CareCloud, Inc. 10-K

Item 1A. Risk Factors Risks Related to Our Business We operate in a highly competitive industry, and our competitors may be able to compete more efficiently or evolve more rapidly than we do, which could have a material adverse effect on our business, revenue, growth rates and market share. The market for revenue cycle management and healthcare IT solutions is highly competitive, and we expect competition to increase in the future. We face competition from other providers of both integrated and stand-alone practice management, EHR and RCM solutions, including competitors who utilize a web-based platform and providers of locally installed software systems. Our competitors include larger healthcare IT companies, such as athenahealth, Inc., eClinicalWorks, Greenway Medical Technologies, Inc., NextGen, RI RCM and Veradigm, all of which may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards, regulations or customer needs and requirements. Many of our competitors have longer operating histories, greater brand recognition and greater financial marketing and other resources than us. We also compete with various regional RCM companies, some of which may continue to consolidate and expand into broader markets. We expect that competition will continue to increase as a result of incentives provided by the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, and consolidation in both the information technology and healthcare industries. Competitors may introduce products or services that render our products or services obsolete or less marketable. Even if our products and services are more effective than the offerings of our competitors, current or potential customers might prefer competitive products or services to our products and services. In addition, our competitive edge could be diminished or completely lost if our competition develops similar offshore operations in Pakistan or other countries, such as India and the Philippines, where labor costs are lower than those in the U.S. (although higher than in Pakistan). Pricing pressures could negatively impact our margins, growth rate and market share. If we are unable to successfully introduce new products or services or fail to keep pace with advances in technology, we would not be able to maintain our customers or grow our business, which will have a material adverse effect on our business. Our business depends on our ability to adapt to evolving technologies and industry standards and upgrade existing and introduce new products and services accordingly. If we cannot adapt to changing technologies and industry standards, including changing requirements of third-party applications and software and meet the requirements of our customers, our products and services may become obsolete, and our business would suffer significantly. Because both the healthcare industry and the healthcare IT technology market are constantly evolving, our success will depend, in part, on our ability to continue to enhance our existing products and services, develop new technology that addresses the increasingly sophisticated and varied needs of our customers, respond to technological advances and emerging industry standards and practices on a timely and cost-effective basis, educate our customers to adopt these new technologies, and successfully assist them in transitioning to our new products and services. The development of our proprietary technology entails significant technical and business risks. We may not be successful in developing, using, marketing, selling, or maintaining new technologies effectively or adapting our proprietary technology to evolving customer requirements, emerging industry standards or changing third party applications, and, as a result, our business and reputation could materially suffer. We may not be able to introduce new products or services on schedule, or at all, or such products or services may not achieve market acceptance or existing products or services may cease to function properly. A failure by us to timely adapt to ever changing technologies or our failure to regularly upgrade existing or introduce new products or to introduce these products on schedule could cause us to not only lose our current customers but also fail to attract new customers. 14 The continued success of our business model is heavily dependent upon our offshore operations, and any disruption to those operations will adversely affect us. The majority of our operations, including the development and maintenance of our web-based platform, our customer support services and medical billing activities, are performed by our highly educated workforce of approximately 3,600 employees in our Offshore Offices. Approximately 99% of our offshore employees are in our Pakistan Offices and our remaining employees are located at our smaller offshore operation center in Sri Lanka. The performance of our operations in our Pakistan Offices, and our ability to maintain our Offshore Offices, is an essential element of our business model, as the labor costs where our Pakistan Offices are located are substantially lower than the cost of comparable labor in India, the United States and other countries, and allows us to competitively price our products and services. Our competitive advantage will be greatly diminished and may disappear altogether if our operations in our Pakistan Offices are negatively impacted. Pakistan and Sri Lanka have in the past experienced and could in the future continue to experience periods of political and social unrest, war and acts of terrorism. Our operations in our offshore locations may be negatively impacted by these and a number of other factors, including currency fluctuations, cost of labor and supplies, power grid and infrastructure issues, vandalism, and changes in local law, as well as laws within the United States relating to these countries. Client mandates or preferences for onshore service providers may also adversely impact our business model. Our operations in our Offshore Offices may also be affected by trade restrictions, such as tariffs or other trade controls. If we are unable to continue to leverage the skills and experience of our highly educated workforce, particularly in our Pakistan Offices, we may be unable to provide our products and services at attractive prices, and our business would be materially and negatively impacted or discontinued. We believe that the labor costs in our Offshore Offices are approximately 14% of the cost of comparably educated and skilled workers in the U.S. If there were potential disruptions in any of these locations, they could have a negative impact on our business. Our offshore operations expose us to additional business and financial risks which could adversely affect us and subject us to civil and criminal liability. The risks and challenges associated with our operations outside the United States include laws and business practices favoring local competitors; compliance with multiple, conflicting and changing governmental laws and regulations, including employment and tax laws and regulations; and fluctuations in foreign currency exchange rates. Foreign operations subject us to numerous stringent U.S. and foreign laws, including the Foreign Corrupt Practices Act (“FCPA”), and comparable foreign laws and regulations that prohibit improper payments or offers of payments to foreign governments and their officials and political parties by U.S. and other business entities for the purpose of obtaining or retaining business. Safeguards we implement to discourage these practices may prove to be less than effective and violations of the FCPA and other laws may result in severe criminal or civil sanctions, or other liabilities or proceedings against us, including class action lawsuits and enforcement actions from the SEC, Department of Justice and overseas regulators. We may be adversely affected by global climate change or by legal, regulatory, or market responses to such change. The long-term effects of climate change are difficult to predict and may be widespread. The impacts may include physical risks (such as severe rains and flooding as a result of climate change that has been experienced in Pakistan), social and human effects (such as population dislocations or harm to health and well-being), compliance costs and transition risks (such as regulatory or technology changes), and other adverse effects. The effects could impair, for example, the availability and cost of certain products and energy (including utilities), which in turn may impact our ability to procure goods or services required for the operation of our business at the quantities and levels we require. We may bear losses incurred as a result of, for example, physical damage to, or destruction of, our facilities (such as our operation centers), and business interruption due to weather events that may be attributable to climate change. These events and impacts could materially adversely affect our business operations, financial position, or results of operation. 15 Changes in the healthcare industry could affect the demand for our services and may result in a decrease in our revenues and market share. As the healthcare industry evolves, changes in our customer base may reduce the demand for our services, result in the termination of existing contracts, and make it more difficult to negotiate new contracts on terms that are acceptable to us. For example, the current trend toward consolidation of healthcare providers may cause our existing customer contracts to terminate as independent practices are merged into hospital systems or other healthcare organizations. Such larger healthcare organizations may have their own practice management, and EHR and RCM solutions, reducing demand for our services. If this trend continues, we cannot assure you that we will be able to continue to maintain or expand our customer base, negotiate contracts with acceptable terms, or maintain our current pricing structure, which would result in a decrease in our revenues and market share. If providers do not purchase our products and services or delay in choosing our products or services, we may not be able to grow our business. Our business model depends on our ability to sell our products and services. Acceptance of our products and services may require providers to adopt different behavior patterns and new methods of conducting business and exchanging information. Providers may not integrate our products and services into their workflow and may not accept our solutions and services as a replacement for traditional methods of practicing medicine. Providers may also choose to buy our competitors’ products and services instead of ours. Achieving market acceptance for our solutions and services will continue to require substantial sales and marketing efforts and the expenditure of significant financial and other resources to create awareness and demand by providers. If providers fail to broadly accept our products and services, our business, financial condition and results of operations will be adversely affected. If the revenues of our customers decrease, or if our customers cancel or elect not to renew their contracts, our revenue will decrease. Under most of our customer contracts, which include RCM, we base our charges on a percentage of the revenue that our customer collects through the use of our services. Many factors may lead to decreases in customer revenue, including: ● reduction of customer revenue as a result of changes to the ACA or fluctuation in medical appointments as COVID-19 evolves; ● a rollback of the expansion of Medicaid or other governmental programs; ● reduction of customer revenue resulting from increased competition or other changes in the marketplace for physician services; ● failure of our customers to adopt or maintain effective business practices; ● actions by third-party payers of medical claims to reduce reimbursement; ● government regulations and government or other payer actions or inactions reducing or delaying reimbursement; ● interruption of customer access to our system; and ● our failure to provide services in a timely or high-quality manner. 