerabilities and bugs when they are first introduced or as new versions are released, or their release may be delayed due to unforeseen difficulties during product development. If any of our products, including products of companies we have acquired, or third-party components used in our products, contain defects, vulnerabilities or bugs, or have reliability, quality or compatibility problems, we may not be able to successfully design workarounds or resolve these issues. Any defects or vulnerabilities we do not detect and fix in pre-release testing could result in reduced sales and revenue, damage to our reputation, repair or remediation costs, delays in the release of new products or versions or legal liability. In addition, we do not control the quality, security or testing of various third-party software, hardware or infrastructure products that are utilized in our business. There can be no assurance that provisions in our license agreements that limit our exposure to liability will be sufficient or withstand legal challenge. Computer programmers and hackers also may be able to develop and deploy viruses, worms, and other malicious software programs that attack our or a critical third party's products or otherwise exploit any security vulnerabilities of such products.

To execute our growth plan and achieve our strategic objectives, we must continue to attract, hire and retain highly qualified and motivated personnel across our organization. In particular, to continue to enhance our software solutions, add new and innovative core functionality and services and develop new products, it is critical for us to maintain a strong research and development organization, including hiring and retaining highly skilled software engineers. Competition for talent is intense within our industry, and there continues to be upward pressure on compensation especially as a result of higher inflation. In addition, for us to achieve broader market acceptance of our software solutions, grow our customer base, and pursue adjacent markets, we will need to continue to develop and maintain our sales and marketing and customer support organizations. Identifying and recruiting qualified personnel, training them in the use of our software solutions and ensuring they are well-equipped to serve our customers requires a significant investment of time and resources, and it can be particularly difficult to retain these individuals. We face significant competition for experienced personnel, and many of our competitors for talent have greater name recognition and financial resources than we have. If we hire employees from competitors or other companies, former employers may assert claims against us for breach of legal obligations to the former employer, resulting in a diversion of our time and resources. In addition, the job market for technology roles has historically been very competitive. While we are able to expand our candidate pool by opening our opportunities nationwide, allowing us to be more competitive, the job market continues to be a challenge everywhere, making it vitally important to retain our current team members. When considering employment opportunities, candidates and existing employees often consider the value of equity awards. If the actual or perceived value of our equity awards declines, or if the price of our common stock experiences significant volatility, this may adversely affect our ability to recruit and retain highly skilled employees. As a result, we may have greater difficulty hiring and retaining skilled personnel than some of our competitors. If we are unable to attract and retain the personnel necessary to execute our growth plan, we may be unable to achieve our strategic objectives, and our business, financial condition, operating results and ability to pay cash dividends to stockholders may be adversely affected.

We generate more than 75% of our revenue from sales to hospitals and other healthcare provider organizations in the United States. These customers, both non-profit and for-profit, are greatly affected by macroeconomic conditions, pandemics or other public health emergencies, healthcare reform legislation and the reimbursement policies of federal and state governments and health insurance companies, and any decline in revenue received by our customers due to adverse economic conditions, pandemics or other public health emergencies, or legislative or regulatory changes could significantly affect the type and amount of services and products they order from us.

Our business is sensitive to recessionary economic cycles, higher interest rates, inflation, higher levels of unemployment, higher tax rates and other changes in tax laws, or other economic factors that may affect business spending or buying habits that could adversely affect the demand for our services. Adverse economic conditions could increase the rate of gross subscriber cancellations and/or the level of revenue erosion for our wireless business and could cause delays in or the loss of software revenue or bookings, which impacts license, professional services, hardware and subscription revenues. A significant portion of our revenue is derived from healthcare customers, and we are impacted by changes in the healthcare economic environment. The healthcare industry is highly regulated and is subject to changing political, legislative, regulatory, and other economic developments. These developments can have a dramatic effect on the decision-making and spending by our customers for information technology and software. This economic uncertainty can add to the unpredictability of decision-making and lengthen our sales cycle. We are unable to predict the full consequences of this uncertainty on our operations. Adverse changes in the economic environment could adversely impact our ability to increase the prices we charge for our offerings, while effectively managing customer churn, or to successfully market and sell our wireless and software solutions to healthcare customers.