Quipt Home Medical (QIPT) Risk Analysis

Quipt is required to maintain a significant number of state and/or federal licenses and permits for its operations and facilities. The ability of Quipt and its subsidiaries to obtain, sustain or renew any such licenses and permits on acceptable ?terms is subject to changes in regulations and policies and to the discretion of the applicable authorities or other ?governmental agencies. There is no guarantee that the Quipt will meet these conditions.?? Moreover, certain employees are required to maintain licenses in the states in which they practice. Quipt manages the facility licensing function centrally. In addition, individual clinical employees are responsible for obtaining, maintaining and renewing their professional licenses, and Quipt has processes in place designed to notify branch or pharmacy managers of renewal dates for the clinical employees under their supervision. State and federal licensing requirements are complex and often open to subjective interpretation by various regulatory agencies. Accurate licensure is also a critical threshold issue for the Medicare enrollment and the Medicare competitive bidding program. From time to time, Quipt may also become subject to new or different licensing requirements due to legislative or regulatory requirements developments or changes in its business, and such developments may cause Quipt to make further changes in its business, the results of which may be material. Although Quipt believes it has appropriate systems in place to monitor licensure, violations of licensing requirements may occur and failure by Quipt to acquire or maintain appropriate licensure for its operations, facilities and clinicians could result in interruptions in its operations, refunds to state and/or federal payors, sanctions or fines or the inability to serve Medicare beneficiaries in competitive bidding markets which could adversely impact Quipt's financial condition and results of operations. Accreditation is required by most of Quipt's managed care payors and is a mandatory requirement for all Medicare DMEPOS providers. If Quipt or any of its branches lose accreditation, or if any of its new branches are unable to become accredited, such failure to maintain accreditation or become accredited could adversely impact Quipt's financial condition and results of operations.

Numerous federal and state laws and regulations addressing patient privacy and consumer privacy, including HIPAA and the HITECH Act, govern the collection, dissemination, security, use and confidentiality of patient-identifiable health information or personal information. Such laws and regulations relating to privacy, data protection, marketing and advertising, and consumer protection are evolving and subject to potentially differing interpretations. These requirements may be interpreted and applied in a manner that varies from one jurisdiction to another and/or may conflict with other laws or regulations. As a result, Quipt's practices may not have complied or may not comply in the future with all such laws, regulations, requirements and obligations. Any failure, or perceived failure, by Quipt or any of its third-party partners or service providers to comply with privacy policies or federal or state privacy or consumer protection-related laws, regulations, industry self-regulatory principles, industry standards or codes of conduct, regulatory guidance, orders to which they may be subject, or other legal obligations relating to privacy or consumer protection, could adversely affect Quipt's reputation, brand and business, and may result in claims, proceedings or actions against Quipt by governmental entities, consumers, users, suppliers or others. These proceedings may result in financial liabilities or may require Quipt to change its operations, including ceasing the use or sharing of certain data sets. HIPAA and the HITECH Act, and their implementing regulations, require Quipt to comply with standards for the use and disclosure of health information within Quipt and with third parties. HIPAA and the HITECH Act also include standards for common healthcare electronic transactions and code sets, such as claims information, plan eligibility, payment information, and privacy and security of individually identifiable health information. HIPAA requires healthcare providers, including Quipt, in addition to health plans and clearinghouses, to develop and maintain policies and procedures with respect to protected health information that is used or disclosed. The HITECH Act included notification requirement for breaches of patient-identifiable health information, restricts certain disclosures and sales of patient-identifiable health information and provides a tiered system for civil monetary penalties for HIPAA violations. HIPAA also provides for criminal penalties. In addition, various federal and state legislative and regulatory bodies, or self-regulatory organizations, may expand current laws or regulations, enact new laws or regulations or issue revised rules or guidance regarding privacy, data protection and consumer protection. For instance, the CCPA became effective on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined) and provide such consumers new ways to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. Although there are limited exemptions for protected health information and the CCPA's implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, the CCPA may increase Quipt's compliance costs and potential liability. Many similar privacy laws have been proposed at the federal level and in other states. Additionally, the FTC and many state attorneys general are interpreting existing federal and state consumer protection laws to impose evolving standards for the online collection, use, dissemination and security of health-related and other personal information. Courts may also adopt the standards for fair information practices promulgated by the FTC, which concern consumer notice, choice, security and access. Consumer protection laws require Quipt to publish statements that describe how it handles personal information and choices individuals may have about the way Quipt handles their personal information. If such information that Quipt publishes is considered untrue, it may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Furthermore, according to the FTC, violating consumers' privacy rights or failing to take appropriate steps to keep consumers' personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5 of the FTC Act. Under the Federal CAN-SPAM Act, the TCPA and the Telemarketing Sales Rule and Medicare regulations, Quipt is limited in the ways in which it can market and service its products and services by use of email, text or telephone marketing. The actual or perceived improper sending of text messages may subject us to potential risks, including liabilities or claims relating to consumer protection laws. Numerous class-action suits under federal and state laws have been filed in recent years against companies who conduct SMS texting programs, with many resulting in multi-million-dollar settlements to the plaintiffs. Any future such litigation against us could be costly and time-consuming to defend. For example, the TCPA, a federal statute that protects consumers from unwanted telephone calls, faxes and text messages, restricts telemarketing and the use of automated SMS text messages without proper consent. On April 1, 2021, in Facebook, Inc. v. Duguid, 141 S. Ct. 1163 (2021), the U.S. Supreme Court adopted a narrow definition of the type of automated dialers that are subject to the TCPA, thereby removing some automated text messages from the scope of the TCPA consent requirements. As a result, there may be an increase in litigation under state laws and new legislation at the federal and state level in an effort to ensure that consent is required for calls and text messages that are now outside the scope of the TCPA. For example, in May 2021, the Florida legislature passed a bill that expands restrictions for telephonic sales calls, including text messages, made using automated selection and dialing systems and creates a private right of action for violations of the law. Additionally, state regulators may determine that telephone calls to patients of Quipt are subject to state telemarketing regulations. If Quipt does not comply with existing or new laws and regulations related to telephone contacts or patient health information, it could be subject to criminal or civil sanctions. New health information standards, whether implemented pursuant to HIPAA, the HITECH Act, congressional action or otherwise, could have a significant effect on the manner in which Quipt handles healthcare-related data and communicates with payors, and the cost of complying with these standards could be significant. The scope and interpretation of the laws that are or may be applicable to the delivery of consumer phone calls, emails and text messages are continuously evolving and developing. If Quipt does not comply with these laws or regulations or if it becomes liable under these laws or regulations, it could face direct liability, could be required to change some portions of its business model, could face negative publicity and its business, financial condition and results of operations could be adversely affected. Even an unsuccessful challenge of Quipt's phone, email or SMS text practices by its consumers, regulatory authorities or other third parties could result in negative publicity and could require a costly response from and defense by Quipt.