16 As a result of our variable sales and implementation cycles, we may be unable to recognize revenue from prospective customers on a timely basis and we may not be able to offset expenditures. The sales cycle for our services can be variable, typically ranging from two to four months from initial contact with a potential customer to contract execution to six to twelve months to rollout services which require each patient to participate. During the sales cycle, we expend time and resources in an attempt to obtain a customer without recognizing revenue from that customer to offset such expenditures. Our implementation cycle is also variable, typically ranging from two to four months from contract execution to completion of implementation. Each customer’s situation is different, and unanticipated difficulties and delays may arise as a result of a failure by us or by the customer to meet our respective implementation responsibilities. During the implementation cycle, we expend substantial time, effort, and financial resources implementing our services without recognizing revenue. Even following implementation, there can be no assurance that we will recognize revenue on a timely basis or at all from our efforts. In addition, cancellation of any implementation after it has begun may involve loss to us of time, effort, and expenses invested in the canceled implementation process, and lost opportunity for implementing paying customers in that same period of time. As a result of the Wayfair decision and changes in various states’ laws, we are required to collect sales and use taxes on certain products and services we sell in certain jurisdictions. We may be subject to liability for past sales and incur additional related costs and expenses, and our future sales may decrease. We may lose sales or incur significant expenses should states be successful in imposing additional state sales and use taxes on our products and services. A successful assertion by one or more states that we should collect sales or other taxes on the sale of our products and services that we are currently not collecting could result in substantial tax liabilities for past sales, decrease our ability to compete with healthcare IT vendors not subject to sales and use taxes, and otherwise harm our business. Each state has different rules and regulations governing sales and use taxes, and these rules and regulations are subject to varying interpretations that may change over time. We review these rules and regulations periodically and, when we believe that our products or services are subject to sales and use taxes in a particular state, we voluntarily approach state tax authorities in order to determine how to comply with their rules and regulations. We cannot assure you that we will not be subject to sales and use taxes or related penalties for past sales in states where we believe no compliance is necessary. If the federal government were to impose a tax on imports or services performed abroad, we might be subject to additional liabilities. At this time, there is no way to predict whether this will occur or estimate the impact on our business. Vendors of products and services like us are typically held responsible by taxing authorities for the collection and payment of any applicable sales and similar taxes. If one or more taxing authorities determine that taxes should have, but have not, been paid with respect to our products or services, we may be liable for past taxes in addition to taxes going forward. Liability for past taxes may also include very substantial interest and penalty charges. Nevertheless, customers may be reluctant to pay back taxes and may refuse responsibility for interest or penalties associated with those taxes. If we are required to collect and pay back taxes and the associated interest and penalties, and if our customers fail or refuse to reimburse us for all or a portion of these amounts, we will have incurred unplanned expenses that may be substantial. Moreover, imposition of such taxes on our products and services going forward will effectively increase the cost of those products and services to our customers and may adversely affect our ability to retain existing customers or to gain new customers in the states in which such taxes are imposed. We may also become subject to tax audits or similar procedures in states where we already pay sales and use taxes. The incurrence of additional accounting and legal costs and related expenses in connection with, and the assessment of, taxes, interest, and penalties as a result of audits, litigation, or otherwise could be materially adverse to our current and future results of operations and financial condition. 17 If we lose the services of Mahmud Haq as Executive Chairman, A. Hadi Chaudhry as Chief Executive Officer and President, or other members of our management team, or if we are unable to attract, hire, integrate and retain other necessary employees, our business would be harmed. Our future success depends in part on our ability to attract, hire, integrate and retain the members of our management team and other qualified personnel. In particular, we are dependent on the services of Mahmud Haq, our founder, principal stockholder and Executive Chairman, and A. Hadi Chaudhry, our Chief Executive Officer and President. Mr. Haq is instrumental in managing our offshore operations in our Pakistan Offices and coordinating those operations with our U.S. activities. The loss of Mr. Haq, who would be particularly difficult to replace, could negatively impact our ability to effectively manage our cost-effective workforce in our Pakistan Offices, which enables us to provide our products and solutions at attractive prices. Our future success also depends on the continued contributions of our other executive officers and certain key employees, each of whom may be difficult to replace, and upon our ability to attract and retain additional management personnel. Competition for such personnel is intense, and we compete for qualified personnel with other employers. We may face difficulty identifying and hiring qualified personnel at compensation levels consistent with our existing compensation and salary structure. If we fail to retain our employees, we could incur significant expenses in hiring, integrating and training their replacements, and the quality of our services and our ability to serve our customers could diminish, resulting in a material adverse effect on our business. We may be unable to adequately establish, protect or enforce our patents, trade secrets and other intellectual property rights. Our success depends in part upon our ability to establish, protect and enforce our patents, trade secrets and other intellectual property and proprietary rights. If we fail to establish, protect or enforce these rights, we may lose customers and important advantages in the market in which we compete. We rely on a combination of patent, trademark, copyright and trade secret law and contractual obligations to protect our key intellectual property rights, all of which provide only limited protection. Our intellectual property rights may not be sufficient to help us maintain our position in the market and our competitive advantages. Trade secrets may not be protectable if not properly kept confidential. We strive to enter into non-disclosure agreements with our employees, customers, contractors and business partners to limit access to and disclosure of our proprietary information. However, the steps we have taken may not be sufficient to prevent unauthorized use of our customer information, technology, and adequate remedies may not be available in the event of unauthorized use or disclosure of our trade secrets and proprietary information. Our ability to protect the trade secrets of our acquired companies from disclosure by the former employees of these acquired entities may be limited by law in the jurisdiction in which the acquired company and/or former employee resides, and/or where the disclosure occurred, and this leaves us vulnerable to the solicitation of the customers we acquire by former employees of the acquired business that join our competitors. Accordingly, despite our efforts, we may be unable to prevent third parties from using our intellectual property for their competitive advantage. Any such use could have a material adverse effect on our business, results of operations and financial condition. Monitoring unauthorized uses of and enforcing our intellectual property rights can be difficult and costly. Legal intellectual property actions are inherently uncertain and may not be successful, and may require a substantial amount of resources and divert our management’s attention. Claims by others that we infringe or may infringe on their intellectual property could force us to incur significant costs or revise the way we conduct our business. Our competitors protect their proprietary rights by means of patents, trade secrets, copyrights, trademarks and other intellectual property. We have not conducted an independent review of patents and other intellectual property issued to third parties, who may have patents or patent applications relating to our proprietary technology. We may receive letters from third parties alleging, or inquiring about, possible infringement, misappropriation or violation of their intellectual property rights. Any party asserting that we infringe, misappropriate or violate proprietary rights may force us to defend ourselves, and potentially our customers, against the alleged claim. These claims and any resulting lawsuit, if successful, could subject us to significant liability for damages and/or invalidation of our proprietary rights or interruption or cessation of our operations. Any such claims or lawsuit could: ● be time-consuming and expensive to defend, whether meritorious or not; ● require us to stop providing products or services that use the technology that allegedly infringes the other party’s intellectual property; ● divert the attention of our technical and managerial resources; ● require us to enter into royalty or licensing agreements with third-parties, which may not be available on terms that we deem acceptable; ● prevent us from operating all or a portion of our business or force us to redesign our products, services or technology platforms, which could be difficult and expensive and may make the performance or value of our product or service offerings less attractive; 18 ● subject us to significant liability for damages or result in significant settlement payments; and/or ● require us to indemnify our customers. Furthermore, during the course of litigation, confidential information may be disclosed in the form of documents or testimony in connection with discovery requests, depositions or trial testimony. Disclosure of our confidential information and our involvement in intellectual property litigation could materially adversely affect our business. Some of our competitors may be able to sustain the costs of intellectual property litigation more effectively than we can because they have substantially greater resources. In addition, any litigation could significantly harm our relationships with current and prospective customers. Any of the foregoing could disrupt our business and have a material adverse effect on our business, operating results and financial condition. In addition, contentions by a third party such as a vendor or partner that we may pose a threat to their intellectual property can disrupt our ability to work with such party and/or our customers who rely upon that third party’s product or services. Withdrawal of participation by key vendors or partners would cause a disruption of services to our clients and a loss of customers, which could negatively affect our business and financial performance. We may be unable to protect, and we may incur significant costs in enforcing, our intellectual property rights. Our patents, trademarks, trade secrets, copyrights, and other intellectual property rights are important assets to us. Various events outside of our control pose a threat to our intellectual property rights, as well as to our products, services, and technologies. For instance, any of our current or future intellectual property rights may be challenged by others or invalidated through administrative process or litigation. Any of our pending or future patent applications, whether or not being currently challenged, may not be issued with the scope of the claims we seek, if at all. We have taken efforts to protect our proprietary rights, including a combination of license agreements, confidentiality policies and procedures, confidentiality provisions in employment agreements, confidentiality agreements with third parties, and technical security measures, as well as our reliance on copyright, patent, trademark, trade secret and unfair competition laws. These efforts may not be sufficient or effective. For example, the secrecy of our trade secrets or other confidential information could be compromised by our employees or by third parties, which could cause us to lose the competitive advantage resulting from those trade secrets or confidential information. Unauthorized third parties may try to copy or reverse engineer portions of our products or otherwise infringe upon, misappropriate or use our intellectual property. We may not be able to discover or determine the extent of any unauthorized use of our proprietary rights. We may also conclude that, in some instances, the benefits of protecting our intellectual property rights may be outweighed by the expense. In addition, our platforms incorporate “open source” software components that are licensed to us under various public domain licenses. Open source license terms are often ambiguous, and there is little or no legal precedent governing the interpretation of many of the terms of certain of these licenses. Therefore, the potential impact of such terms on our business is somewhat unknown. Further, some enterprises may be reluctant or unwilling to use cloud-based services, because they have concerns regarding the risks associated with the security and reliability, among other things, of the technology delivery model associated with these services. If enterprises do not perceive the benefits of our services, then the market for these services may not expand as much or develop as quickly as we expect, either of which would adversely affect our business, financial condition, or operating results. Legal standards relating to the validity, enforceability and scope of protection of intellectual property rights are uncertain and still evolving. The laws of some foreign countries may not be as protective of intellectual property rights as those in the United States, and effective intellectual property protection may not be available in every country in which our products and services are distributed. Any impairment of our intellectual property rights, or our failure to protect our intellectual property rights adequately, could give our competitors’ access to our technology and could materially and adversely impact our business and operating results. Any increase in the unauthorized use of our intellectual property could also divert the efforts of our technical and management personnel and result in significant additional expense to us, which could materially and adversely impact our operating results. Finally, we may be required to spend significant resources to monitor and protect our intellectual property rights, including with respect to legal proceedings, which could result in substantial costs and diversion of resources and could materially and adversely impact our business, financial condition and operating results. 