HEALTHEQUITY, INC. 10-K

Item 1. Business Company overview We are a leader and an innovator in providing technology-enabled services that empower consumers to make healthcare saving and spending decisions. We use our innovative technology to manage consumers' tax-advantaged health savings accounts (“HSAs”) and other consumer-directed benefits (“CDBs”) offered by employers, including flexible spending accounts and health reimbursement arrangements (“FSAs” and “HRAs”), and to administer Consolidated Omnibus Budget Reconciliation Act (“COBRA”), commuter and other benefits. As part of our services, we and our subsidiaries provide consumers with healthcare bill evaluation and payment processing services, personalized benefit information, including information on treatment options and comparative pricing, access to remote and telemedicine benefits, the ability to earn wellness incentives, and investment advice to grow their tax-advantaged healthcare savings. We believe the shift to greater consumer responsibility for healthcare costs will require a significant portion of consumers under the age of 65 with private health insurance in the United States to use offerings such as ours. The core of our offerings is the HSA, a financial account through which consumers spend and save long-term for healthcare expenses on a tax-advantaged basis. As of January 31, 2022, we administered 7.2 million HSAs, with balances totaling $19.6 billion, which we call HSA Assets, as well as 7.2 million complementary CDBs. We refer to the aggregate number of HSAs and other CDBs that we administer as Total Accounts, of which we had 14.4 million as of January 31, 2022. We reach consumers primarily through relationships with their employers, which we call Clients. We reach Clients primarily through relationships with benefits brokers and advisors, integrated partnerships with a network of health plans, benefits administrators, benefits brokers and consultants, and retirement plan recordkeepers, which we call Network Partners, and a sales force that calls on Clients directly. As of January 31, 2022, our platforms were integrated with 185 Network Partners, and we serve approximately 120,000 Clients. We have increased our share of the growing HSA market from 4% in December 2010 to 18% as of December 2021, measured by HSA Assets. According to Devenir, we are the largest HSA provider by accounts and second largest by assets as of December 2021. In addition, we believe we are the largest provider of other CDBs. We seek to differentiate ourselves through our proprietary technology, product breadth, ecosystem connectivity, and service-driven culture. Our proprietary technology allows us to help consumers optimize the value of their HSAs and other CDBs and gain confidence and skills in managing their healthcare costs as part of their financial security. Our ability to assist consumers is enhanced by our capacity to securely share data in both directions with others in the health, benefits, and retirement ecosystems. Our commuter benefits offering also leverages connectivity to an ecosystem of mass transit, ride hailing, and parking providers. These strengths reflect our “DEEP Purple” culture of remarkable service to customers and teammates, achieved by driving excellence, ethics, and process into everything we do. Our business model provides strong visibility into our future operating performance, with the vast majority of our accounts opened before the start of our fiscal year. We earn revenue primarily from three sources: service, custodial, and interchange. We earn service revenue mainly from fees paid by Clients on a recurring per-account per-month basis. We earn custodial revenue mainly from HSA Assets held at our members’ direction in federally insured cash deposits, insurance contracts or mutual funds, and from investment of Client-held funds. We earn interchange revenue mainly from fees paid by merchants on payments that our members make using our physical payment cards and on our virtual payment system. See “Key components of our results of operations” for additional information on our sources of revenue, including the adverse impacts caused by the ongoing COVID-19 pandemic. Recent acquisitions WageWorks acquisition. On August 30, 2019, we completed our acquisition of WageWorks, Inc. (the "WageWorks Acquisition") and paid approximately $2.0 billion in cash to WageWorks stockholders, financed through net borrowings of approximately $1.22 billion under our prior term loan facility and approximately $816.9 million of cash on hand. The key strategy of the WageWorks Acquisition was to enable us to increase the number of our employer sales opportunities, the conversion of these opportunities to Clients, and the value of Clients in generating members, HSA Assets and complementary CDBs. WageWorks’ historic strength of selling to employers directly and through health -2- Table of Contents benefits brokers and advisors complemented our distribution through Network Partners. With WageWorks’ CDB capabilities, we provide employers with a single partner for both HSAs and other CDBs, which is preferred by the vast majority of employers according to research conducted for us by Aite Group. For Clients that partner with us in this way, we believe we can produce more value by encouraging both CDB participants to contribute to HSAs and HSA-only members to take advantage of tax savings available through other CDBs. As of January 31, 2022, we had substantially completed our multi-year integration effort and achieved