Quipt's operations are subject to the many hazards inherent in the transportation of medical gas products and compressed and liquid oxygen, including ruptures, leaks and fires. These risks could result in substantial losses due to personal injury or loss of life, severe damage to and destruction of property and equipment and pollution or other environmental damage and may result in curtailment or suspension of Quipt's related operations. If a significant accident or event occurs, it could adversely affect Quipt's business, financial position and results of operations. Additionally, corrective action plans, fines or other sanctions may be levied by government regulators who oversee transportation of hazardous materials such as compressed or liquid oxygen. Quipt provides a significant number of patients with oxygen-based therapy, and from time to time, Quipt has operated medical gas facilities in several states subject to federal and state regulatory requirements. Quipt's medical gas facilities and operations are subject to extensive regulation by the Food and Drug Administration ("FDA") and other federal and state authorities. The FDA regulates medical gases, including medical oxygen, pursuant to its authority under the federal Food, Drug and Cosmetic Act. Among other requirements, the FDA's current Good Manufacturing Practice ("cGMP") regulations impose certain quality control, documentation and record keeping requirements on the receipt, processing and distribution of medical gas. Further, in each such state, its medical gas facilities would be subject to regulation under state health and safety laws, which vary from state to state. The FDA and state authorities conduct periodic, unannounced inspections at medical gas facilities to assess compliance with the cGMP and other regulations, and Quipt expends significant time, money and resources in an effort to achieve substantial compliance with the cGMP regulations and other federal and state law requirements at each of its medical gas facilities. Quipt also complies with the FDA's requirement for medical gas providers to register their sites with the agency. There can be no assurance, however, that these efforts will be successful and that Quipt's medical gas facilities will maintain compliance with federal and state law regulations. Failure by Quipt to maintain regulatory compliance at its medical gas facilities could result in enforcement action, including warning letters, fines, product recalls or seizures, temporary or permanent injunctions, or suspensions in operations at one or more locations, and civil or criminal penalties which could materially harm its business, financial condition, results of operations, cash flow, capital resources and liquidity.

Supply chain disruptions, such as materials and equipment shortages, shipping, logistics and other delays, might make it more difficult and costly for Quipt to obtain products or services from third parties. If these types of disruptions occur, they could have a material adverse effect on Quipt's business, financial condition, results of operations and cash flows. Labor shortages may lead to a significant increase in competition throughout the industry to attract and retain talent and lead to increased labor costs. Quipt's failure to recruit and retain qualified employees, or to control its labor costs, could have a material adverse effect on its business, financial position, results of operations, and cash flows. While Quipt seeks to mitigate any cost increases, labor impacts and supply chain delays and shortages, these efforts may not be successful and Quipt could experience adverse impacts due to such factors. Quipt cannot predict the extent of these factors or other future increases in operating costs. To the extent such costs continue to increase, Quipt may be prevented, in whole or in part, from passing such cost increases through to its existing and prospective customers, or Quipt's customers may seek other competitive sources due to supply chain delays, which could have a material adverse impact on Quipt's business, financial position, results of operations and cash flows.