19 Current and future litigation against us could be costly and time-consuming to defend and could result in additional liabilities. We may from time to time be subject to legal proceedings and claims that arise in the ordinary course of business, such as claims brought by current and former clients in connection with commercial disputes and employment claims made by our current or former employees. Claims may also be asserted by or on behalf of a variety of other parties, including government agencies, patients of our physician clients, stockholders, the sellers of the businesses that we acquire, or the creditors of the businesses we acquire. Any litigation involving us may result in substantial costs and may divert management’s attention and resources, which may seriously harm our business, overall financial condition, and operating results. Insurance may not cover existing or future claims, be sufficient to fully compensate us for one or more of such claims, or continue to be available on terms acceptable to us. A claim brought against us that is uninsured or underinsured could result in unanticipated costs, thereby reducing our operating results and leading analysts or potential investors to reduce their expectations of our performance resulting in a reduction in the trading price of our stock. Our proprietary software or service delivery platform may not operate properly, which could damage our reputation, give rise to claims against us, or divert application of our resources from other purposes, any of which could harm our business and operating results. We may encounter human or technical obstacles that prevent our proprietary or acquired applications from operating properly. If our applications do not function reliably or fail to achieve customer expectations in terms of performance, customers could assert liability claims against us or attempt to cancel their contracts with us. This could damage our reputation and impair our ability to attract or maintain customers. There are particular risks when we inherit technologies through the companies we acquire. These technologies, often developed by distressed companies, were not created under our direct supervision and control and therefore may not have been developed in accordance with our standards. Such acquired technologies could, and at times do, contain operational deficiencies, defects, glitches or bugs that may not be discovered immediately or otherwise could have been avoided had we built the technology ourselves. Whether technology we develop or technology we acquire, we will need to replace certain components and remediate software defects or bugs from time to time. There can be no assurance that such defects or bugs, or the process of remediating them, will not have a material impact on our business. Our inability to promptly and cost-effectively correct a product defect could result in the Company having to withdraw an important product from market, damage to our reputation, and result in material costs and expenses, any of which could have a material impact on our revenue, margins, and operating results. Moreover, information services as complex as those we offer have in the past contained, and may in the future develop or contain, undetected defects or errors. We cannot assure you that material performance problems or defects in our products or services will not arise in the future. Errors may result from receipt, entry, or interpretation of patient information or from interface of our services with legacy systems and data that we did not develop and the function of which is outside of our control. Despite testing, defects or errors may arise in our existing or new software or service processes. Because changes in payer requirements and practices are frequent and sometimes difficult to determine except through trial and error, we are continuously discovering defects and errors in our software and service processes compared against these requirements and practices. These defects and errors and any failure by us to identify and address them could result in loss of revenue or market share, liability to customers or others, failure to achieve market acceptance or expansion, diversion of development resources, injury to our reputation, and increased service and maintenance costs. Defects or errors in our software might discourage existing or potential customers from purchasing our products and services. Correction of defects or errors could prove to be impossible or impracticable. The costs incurred in correcting any defects or errors or in responding to resulting claims or liability may be substantial and could adversely affect our operating results. In addition, customers relying on our services to collect, manage, and report clinical, business, and administrative data may have a greater sensitivity to service errors and security vulnerabilities than customers of software products in general. We market and sell services that, among other things, provide information to assist healthcare providers in tracking and treating patients. Any operational delay in or failure of our technology or service processes may result in the disruption of patient care and could cause harm to patients and thereby create unforeseen liabilities for our business. Our customers or their patients may assert claims against us alleging that they suffered damages due to a defect, error, or other failure of our software or service processes. A product liability claim or errors or omissions claim could subject us to significant legal defense costs and adverse publicity, regardless of the merits or eventual outcome of such a claim. Our physicians have relied on our platforms (including the platform we acquired) as being certified by the Office of the National Coordinator for Health Information Technology (“ONC”). If this certification were to be challenged, we might face liability related to any incentive that the physicians received in reliance upon such certification. 20 If our security measures are breached or fail and unauthorized access is obtained to a customer’s data, our service may not be perceived as secure, the attractiveness of our services to current or potential customers may be reduced, and we may incur significant liabilities. Our services involve the web-based storage and transmission of customers’ proprietary information and patient information, including health, financial, payment and other personal or confidential information. We rely on proprietary and commercially available systems, software, tools and monitoring, as well as other processes, to provide security for processing, transmission and storage of such information. Because of the sensitivity of this information and due to requirements under applicable laws and regulations, the effectiveness of our security efforts is very important. We maintain servers, which store customers’ data, including patient health records, in the U.S. and offshore. We also process, transmit and store some data of our customers on servers and networks that are owned and controlled by third-party contractors in India and elsewhere. Increasingly, threat actors are targeting the healthcare industry with ransomware and other malicious software. If our security measures are breached or fail as a result of third-party action, acts of terror, social unrest, employee error, malfeasance or for any other reasons, someone may be able to obtain unauthorized access to customer or patient data. Improper activities by third parties, advances in computer and software capabilities and encryption technology, new tools and discoveries and other events or developments may facilitate or result in a compromise or breach of our security systems. Our security measures may not be effective in preventing unauthorized access to the customer and patient data stored on our servers. If a breach of our security occurs, we could face damages for contract breach, penalties for violation of applicable laws or regulations, possible lawsuits by individuals affected by the breach and significant remediation costs and efforts to prevent future occurrences. In addition, whether there is an actual or a perceived breach of our security, the market perception of the effectiveness of our security measures could be harmed and we could lose current or potential customers. Our products and services are required to meet the interoperability standards, which could require us to incur substantial additional development costs or result in a decrease in revenue. Our customers and the industry leaders enacting regulatory requirements are concerned with and often require that our products and services be interoperable with other third-party healthcare information technology suppliers. Although our products comply with the latest ONC standards and provide seamless and secure access, use and sharing of electronic health records, market forces or regulatory authorities could create software interoperability standards that would apply to our solutions, and if our products and services are not consistent with those standards, we could be forced to incur substantial additional development costs. There currently exists a comprehensive set of criteria for the functionality, interoperability and security of various software modules in the healthcare information technology industry. However, those standards are subject to continuous modification and refinement. Maintaining compliance with industry interoperability standards and related requirements could result in larger than expected software development expenses and administrative expenses in order to conform to these requirements. These standards and specifications, once finalized, will be subject to interpretation by the entities designated to certify such technology. We will incur increased development costs in delivering solutions if we need to change or enhance our products and services to be in compliance with these varying and evolving standards. If our products and services are not consistent with these evolving standards, our market position and sales could be impaired and we may have to invest significantly in changes to our solutions. Disruptions in internet or telecommunication service or damage to our data centers could adversely affect our business by reducing our customers’ confidence in the reliability of our services and products. Our information technologies and systems are vulnerable to damage or interruption from various causes, including acts of God and other natural disasters, war and acts of terrorism and power losses, computer systems failures, internet and telecommunications or data network failures, operator error, losses of and corruption of data and similar events. Our customers’ data, including patient health records, reside on our own servers located in the U.S., and our Offshore Offices. Although we conduct business continuity planning to protect against fires, floods, other natural disasters and general business interruptions to mitigate the adverse effects of a disruption, relocation or change in operating environment at our data centers, the situations we plan for and the amount of insurance coverage we maintain may not be adequate in any particular case. In addition, the occurrence of any of these events could result in interruptions, delays or cessations in service to our customers. Any of these events could impair or prohibit our ability to provide our services, reduce the attractiveness of our services to current or potential customers and adversely impact our financial condition and results of operations. 