approximately $80 million in annualized ongoing net synergies. We anticipate generating additional revenue synergies over the longer-term as our combined distribution channels and existing client base take advantage of the broader service offerings and as we continue to drive member engagement. Luum acquisition. In March 2021, we bolstered our commuter offering by acquiring 100% of the outstanding capital stock of Fort Effect Corp, d/b/a Luum (the "Luum Acquisition"). The aggregate purchase price for the acquisition consisted of $56.2 million in cash. Luum provides employers with various commuter services, including access to real-time commute data, to help them design and implement flexible return-to-office and hybrid-workplace strategies and benefits. Fifth Third Bank HSA portfolio acquisition. On April 27, 2021, we signed an agreement to acquire the Fifth Third Bank, National Association ("Fifth Third") HSA portfolio, which consisted of $490.0 million of HSA Assets held in approximately 160,000 HSAs in exchange for a purchase price of $60.8 million in cash. This acquisition closed on September 29, 2021. Further acquisition. On September 7, 2021, we signed an amended agreement to acquire the Further business (other than Further's voluntary employee beneficiary association business), a leading provider of HSA and other CDB administration services, with approximately 580,000 HSAs and $1.9 billion of HSA Assets, for $455 million in cash (the "Further Acquisition"). This acquisition closed on November 1, 2021. HealthSavings HSA portfolio acquisition. On December 4, 2021, we signed an agreement to acquire the Health Savings Administrators, L.L.C. (“HealthSavings”) HSA portfolio, which consisted of $1.3 billion of HSA Assets held in approximately 87,000 HSAs in exchange for a purchase price of $60 million in cash. This acquisition closed on March 2, 2022. Our products and services Technology platforms. We offer multiple cloud-based platforms, accessed by our members online via a desktop or mobile device, through which individuals can make health saving and spending decisions, pay healthcare bills, compare treatment options and prices, receive personalized benefit and clinical information, earn wellness incentives, grow their savings and make investment choices. The platforms provide users with access to services we provide as well as services provided by third parties selected by us or by our Network Partners. Among other features, our HSA platform includes the capability to present to users medical bills upon adjudication by a health plan, including details such as the amount paid by insurance, specific nature of the medical service provided, and diagnostic code. Users of our HSA platform can pay these bills from an account of ours or from any bank account, online, via a mobile device, or using our payment card. All users of our HSA platform gain access to our healthcare consumer specialists, available every hour of every day, via a toll-free telephone number or email. Our specialists can assist users with such tasks as optimizing the use of tax-advantaged accounts to reduce medical spending or selecting from among medical plans offered by an employer or health plan. We acquired several other technology platforms as part of the WageWorks Acquisition. These additional technology platforms are designed to be highly scalable based on an on-demand delivery model that Clients and members may access through a standard web browser on any internet-enabled device, including computers, smart phones, and other mobile devices such as tablet computers. Our on-demand delivery model for these platforms eliminates the need for our Clients to install and maintain hardware and software in order to support CDB programs and enables us to rapidly implement product enhancements across our entire user base. We acquired an additional technology platform as part of the Luum Acquisition, which provides Clients with various commuter services, including access to real-time commute data, to help Clients design and implement flexible return-to-office and hybrid-workplace strategies and benefits. We are working to phase out certain technology platforms that we acquired in the WageWorks Acquisition, which requires us to migrate certain Clients to one of our remaining technology platforms. We expect to complete these migrations during the fiscal year ending January 31, 2023. Health savings accounts. The Medicare Modernization Act of 2003 created HSAs, a tax-exempt trust or custodial account managed by a custodian that is a bank, an insurance company, or a non-bank custodian -3- Table of Contents specifically authorized by the Internal Revenue Service, or IRS, as meeting certain ownership, capitalization, expertise, and governance requirements. We are an IRS-approved non-bank custodian of our members' HSAs, designated to serve as both a passive and non-passive non-bank custodian of HSAs. To be eligible to contribute to an HSA, an individual must be covered under a high deductible healthcare plan, or HDHP, have no additional health coverage, not be enrolled in Medicare, and not be claimed as a dependent on someone else’s tax return. HSAs have several tax-advantaged benefits, which we call the "triple tax savings": (1) individuals can claim a tax deduction for contributions they make to their HSAs, and contributions that their employers make to their HSAs may be excluded from their gross income for purposes of federal and most state income and employment tax; (2) the interest or earnings on the assets in the