In recent years, there has been a continuing trend of health insurers merging or increasing efforts to consolidate with other non-governmental payors. Insurers are also increasingly pursuing alignment initiatives with healthcare providers. Consolidation within the health insurance industry may result in insurers having increased negotiating leverage and competitive advantages, such as greater access to performance and pricing data. Quipt's ability to negotiate prices and favorable terms with health insurers in certain markets could be affected negatively as a result of this consolidation. In addition, the shift toward value-based payment models could be accelerated if larger insurers, including those engaging in consolidation activities, find these models to be financially beneficial. There can be no assurance that Quipt will be able to negotiate favorable terms with payors and otherwise respond effectively to the impact of increased consolidation in the payor industry or vertical integration efforts.

There is an inherent risk of liability in the provision of healthcare services. As participants in the healthcare industry, Quipt may periodically be subject to lawsuits, some of which may involve large claims and significant costs to defend, such as mass tort or other class actions. Although Quipt's insurance coverage reflects deductibles, self-insured retentions, limits of liability and similar provisions that it believes are reasonable based on its operations, the coverage under its insurance programs may not be adequate to protect it in all circumstances. Quipt's insurance policies contain exclusions and conditions that could have a materially adverse impact on Quipt's ability to receive indemnification thereunder, as well as customary sub-limits for particular types of losses. Additionally, insurance companies that currently insure companies in Quipt's industry may cease to do so, may change the coverage provided or may substantially increase premiums in the future. The incurrence of losses and liabilities that exceed Quipt's available coverage, therefore, could have a material adverse effect on its business, financial condition and results of operations. Quipt also maintains Directors and Officers (D&O) Liability insurance coverage to protect all of its directors and executive officers. As premiums for insurance covering directors' and officers' liability are rising, Quipt may be required to accept reduced policy limits and coverage or incur substantially higher costs to obtain the same or similar coverage. There can be no assurance that this D&O coverage will be sufficient to cover the costs of the events that may lead to its invocation, in which case, there could be an adverse impact on Quipt's financial condition, should such an unforeseen event occur. As a result, it may be more difficult for us to attract and retain qualified people to serve on Quipt's board of directors, its board committees, or as executive officers.

Quipt derived approximately 27% of its net revenue for each of the years ended September 30, 2024 and 2023, by seeking reimbursement from Medicare. If the Medicare program were to slow payments of Quipt receivables for any reason, Quipt would be ?adversely impacted. In addition, Medicare, private health insurance companies,? and third-party private payors ?continually seek to control the cost of providing healthcare services through direct contracts with healthcare providers, increased oversight and greater enrollment of patients in managed care programs and preferred provider organizations. These private payors are increasingly demanding discounted fee structures, including setting reimbursement rates based on Medicare fee schedules or requiring healthcare providers or suppliers to assume a greater degree of financial risk related to patient care. Reimbursement rates under private payor programs may not remain at current levels and may not be sufficient to cover the costs of caring for patients enrolled in such programs, and Quipt may experience a deterioration in pricing flexibility, changes in payor mix and growth in operating expenses in excess of increases in payments by private third-party payors. Quipt may be compelled to lower its prices due to increased pricing pressures, which could adversely impact Quipt's financial condition and results of operations. A reduction in reimbursement may be unrelated to any concurrent decline in the cost of operations, thereby resulting in ?reduced profitability. Quipt's costs of operations could increase, but the cost increases may not be passed on to ?customers because reimbursement rates are set without regard to the cost of service.?

Failure to achieve the cost savings or enhanced quality control expected from the successful design and implementation of such initiatives may adversely impact Quipt's financial condition and results of operations. Additionally, Medicare and Medicaid often change their documentation requirements with respect to claims submissions. The standards and rules for healthcare transactions, code sets and unique identifiers also continue to evolve, such as ICD 10 and HIPAA 5010 and other data security requirements. Moreover, government programs and/or commercial insurance payors may have difficulties administering new standards and rules for healthcare transactions and this may adversely affect timelines of payment or payment error rates. The DMEPOS Competitive Bidding Program also imposes new reporting requirements on contracted providers. Failure by Quipt to successfully design and implement system or process modifications could have a significant impact on its operations and financial condition. From time to time, Quipt's outsourced contractors for certain information systems functions may make operational, leadership or other changes that could impact Quipt's plans and cost-savings goals. The implementation of many of the new standards and rules will require Quipt to make substantial investments. Further, the implementation of these system or process changes could have a disruptive effect on related transaction processing and operations. If Quipt's implementation efforts related to systems development are unsuccessful, Quipt may need to write off amounts that it has capitalized related to systems development projects. Additionally, if systems development implementations do not occur, Quipt may need to incur additional costs to support its existing systems.