21 In addition, despite the implementation of security measures, our infrastructure, data centers, or systems that we interface with or utilize, including the internet and related systems, may be vulnerable to physical break-ins, hackers, improper employee or contractor access, computer viruses, programming errors, denial-of-service attacks or other attacks by third-parties seeking to disrupt operations or misappropriate information or similar physical or electronic breaches of security. Any of these can cause system failure, including network, software or hardware failure, which can result in service disruptions. As a result, we may be required to expend significant capital and other resources to protect against security breaches and hackers or to alleviate problems caused by such breaches. We may be subject to liability for the content we provide to our customers and their patients. We provide content for use by healthcare providers in treating patients. This content includes, among other things, patient education materials, coding and drug databases developed by third parties, and prepopulated templates providers can use to document visits and record patient health information. If content in the third-party databases we use is incorrect or incomplete, adverse consequences, including death, may give rise to product liability and other claims against us. A court or government agency may take the position that our delivery of health information directly, including through licensed practitioners, or delivery of information by a third-party site that a consumer accesses through our solutions, exposes us to personal injury liability, or other liability for wrongful delivery or handling of healthcare services or erroneous health information. Our liability insurance coverage may not be adequate or continue to be available on acceptable terms, if at all. A claim brought against us that is uninsured or under-insured could harm our business. Even unsuccessful claims could result in substantial costs and diversion of management resources. We are subject to the effect of payer and provider conduct that we cannot control and that could damage our reputation with customers and result in liability claims that increase our expenses. We offer electronic claims submission services for which we rely on content from customers, payers, and others. While we have implemented features and safeguards designed to maximize the accuracy and completeness of claims content, these features and safeguards may not be sufficient to prevent inaccurate claims data from being submitted to payers. Should inaccurate claims data be submitted to payers, we may experience poor operational results and be subject to liability claims, which could damage our reputation with customers and result in liability claims that increase our expenses . Failure by our clients to obtain proper permissions and waivers may result in claims against us or may limit or prevent our use of data, which could harm our business. Our clients are obligated by applicable law to provide necessary notices and to obtain necessary permission waivers for use and disclosure of the information that we receive. If they do not obtain necessary permissions and waivers, then our use and disclosure of information that we receive from them or on their behalf may be limited or prohibited by state or federal privacy laws or other laws. This could impair our functions, processes, and databases that reflect, contain, or are based upon such data and may prevent use of such data. In addition, this could interfere with or prevent creation or use of rules, and analyses or limit other data-driven activities that benefit us. Moreover, we may be subject to claims or liability for use or disclosure of information by reason of lack of valid notice, permission, or waiver. These claims or liabilities could subject us to unexpected costs and adversely affect our operating results. Any deficiencies in our financial reporting or internal controls could adversely affect our business and the trading price of our securities. As a public company, we are required to maintain internal control over financial reporting and to report any material weaknesses in such internal controls. Section 404 of the Sarbanes-Oxley Act requires that we evaluate and determine the effectiveness of our internal control over financial reporting. 22 In the future, if we have a material weakness in our internal control over financial reporting, we may not detect errors on a timely basis and our financial statements may be materially misstated. In addition, our internal control over financial reporting would not prevent or detect all errors and fraud. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud will be detected. If there are material weaknesses or failures in our ability to meet any of the requirements related to the maintenance and reporting of our internal controls, investors may lose confidence in the accuracy and completeness of our financial reports, which in turn could cause the price of our common stock and preferred stock to decline. Moreover, effective internal controls are necessary to produce reliable financial reports and to prevent fraud. If we have deficiencies in our internal controls, it may negatively impact our business, results of operations and reputation. In addition, we could become subject to investigations by Nasdaq, the SEC or other regulatory authorities, which could require additional management attention and which could adversely affect our business. In 2021, we identified a material weakness in our internal controls over financial reporting related to a non-routine transaction. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of a company’s annual or interim consolidated financial statements will not be prevented or detected on a timely basis. In 2021, we identified a material weakness in our internal control over financial reporting related to lack of control over the completeness and accuracy of key inputs related to the measurement of a non-routine transaction. We did not properly implement controls over the precision of management’s review of certain key inputs relating to this transaction. We implemented procedures as of March 31, 2022 to remediate this material weakness. In the event we are unable to sufficiently remediate any future material weakness in our internal controls over financial reporting, the accuracy and timing of our financial reporting may be negatively impacted, and as a result we may be unable to maintain compliance with securities laws and investors may lose confidence in the accuracy and completeness of our financial reports, leading to a decline in the market value of our securities. We are a party to several related-party agreements with our founder and Executive Chairman, Mahmud Haq, which have significant contractual obligations. These agreements are reviewed by our Audit Committee on an annual basis. Since inception, we have entered into several related-party transactions with our founder and Executive Chairman, Mahmud Haq, which subject us to significant contractual obligations. We believe these transactions reflect terms comparable to those that would be available from third parties. Our independent audit committee has reviewed these arrangements and continues to do so on an annual basis. We depend on key information systems and third-party service providers. We depend on key information systems to accurately and efficiently transact our business, provide information to management and prepare financial reports. These systems and services are vulnerable to interruptions or other failures resulting from, among other things, natural disasters, terrorist attacks, software, equipment or telecommunications failures, processing errors, computer viruses, other security issues or supplier defaults. Security, backup and disaster recovery measures may not be adequate or implemented properly to avoid such disruptions or failures. Any disruption or failure of these systems or services could cause substantial errors, processing inefficiencies, security breaches, inability to use the systems or process transactions, loss of customers or other business disruptions, all of which could negatively affect our business and financial performance. 23 Systems failures or cyberattacks and resulting interruptions in the availability of or degradation in the performance of our websites, applications, products or services could harm our business. As cybersecurity attacks continue to evolve and increase, our information systems could also be penetrated or compromised by internal and external parties’ intent on extracting confidential information, disrupting business processes or corrupting information. Our systems may experience service interruptions or degradation due to hardware and software defects or malfunctions, computer denial-of-service and other cyberattacks, human error, earthquakes, hurricanes, floods, fires, natural disasters, power losses, disruptions in telecommunications services, fraud, military or political conflicts, terrorist attacks, computer viruses, or other events. Our systems are also subject to break-ins, sabotage and intentional acts of vandalism. Some of our systems are not fully redundant and our disaster recovery planning is not sufficient for all eventualities. We have experienced and will likely continue to experience system failures, denial of service attacks and other events or conditions from time to time that interrupt the availability or reduce the speed or functionality of our websites and mobile applications. These events likely will result in loss of revenue. A prolonged interruption in the availability or reduction in the speed or other functionality of our websites and mobile applications could materially harm our business. Frequent or persistent interruptions in our services could cause current or potential users to believe that our systems are unreliable, leading them to switch to our competitors or to avoid our sites, and could permanently harm our reputation and brands. Moreover, to the extent that any system failure or similar event results in damages to our customers or their businesses, these customers could seek significant compensation from us for their losses and those claims, even if unsuccessful, would likely be time-consuming and costly for us to address. These risks could arise from external parties or from acts or omissions of internal or service provider personnel. Such unauthorized access could disrupt our business and could result in the loss of assets, litigation, remediation costs, damage to our reputation and failure to retain or attract customers following such an event, which could adversely affect our business. Rapid technological change in the telehealth industry presents us with significant risks and challenges . The telehealth market is characterized by rapid technological change, changing consumer requirements, short product lifecycles and evolving industry standards. Our success will depend on our ability to enhance our solution with next-generation technologies and to develop or to acquire and market new services to access new consumer populations. There is no guarantee that we will possess the resources, either financial or personnel, for the research, design and development of new applications or services, or that we will be able to utilize these resources successfully and avoid technological or market obsolescence. Further, there can be no assurance that technological advances by one or more of our competitors or future competitors will not result in our present or future applications and services becoming uncompetitive or obsolete. Our business, financial condition, results of operations and growth may be adversely affected by pandemics, epidemics or other public health emergencies, such as COVID-19. We are subject to risks related to the public health crises such as the global pandemic associated with the coronavirus (COVID-19). Numerous governmental jurisdictions, including the State of New Jersey where we maintain our principal executive offices, and those in which many of our U.S. and international offices are based, have imposed, and others in the future may impose, “shelter-in-place” orders, quarantines, executive orders and similar government orders and restrictions for their residents to control the spread of public health emergencies. Such orders or restrictions, and the perception that such orders or restrictions could occur, could result in business closures, work stoppages, slowdowns and delays, work-from-home policies, travel restrictions and cancellation of events, among other effects, thereby negatively impacting our customers, employees, and offices, among others. Healthcare organizations around the world, including our health care provider customers, faced and may continue to face, substantial challenges in treating patients with COVID-19, such as the diversion of staff and resources from ordinary functions to the treatment of COVID-19, supply, resource and capital shortages and overburdening of staff and resource capacity. To the extent such health-care provider customers experience challenges and difficulties, it will adversely affect our business operation and results of operations. We note, for example, that approximately 53% of our revenue is directly tied to the cash collected by our health-care provider customers, which means that our short-term revenue has and may in the future decline as less patients visit their doctors should periods of social distancing be implemented again in the future. A recession or prolonged economic contraction as a result of health emergencies could also harm the business and results of operations of our enterprise customers, resulting in potential business closures, layoffs of employees and a significant increase in unemployment in the United States and elsewhere. The occurrence of any such events may lead to reduced income for customers and reduced size of workforces, which could reduce our revenue and harm our business, financial condition and results of operations. The widespread COVID-19 pandemic has resulted in, and may continue to result in, significant volatility and uncertainty in U.S. and international financial markets, reducing our ability to access capital, which could in the future negatively affect our liquidity. In addition, a recession or market correction resulting from the spread of COVID-19 could materially affect our business and the value of our common stock and Preferred Stock. Future acquisitions may be subject to difficulties in evaluating potential acquisition targets as a result of the inability to accurately predict the duration or long-term economic and business consequences resulting from the COVID-19 pandemic. 24 The prolonged impact of these public health emergencies, including COVID-19, is highly uncertain and unpredictable, depending upon the severity and duration of the emergency and the effectiveness of actions taken globally to contain or mitigate its effects. Future financial impact cannot be estimated reasonably at this time, but may materially adversely affect our business, results of operations and financial condition. However, we will continue to monitor the COVID-19 situation closely and are committed to continuing to make appropriate changes as and when needed. Risks Related to Our Acquisition Strategy If we do not manage our growth effectively, our revenue, business and operating results may be harmed. Our strategy is to expand through organic growth, and through synergistic, accretive acquisitions of companies in the business of healthcare IT (“HCIT”) and complementary services. Since 2006, we have completed 27 transactions acquiring the assets or businesses of RCM, HCIT, and related companies. The majority of these transactions have occurred since we went public in July 2014. Our future acquisitions may require greater than anticipated investment of operational and financial resources as we seek to migrate customers of these companies to our solutions. Acquisitions also require the integration of different software and services, assimilation of new employees, diversion of management and IT resources, and increases in administrative costs. Acquisitions may also require additional costs associated with any debt or equity financings undertaken to pay for such acquisitions. We cannot assure you that any acquisition we undertake will be successful. Future growth will also place additional demands on our customer support, sales, and marketing resources, and may require us to hire and train additional employees. We will need to expand and upgrade our systems and infrastructure to accommodate our growth. The failure to manage our growth effectively will materially and adversely affect our business. We may be unable to retain customers following their acquisition, which may result in a decrease in our revenues and operating results. Customers of the businesses we acquire often have the right to terminate their service contracts for any reason at any time upon notice of 90 days or less. These customers may elect to terminate their contracts as a result of our acquisition or choose not to renew their contracts upon expiration. Legal and practical limitations on our ability to enforce non-competition and non-solicitation provisions against customer representatives and sales personnel that leave the businesses we acquire to join competitors may result in the loss of customers. In the past, our failure to retain acquired customers has at times resulted in decreases in our revenues. Our inability to retain customers of businesses we acquire could adversely affect our ability to benefit from those acquisitions and to grow our future revenues and operating income. Acquisitions may subject us to liability with regard to the creditors, customers, and shareholders of the sellers. While we attempt to limit our exposure to the liabilities associated with the businesses we acquire, we cannot guarantee that we will be successful in avoiding all material liability. Regardless of how we structure the acquisition, whether as an asset purchase, stock purchase, merger or other business combination, creditors, customers, vendors, governmental agencies and other parties at times seek to hold us accountable for unpaid debts, breach of contract claims, regulatory violations and other liabilities that relate to the business we acquired. Disaffected shareholders of the businesses we acquire have also attempted to interfere with our business acquisitions or brought claims against us. We attempt to minimize all of these risks through thorough due diligence, negotiating indemnities and holdbacks, obtaining relevant representations from sellers, procuring insurance coverage and leveraging experienced professionals when appropriate. We may be unable to implement our strategy of acquiring additional companies. We have no unconditional commitments with respect to any acquisition as of the date of this Form 10-K. Although we expect that one or more acquisition opportunities will become available in the future, we may not be able to acquire additional companies at all or on terms favorable to us. We will likely need additional financing for such acquisitions, but there is no assurance that we will be able to borrow funds or raise capital through the issuance of our equity on favorable terms. Certain of our larger, better capitalized competitors may seek to acquire some of the companies we may be interested in. Competition for acquisitions would likely increase acquisition prices and result in us having fewer acquisition opportunities. 25 Depending on the type of businesses we acquire (e.g., RCM, practice management, EHR, etc.), we may have varying cost saving and/or cross-selling opportunities with the acquired business. However, there is no assurance that we will achieve anticipated cost savings and cross-selling on our acquisitions, and failure to do so may mean we overpaid for such acquisitions. In completing any future acquisitions, we will rely upon the representations, warranties and indemnities made by the sellers with respect to each acquisition as well as our own due diligence investigation. We cannot be assured that such representations and warranties will be true and correct or that our due diligence will uncover all materially adverse facts relating to the operations and financial condition of the acquired companies or their customers. Nor can we be assured that any available insurance will cover all such losses. To the extent that we are required to pay for obligations of an acquired company, or if material misrepresentations exist, we may not realize the expected benefit from such acquisition and we will have overpaid in cash and/or stock for the value received in that acquisition. Future acquisitions may result in potentially dilutive issuances of equity securities, the incurrence of indebtedness and increased amortization expense. Future acquisitions may result in dilutive issuances of equity securities, the incurrence of debt, the assumption of known and unknown liabilities, the write-off of software development costs and the amortization of expenses related to intangible assets, all of which could have an adverse effect on our business, financial condition and results of operations. Regulatory Risks The healthcare industry is heavily regulated. Our failure to comply with regulatory requirements could create liability for us, result in adverse publicity and negatively affect our business. The healthcare industry is heavily regulated and is constantly evolving due to the changing political, legislative, regulatory landscape and other factors. Many healthcare laws are complex, and their application to specific services and relationships may not be clear. In particular, many existing healthcare laws and regulations, when enacted, did not anticipate or address the services that we provide. Further, healthcare laws differ from state to state and it is difficult to ensure that our business, products and services comply with evolving laws in all states. By way of example, certain federal and state laws forbid billing based on referrals between individuals or entities that have various financial, ownership, or other business relationships with healthcare providers. These laws vary widely from state to state, and one of the federal laws governing these relationships, known as the Stark Law, is very complex in its application. Similarly, many states have laws forbidding physicians from practicing medicine in partnership with non-physicians, such as business corporations, as well as laws or regulations forbidding splitting of physician fees with non-physicians or others. Other federal and state laws restrict assignment of claims for reimbursement from government-funded programs, the manner in which business service companies may handle payments for such claims and the methodology under which business services companies may be compensated for such services. The 21 st Century Cures Act (the “Cures Act”), passed by Congress in 2016, is meant to improve various aspects of the healthcare industry, including interoperability and information blocking. The Cures Act’s interoperability provisions relate to Information Exchange and Certification administered by the Office of the National Coordinator for Health Information Technology (the “ONC”). The certification involves complex and specific requirements related to various types of requests for the access, exchange or use of Electronic Health Information. In addition, the information blocking rule aims to resolve concerns that individuals in the healthcare industry intentionally prevent the exchange of information between multiple stakeholders. The Cures Act allows for penalties for stakeholders, including but not limited to, health IT developers and providers who do not comply with same. While we remain committed to efficient exchange of information in the healthcare industry and continue meeting all new certification requirements, failure to comply with these regulatory requirements, could create liability for us, result in adverse publicity and negatively affect our business. The Office of Inspector General (“OIG”) of the Department of Health and Human Services (“HHS”) has a longstanding concern that percentage-based billing arrangements may increase the risk of improper billing practices. In addition, certain states have adopted laws or regulations forbidding splitting of fees with non-physicians which may be interpreted to prevent business service providers, including medical billing providers, from using a percentage-based billing arrangement. The OIG and HHS recommend that medical billing companies develop and implement comprehensive compliance programs to mitigate this risk. While we have developed and implemented a comprehensive billing compliance program that we believe is consistent with these recommendations, our failure to ensure compliance with controlling legal requirements, accurately anticipate the application of these laws and regulations to our business and contracting model, or other failure to comply with regulatory requirements, could create liability for us, result in adverse publicity and negatively affect our business. 26 The federal Anti-Kickback Statute (“AKS”) prohibits us from knowingly and willfully soliciting, receiving, offering or providing remuneration in exchange for referrals or recommendations for purposes of selling products or services which are paid for by federal healthcare programs such as Medicare and Medicaid. In addition, a claim including products or services resulting from a violation of AKS constitutes a violation of the federal False Claims Act (“FCA”). If we are determined to have violated the FCA, we may be required to pay up to three times the actual damages sustained by the government, plus mandatory civil penalties for each separate false claim. If we are found to be in violation of the FCA, AKS, ACA, or any other applicable state or any federal fraud and abuse laws, whether by our current practices or for the past practices of a company we acquire, we may be subject to substantial civil damages and criminal penalties and fines that could have a material adverse impact on our business. In addition, federal and state legislatures and agencies periodically consider proposals to revise aspects of the healthcare industry or to revise or create additional statutory and regulatory requirements. For instance, the current administration may make changes to the ACA, the nature and scope of which are presently unknown. Similarly, certain computer software products are regulated as medical devices under the Federal Food, Drug, and Cosmetic Act. While the Food and Drug Administration (“FDA”) has sometimes chosen to disclaim authority to, or to refrain from actively regulating certain software products which are similar to our products, this area of medical device regulation remains in flux. We expect that the FDA will continue to be active in exploring legal regimes for regulating computer software intended for use in healthcare settings. Any additional regulation can be expected to impose additional overhead costs on us and should we fail to adequately meet these legal obligations, we could face potential regulatory action. Regulatory authorities such as the Centers for Medicare and Medicaid Services may also impose functionality standards with regard to electronic prescribing technologies. If implemented, proposals like these could impact our operations, the use of our services and our ability to market new services, or could create unexpected liabilities for us. We cannot predict what changes to laws or regulations might be made in the future or how those changes could affect our business or our operating costs. Further, our ability to provide our telehealth services in each state is dependent upon a state’s treatment of telehealth and emerging technologies (such as digital health services), which are subject to changing political, regulatory and other influences. Many states have laws that limit or restrict the practice of telehealth, such as laws that require a provider to be licensed and/or physically located in the same state where the patient is located. For example, California, Massachusetts, and Oregon, among others, are not members of the Interstate Medical Licensure Compact, which streamlines the process by which physicians licensed in one state are able to practice in other participating states. Failure to comply with these laws could result in denials of reimbursement for services (to the extent such services are billed), recoupments of prior payments, professional discipline for providers or civil or criminal penalties. If we do not maintain the certification of our EHR solutions pursuant to the HITECH Act and Cures Act, our business, financial condition and results of operations will be adversely affected. The HITECH Act provided financial incentives for healthcare providers that demonstrated “meaningful use” of an EHR and mandated use of health information technology systems that are certified according to technical standards developed under the supervision of the U.S. Department of Health and Human Services (“HHS”). The HITECH Act also imposes certain requirements upon governmental agencies to use, and requires healthcare providers, health plans, and insurers contracting with such agencies to use, systems that are certified according to such standards. The healthcare IT industry continues to experience changes as a result of new laws, regulations, and changes to healthcare industry standards. For instance, the meaningful use incentive program has since expired and has been consolidated, among other incentive programs, within the Merit-based Incentive Payment System (“MIPS”), which was created as part of the Quality Payment Program (“QPP”), launched by CMS after passage of the Medicare Access and CHIP Reauthorization Act (“MACRA”). MACRA and regulations promulgated by it change the way CMS rewards clinicians in the healthcare industry by rewarding value-based care over volume-based care. MIPS requires substantial reporting mechanisms based on clinical quality measures that highly depend on reporting feature within EHR systems. 27 The HITECH and Cures Acts (as described in more detail above) contain certification requirements which affect our business because we have invested and continue to invest in conforming our products and services to these standards. HHS has developed certification programs for electronic health records and health information exchanges. Our web-based EHR solutions have been certified as complete EHR systems by ICSA Labs or Drummond Group, non-governmental, independent certifying bodies. We must ensure that our EHR solutions continue to be certified according to applicable HITECH Act and Cures Act technical standards so that our customers qualify for any MIPS/MACRA incentive payments and are not subject to penalties for non-compliance. Failure to maintain this certification under the HITECH Act and Cures Act could jeopardize our relationships with customers who are relying upon us to provide certified software, and will make our products and services less attractive to customers than the offerings of other EHR vendors who maintain certification of their products. If a breach of our measures protecting personal data covered by HIPAA or the HITECH Act occurs, we may incur significant liabilities. The Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”), and the regulations that have been issued under it contain substantial restrictions and requirements with respect to the use, collection, storage and disclosure of individuals’ protected health information. Under HIPAA, covered entities must establish administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of electronic protected health information maintained or transmitted by them or by others on their behalf. In February 2009, HIPAA was amended by the HITECH Act to add provisions that impose certain of HIPAA’s privacy and security requirements directly upon business associates of covered entities. Under HIPAA and the HITECH Act, our customers are covered entities and we are a business associate of our customers as a result of our contractual obligations to perform certain services for those customers. The HITECH Act transferred enforcement authority of the security rule from CMS to the Office for Civil Rights of HHS, thereby consolidating authority over the privacy and security rules under a single office within HHS. Further, HITECH empowered state attorneys’ general to enforce HIPAA. The HITECH Act heightened enforcement of privacy and security rules, indicating that the imposition of penalties will be more common in the future and such penalties will be more severe. For example, the HITECH Act requires that the HHS fully investigate all complaints if a preliminary investigation of the facts indicates a possible violation due to “willful neglect” and imposes penalties if such neglect is found. Further, where our liability as a business associate to our customers was previously merely contractual in nature, the HITECH Act now treats the breach of duty under an agreement by a business associate to carry the same liability as if the covered entity engaged in the breach. In other words, as a business associate, we are now directly responsible for complying with HIPAA. We may find ourselves subject to increased liability as a possible liable party and we may incur increased costs as we perform our obligations to our customers under our agreements with them. Finally, regulations also require business associates to notify covered entities, who in turn must notify affected individuals and government authorities of data security breaches involving unsecured protected health information. We have performed an assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic health information. In response to this risk analysis, we implemented and maintain physical, technical and administrative safeguards intended to protect all personal data and have processes in place to assist us in complying with applicable laws and regulations regarding the protection of this data and properly responding to any security incidents. If we knowingly breach the HITECH Act’s requirements, we could be exposed to criminal liability. A breach of our safeguards and processes could expose us to civil penalties of up to $1.5 million for each incident and the possibility of civil litigation. If we or our customers fail to comply with federal and state laws governing submission of false or fraudulent claims to government healthcare programs and financial relationships among healthcare providers, we or our customers may be subject to civil and criminal penalties or loss of eligibility to participate in government healthcare programs. As a participant in the healthcare industry, our operations and relationships, and those of our customers, are regulated by a number of federal, state and local governmental entities. The impact of these regulations can adversely affect us even though we may not be directly regulated by specific healthcare laws and regulations. We must ensure that our products and services can be used by our customers in a manner that complies with those laws and regulations. Inability of our customers to do so could affect the marketability of our products and services or our compliance with our customer contracts, or even expose us to direct liability under the theory that we had assisted our customers in a violation of healthcare laws or regulations. A number of federal and state laws, including anti-kickback restrictions and laws prohibiting the submission of false or fraudulent claims, apply to healthcare providers and others that make, offer, seek or receive referrals or payments for products or services that may be paid for through any federal or state healthcare program and, in some instances, any private program. These laws are complex and their application to our specific services and relationships may not be clear and may be applied to our business in ways that we do not anticipate. Federal and state regulatory and law enforcement authorities have recently increased enforcement activities with respect to Medicare and Medicaid fraud and abuse regulations and other healthcare reimbursement laws and rules. From time to time, participants in the healthcare industry receive inquiries or subpoenas to produce documents in connection with government investigations. We could be required to expend significant time and resources to comply with these requests, and the attention of our management team could be diverted by these efforts. The occurrence of any of these events could give our customers the right to terminate our contracts with us and result in significant harm to our business and financial condition. 28 These laws and regulations may change rapidly, and it is frequently unclear how they apply to our business. Any failure of our products or services to comply with these laws and regulations could result in substantial civil or criminal liability and could, among other things, adversely affect demand for our services, invalidate all or portions of some of our contracts with our customers, require us to change or terminate some portions of our business, require us to refund portions of our revenue, cause us to be disqualified from serving customers doing business with government payers, and give our customers the right to terminate our contracts with them, any one of which could have an adverse effect on our business. Potential healthcare reform and new regulatory requirements placed on our products and services could increase our costs, delay or prevent our introduction of new products or services, and impair the function or value of our existing products and services. Our products and services may be significantly impacted by healthcare reform initiatives and will be subject to increasing regulatory requirements, either of which could negatively impact our business in a multitude of ways. If substantive healthcare reform or applicable regulatory requirements are adopted, we may have to change or adapt our products and services to comply. Reform or changing regulatory requirements may also render our products or services obsolete or may block us from accomplishing our work or from developing new products or services. This may in turn impose additional costs upon us to adapt to the new operating environment or to further develop or modify our products and services. Such reforms may also make introduction of new products and service costlier or more time-consuming than we currently anticipate. These changes may also prevent our introduction of new products and services or make the continuation or maintenance of our existing products and services unprofitable or impossible. Additional regulation of the disclosure of medical information outside the United States may adversely affect our operations and may increase our costs. Federal or state governmental authorities may impose additional data security standards or additional privacy or other restrictions on the collection, use, transmission, and other disclosures of medical information. Legislation has been proposed at various times at both the federal and the state level that would limit, forbid, or regulate the use or transmission of medical information outside of the United States. Such legislation, if adopted, may render our use of our servers in Offshore Offices for work related to such data impracticable or substantially more expensive. Alternative processing of such information within the United States may involve substantial delay in implementation and increased cost. Our services present the potential for embezzlement, identity theft, or other similar illegal behavior by our employees. Among other things, our services from time to time involve handling mail from payers and payments from patients for our customers, and this mail frequently includes original checks and credit card information and occasionally includes currency. Where requested, we deposit payments and process credit card transactions from patients on behalf of customers and then forward these payments to the customers. Even in those cases in which we do not handle original documents or mail, our services also involve the use and disclosure of personal and business information that could be used to impersonate third parties or otherwise gain access to their data or funds. The manner in which we store and use certain financial information is governed by various federal and state laws. If any of our employees takes, converts, or misuses such funds, documents, or data, we could be liable for damages, subject to regulatory actions and penalties, and our business reputation could be damaged or destroyed. In addition, we could be perceived to have facilitated or participated in illegal misappropriation of funds, documents, or data and therefore be subject to civil or criminal liability. 29 Risks Related to Ownership of Shares of Our Common Stock Our revenues, operating results and cash flows may fluctuate in future periods and we may fail to meet investor expectations, which may cause the price of our common stock to decline. Variations in our quarterly and year-end operating results are difficult to predict and may fluctuate significantly from period to period. If our sales or operating results fall below the expectations of investors or securities analysts, the price of our common stock could decline substantially. Specific factors that may cause fluctuations in our operating results include: ● demand and pricing for our products and services; ● the encounter volumes of our customer base; ● government or commercial healthcare reimbursement policies; ● physician and patient acceptance of any of our current or future products; ● introduction of competing products; ● our operating expenses which fluctuate due to growth of our business; ● timing and size of any new product or technology acquisitions we may complete; and ● variable sales cycle and implementation periods for our products and services. Future sales of shares of our common stock could depress the market price of our common stock. Sales of a substantial number of shares of our common stock in the public market could occur at any time. If our stockholders sell, or the market perceives that our stockholders intend to sell substantial amounts of our common stock in the public market, the market price of our common stock could decline significantly. Mahmud Haq currently controls 29.5% of our outstanding shares of common stock, which will prevent investors from influencing significant corporate decisions. Mahmud Haq, our founder and Executive Chairman, beneficially owns 29.5% of our outstanding shares of common stock. As a result, Mr. Haq exercises a significant level of control over all matters requiring stockholder approval, including the election of directors, amendment of our certificate of incorporation, and approval of significant corporate transactions. This control could have the effect of delaying or preventing a change of control of our company or changes in management, and will make the approval of certain transactions difficult or impossible without his support, which in turn could reduce the price of our common stock. Provisions of Delaware law, of our amended and restated charter and amended and restated bylaws may make a takeover more difficult, which could cause our common stock price to decline. Provisions in our amended and restated certificate of incorporation and amended and restated bylaws and in the Delaware General Corporation Law (“DGCL”) may make it difficult and expensive for a third party to pursue a tender offer, change in control or takeover attempt, which is opposed by management and the Board of Directors. Public stockholders who might desire to participate in such a transaction may not have an opportunity to do so. We have a staggered Board of Directors that makes it difficult for stockholders to change the composition of the Board of Directors in any one year. Further, our amended and restated certificate of incorporation provides for the removal of a director only for cause upon the affirmative vote of the holders of at least 50.1% of the outstanding shares entitled to cast their vote for the election of directors, which may discourage a third party from making a tender offer or otherwise attempting to obtain control of us. These and other anti-takeover provisions could substantially impede the ability of public stockholders to change our management and Board of Directors. Such provisions may also limit the price that investors might be willing to pay for shares of our Preferred Stock in the future. Any issuance of additional preferred stock in the future may dilute the rights of our existing stockholders. Our Board of Directors has the authority to issue up to 7,000,000 shares of preferred stock and to determine the price, privileges and other terms of these shares, of which 4,526,231 shares of Series A Preferred Stock and 1,344,128 of Series B Preferred Stock have been issued as of December 31, 2022. Our Board of Directors may exercise its authority with respect to the remaining shares of preferred stock without any further approval of common stockholders. The rights of the holders of common stock may be adversely affected by the rights of future holders of preferred stock. 30 We do not intend to pay cash dividends on our common stock. Currently, we do not anticipate paying any cash dividends to holders of our common stock. As a result, capital appreciation, if any, of our common stock will be a stockholder’s sole source of gain. Complying with the laws and regulations affecting public companies will increase our costs and the demands on management and could harm our operating results. As a public company, the Sarbanes-Oxley Act requires, among other things, that we assess the effectiveness of our internal control over financial reporting annually and the effectiveness of our disclosure controls and procedures quarterly. As a “smaller reporting company” prior to 2021, we elected to avail ourselves of the exemption from the requirement that our independent registered public accounting firm attest to the effectiveness of our internal control over financial reporting under Section 404 of the Sarbanes-Oxley Act. For the year 2021, we were subject to such requirement, but were not required to have this attestation performed for the year 2022. In future years if we are required to have our independent registered public accounting firm attest the effectiveness of our internal control over financial reporting, the cost of our compliance with Section 404 will correspondingly increase. Our compliance with applicable provisions of Section 404 requires that we incur substantial accounting expense and expend significant management time on compliance-related issues and stay in compliance with reporting requirements. Moreover, if we are not able to stay in compliance with the requirements of Section 404 applicable to us in a timely manner, or if we or our independent registered public accounting firm identifies any deficiencies in our internal control over financial reporting that are deemed to be material weaknesses, the market price of our stock could decline and we could be subject to sanctions or investigations by the SEC or other regulatory authorities, which would require additional financial and management resources. Furthermore, investor perceptions of our Company may suffer if deficiencies are found, and this could cause a decline in the market price of our common and preferred stock. Irrespective of compliance with Section 404, any failure of our internal control over financial reporting could have a material adverse effect on our stated operating results and harm our reputation. If we are unable to implement these changes effectively or efficiently, it could harm our operations, financial reporting, or financial results and could result in an adverse opinion on internal control from our independent registered public accounting firm. We are a smaller reporting company and we cannot be certain if the reduced disclosure requirements applicable to smaller reporting companies will make our common stock less attractive to investors. There are many exemptions available to smaller reporting companies like us that have less than $250 million of worldwide common equity held by non-affiliates. The disclosures we will be required to provide in our SEC filings are still less than they would be if we were not considered a smaller reporting company. Specifically, smaller reporting companies are able to provide simplified executive compensation disclosures in their fillings and have certain other decreased disclosure obligations in their SEC filings. Our status as a smaller reporting company may make it harder for investors to analyze our results of operations and financial prospects. We cannot predict if investors will find our common stock less attractive because we will rely on the exemption available to smaller reporting companies. If some investors find our common stock less attractive as a result, there may be a less active trading market for our common stock and our stock price may be more volatile. New climate disclosure rules, if adopted by the SEC, may increase our costs and litigation risks, which could materially and adversely affect our future results of operations and financial condition. During 2022, the SEC proposed new climate disclosure rules, which, if adopted, would require new climate-related disclosure in SEC filings, including certain climate-related metrics and greenhouse gas emissions data, information about climate-related targets and goals, transition plans, if any, and extensive attestation requirements. In addition to requiring public companies to quantify and disclose direct emissions data, the new rules also would require disclosure of climate impact arising from the operations and uses by the company’s business partners and contractors and end-users of the company’s products and/or services. We are currently assessing the impact of the new rules, if adopted as proposed, but at this time, we cannot predict the costs of implementation or any potential adverse impacts resulting from the new rules if adopted. However, we may incur increased costs relating to the assessment and disclosure of climate-related risks and increased litigation risks related to disclosures made pursuant to the new rules, either of which could materially and adversely affect our future results of operations and financial condition. 31 Risks Related to Ownership of Shares of Our Preferred Stock Our Series A and Series B Preferred Stock ranks junior to all of our indebtedness and other liabilities. Our Series A Preferred Stock ranks pari passu to our Series B Preferred Stock with respect to the distribution of assets upon our liquidation, dissolution or winding-up of our affairs. In the event of our bankruptcy, liquidation, dissolution or winding-up of our affairs, our assets will be available to pay obligations on the Preferred Stock only after all of our indebtedness and other liabilities have been paid. The rights of holders of the Preferred Stock to participate in the distribution of our assets will rank junior to the prior claims of our current and future creditors and any future series or class of preferred stock we may issue that ranks senior to the Preferred Stock. Also, the Preferred Stock effectively ranks junior to all existing and future indebtedness and to the indebtedness and other liabilities of our existing subsidiaries and any future subsidiaries. Our existing subsidiaries are, and future subsidiaries would be, separate legal entities and have no legal obligation to pay any amounts to us in respect of dividends due on the Preferred Stock. If we are forced to liquidate our assets to pay our creditors, we may not have sufficient assets to pay amounts due on any or all of the Preferred Stock then outstanding. We may in the future incur debt and other obligations that will rank senior to the Preferred Stock. At December 31, 2022, our total liabilities (excluding contingent consideration) equaled approximately $34.5 million . Certain of our existing or future debt instruments may restrict the authorization, payment or setting apart of dividends on the Preferred Stock. Our Credit Agreement with Silicon Valley Bank (“SVB”) restricts the payment of dividends in the event of any event of default, including failure to meet certain financial covenants. There can be no assurance that we will remain in compliance with the SVB Credit Agreement, and if we default, we may be contractually prohibited from paying dividends on the Preferred Stock. Also, future offerings of debt or senior equity securities may adversely affect the market price of the Preferred Stock. If we decide to issue debt or senior equity securities in the future, it is possible that these securities will be governed by an indenture or other instruments containing covenants restricting our operating flexibility. Additionally, any convertible or exchangeable securities that we issue in the future may have rights, preferences and privileges more favorable than those of the Preferred Stock and may result in dilution to owners of the Preferred Stock. We and, indirectly, our shareholders, will bear the cost of issuing and servicing such securities. Because our decision to issue debt or equity securities in any future offering will depend on market conditions and other factors beyond our control, we cannot predict or estimate the amount, timing or nature of our future offerings. The holders of the Preferred Stock will bear the risk of our future offerings, which may reduce the market price of the Preferred Stock and will dilute the value of their holdings. We may not be able to pay dividends on the Preferred Stock if we fall out of compliance with our loan covenants and are prohibited by our bank lender from paying dividends or if we have insufficient cash to make dividend payments. Our ability to pay cash dividends on the Preferred Stock requires us to have either net profits or positive net assets (total assets less total liabilities), and to be able to pay our debts as they become due in the usual course of business. We cannot predict with certainty whether we will remain in compliance with the covenants of our senior secured lender, SVB, which include, among other things, generating adjusted EBITDA or complying with a minimum liquidity ratio at times when we are utilizing our line of credit. If we fall out of compliance, our lender may exercise any of its rights and remedies under the loan agreement, including restricting us from making dividend payments. Further, notwithstanding these factors, we may not have sufficient cash to pay dividends on the Preferred Stock. Our ability to pay dividends may be impaired if any of the risks described in this document, including the documents incorporated by reference herein, were to occur. Also, payment of our dividends depends upon our financial condition, remaining in compliance with our affirmative and negative loan covenants with SVB, which we may be unable to do in the future, and other factors as our Board of Directors may deem relevant from time to time. We cannot assure you that our businesses will generate sufficient cash flow from operations or that future borrowings will be available to us in an amount sufficient to enable us to make distributions on our common stock, if any, and preferred stock, including the Preferred Stock to pay our indebtedness or to fund our other liquidity needs. 32 We may issue additional shares of Preferred Stock and additional series of preferred stock that rank on parity with the Preferred Stock as to dividend rights, rights upon liquidation or voting rights. We are allowed to issue additional shares of Preferred Stock and additional series of preferred stock that would rank equal to or below the Preferred Stock as to dividend payments and rights upon our liquidation, dissolution or winding up of our affairs pursuant to our amended and restated certificate of incorporation and the certificate of designations relating to the Preferred Stock without any vote of the holders of the Preferred Stock. Upon the affirmative vote of the holders of at least two-thirds of the outstanding shares of Preferred Stock (voting together as a class with all other series of parity preferred stock we may issue upon which like voting rights have been conferred and are exercisable), we are allowed to issue additional series of preferred stock that would rank above the Preferred Stock as to dividend payments and rights upon our liquidation, dissolution or the winding up of our affairs pursuant to our amended and restated certificate of incorporation and the certificate of designations relating to the Preferred Stock. The issuance of additional shares of Preferred Stock and additional series of preferred stock could have the effect of reducing the amounts available to the Preferred Stock upon our liquidation or dissolution or the winding up of our affairs. It also may reduce dividend payments on the Preferred Stock if we do not have sufficient funds to pay dividends on all Preferred Stock outstanding and other classes or series of stock with equal priority with respect to dividends. Also, although holders of Preferred Stock are entitled to limited voting rights with respect to the circumstances under which the holders of Preferred Stock are entitled to vote, the Preferred Stock votes separately as a class along with all other series of our preferred stock that we may issue upon which like voting rights have been conferred and are exercisable. As a result, the voting rights of holders of Preferred Stock may be significantly diluted, and the holders of such other series of preferred stock that we may issue may be able to control or significantly influence the outcome of any vote. Future issuances and sales of senior or pari passu preferred stock, or the perception that such issuances and sales could occur, may cause prevailing market prices for the Preferred Stock and our common stock to decline and may adversely affect our ability to raise additional capital in the financial markets at times and prices favorable to us. Market interest rates may materially and adversely affect the value of the Preferred Stock. One of the factors that influences the price of the Preferred Stock is the dividend yield on the Preferred Stock (as a percentage of the market price of each class of the Preferred Stock) relative to market interest rates. An increase in market interest rates may lead prospective purchasers of the Preferred Stock to expect a higher dividend yield (and higher interest rates would likely increase our borrowing costs and potentially decrease funds available for dividend payments). Thus, higher market interest rates could cause the market price of the Preferred Stock to materially decrease. Holders of the Preferred Stock may be unable to use the dividends-received deduction and may not be eligible for the preferential tax rates applicable to “qualified dividend income”. Distributions paid to corporate U.S. holders of the Preferred Stock may be eligible for the dividends-received deduction, and distributions paid to non-corporate U.S. holders of the Preferred Stock may be subject to tax at the preferential tax rates applicable to “qualified dividend income,” if we have current or accumulated earnings and profits, as determined for U.S. federal income tax purposes. We do not currently have such accumulated earnings and profits. Additionally, we may not have sufficient current earnings and profits during future fiscal years for the distributions on the Preferred Stock to qualify as dividends for U.S. federal income tax purposes. If the distributions fail to qualify as dividends, U.S. holders would be unable to use the dividends-received deduction and may not be eligible for the preferential tax rates applicable to “qualified dividend income.” If any distributions on the Preferred Stock with respect to any fiscal year are not eligible for the dividends-received deduction or preferential tax rates applicable to “qualified dividend income” because of insufficient current or accumulated earnings and profits, it is possible that the market value of the Preferred Stock might decline. Our Preferred Stock has not been rated. We have not sought to obtain a rating for the Preferred Stock. No assurance can be given, however, that one or more rating agencies might not independently determine to issue such a rating or that such a rating, if issued, would not adversely affect the market price of the Preferred Stock. Also, we may elect in the future to obtain a rating for the Preferred Stock, which could adversely affect the market price of the Preferred Stock. Ratings only reflect the views of the rating agency or agencies issuing the ratings and such ratings could be revised downward, placed on a watch list or withdrawn entirely at the discretion of the issuing rating agency if in its judgment circumstances so warrant. Any such downward revision, placing on a watch list or withdrawal of a rating could have an adverse effect on the market price of the Preferred Stock. 33 We may redeem the Series A Preferred Stock at any time and may redeem the Series B Preferred Stock after February 15, 2024. Since November 4, 2020, we may, at our option, redeem the Series A Preferred Stock, in whole or in part, at any time or from time to time. On March 18, 2022, we redeemed 800,000 shares of the Series A Preferred Stock in accordance with our amended and restated certificate of designations for the Series A Preferred Stock. Starting February 15, 2024, we may, at our option, redeem the Series B Preferred Stock, in whole or in part, at any time or from time to time, paying a small premium if we choose to redeem any Series B Preferred Stock prior to February 15, 2027. Also, upon the occurrence of a change of control, we may, at our option, redeem the Preferred Stock, in whole or in part, within 120 days after the first date on which such change of control occurred. We may have an incentive to redeem the Preferred Stock voluntarily if market conditions allow us to issue other preferred stock or debt securities at a rate that is lower than the dividend on the Preferred Stock. If we redeem the Preferred Stock, then from and after the redemption date, dividends will cease to accrue on shares of Preferred Stock, the shares of Preferred Stock shall no longer be deemed outstanding and all rights as a holder of those shares will terminate, except the right to receive the redemption price plus accumulated and unpaid dividends, if any, payable upon redemption. The Company also intends to allow holders of the Series A Preferred Stock in the future to exchange their shares of the Series A Preferred Stock into an equivalent number of shares of the Series B Preferred Stock. The market price of our Preferred Stock is variable and could be substantially affected by various factors. The market price of our Preferred Stock could be subject to wide fluctuations in response to numerous factors. These factors include, but are not limited to, the following: ● prevailing interest rates, increases in which may have an adverse effect on the market price of the Preferred Stock; ● trading prices of similar securities; ● our history of timely dividend payments; ● the annual yield from dividends on the Preferred Stock as compared to yields on other financial instruments; ● general economic and financial market conditions; ● government action or regulation; ● our financial condition, performance and prospects of our competitors; ● changes in financial estimates or recommendations by securities analysts with respect to us or our competitors in our industry; ● our issuance of additional preferred equity or debt securities; and ● actual or anticipated variations in quarterly operating results of us and our competitors. A holder of Preferred Stock has extremely limited voting rights. The voting rights for a holder of Preferred Stock are limited. Our shares of common stock are the only class of our securities that carry full voting rights, and Mahmud Haq, our Executive Chairman, beneficially owns approximately 29.5% of our outstanding shares of common stock. As a result, Mr. Haq exercises a significant level of control over all matters requiring stockholder approval, including the election of directors, amendment of our certificate of incorporation, and approval of significant corporate transactions. This control could have the effect of delaying or preventing a change of control of our Company or changes in management, and will make the approval of certain transactions difficult or impossible without his support, which in turn could reduce the price of our Preferred Stock. Voting rights for holders of the Preferred Stock exist primarily with respect to the ability to elect, voting together with the holders of any other series of our preferred stock having similar voting rights, two additional directors to our Board of Directors, subject to limitations, in the event that eighteen monthly dividends (whether or not consecutive) payable on the Preferred Stock are in arrears, and with respect to voting on amendments to our articles of incorporation or articles of amendment relating to the Preferred Stock that materially and adversely affect the rights of the holders of Preferred Stock or authorize, increase or create additional classes or series of our capital stock that are senior to the Preferred Stock. Other than the limited circumstances and except to the extent required by law, holders of Preferred Stock do not have any voting rights. 34 The Preferred Stock is not convertible, and investors will not realize a corresponding upside if the price of the common stock increases. The Preferred Stock is not convertible into the common stock and earns dividends at a fixed rate. Accordingly, an increase in market price of our common stock will not necessarily result in an increase in the market price of our Preferred Stock. The market value of the Preferred Stock may depend more on dividend and interest rates for other preferred stock, commercial paper and other investment alternatives and our actual and perceived ability to pay dividends on, and in the event of dissolution satisfy the liquidation preference with respect to, the Preferred Stock. Item 1B. Unresolved Staff Comments None.