account, including reinvestment, accumulate without being subject to tax; and (3) distributions may be tax free if they are used to pay qualified medical expenses. There is no requirement to provide receipts to us to substantiate HSA distributions to members, whether made through our payment card or directly from our online HSA platform. Additionally, taxable distributions other than for qualified medical expenses are permitted without penalty (although subject to income tax) after age 65. Balances remain in the account until used, i.e. , there is no “use or lose” requirement. An HSA is owned by the account holder; it remains the account holder’s property upon a change of employment, health plan or retirement. Investment platform and advisory services. We offer a mutual fund investment platform and access to an online-only automated investment advisory service to all of our members whose account balances exceed a stated threshold. These services are entirely elective to the member. The advisory service is delivered through a web-based tool, Advisor, which is offered and managed by HealthEquity Advisors, LLC, our SEC-registered investment adviser subsidiary. HealthEquity Advisors, LLC provides investment advice to its clients exclusively through the Advisor tool on an interactive website. Members who utilize our mutual fund investment platform or subscribe for Advisor services pay asset-based fees, which include the cost of the advisory service and all other expenses associated with transactions made through these online tools. Advisor provides investment education guidance and management, including maintaining HSA cash (liquidity) in amounts directed by the member, targeting risk appropriate portfolio diversification, and mutual fund selection. We offer investors access to three levels of service: • Self-driven: For members who do not subscribe for Advisor, we provide a mutual fund investment platform to invest HSA balances. Neither we nor Advisor provides advice to members in respect of investments among funds on the platform; • GPS powered by HealthEquity Advisors, LLC: Advisor provides guidance and advice, but the member makes the final investment decisions and implements portfolio allocation and investment advice through the HealthEquity platform; and • AutoPilot powered by HealthEquity Advisors, LLC: Advisor manages the account and implements portfolio allocation and investment advice automatically for the member. Regardless of the level of service selected, members are responsible for their proportionate share of fees and expenses payable by the underlying mutual funds and other investment vehicles in which they invest. Healthcare flexible spending accounts. Healthcare FSAs are employer-sponsored CDBs that enable employees to set aside pre-tax dollars to pay for eligible healthcare expenses that are not generally covered by insurance, such as co-pays, deductibles and over-the-counter medical products, as well as vision expenses, orthodontia, and medical devices. Healthcare FSAs can be customized by employers so they have the freedom to determine what eligible expenses may be reimbursed under these arrangements. Our employer Clients also realize payroll tax (i.e., FICA and Medicare) savings on the pre-tax contributions made by their employees. The IRS imposes a limit, indexed to inflation, on pre-tax dollar employee contributions made to healthcare FSAs. The IRS also allows a carryover of up to 20% of the indexed contribution limit that does not count against or otherwise affect the indexed salary reduction limit applicable to each plan year. Employers are able to contribute additional amounts in excess of this statutory limit and may choose to do so in an effort to mitigate the impact of rising healthcare costs on their employees. Dependent care flexible spending accounts. We also administer FSA programs for dependent care plans. These plans allow employees to set aside pre-tax dollars to pay for eligible dependent care expenses, which typically include child care or day care expenses but may also include expenses incurred from adult and elder care. Current laws and regulations impose a statutory limit on the amount of pre-tax dollars employees can contribute to dependent care FSAs with no carryover allowed. Like healthcare FSAs, employers can also contribute funds to employees’ dependent care FSAs; however, these are subject to the statutory annual limit on total contributions. As -4- Table of Contents with healthcare FSAs, employers realize payroll tax savings on the pre-tax dependent care FSA contributions made by their employees. HealthEquity administers the United States Office of Personnel Management's (“OPM”) Federal Flexible Spending Account Program (“FSAFEDS”). This relationship provides eligible federal government employees access to our advanced technology platforms and premium service capabilities. Health reimbursement arrangements. Under HRAs, employers provide their employees with a specified amount of reimbursement funds that are available to help employees defray their out-of-pocket healthcare expenses, such as deductibles, co-insurance and co-payments. HRAs may only be funded by employers and there is no limitation on how much employers may contribute; however, similar to other CDBs that are funded with pre-tax dollars, employers are required to establish the programs in such a way as to prevent discrimination in favor of highly compensated employees. HRAs must either be considered an excepted benefit (for example, a dental-only HRA or a vision-only HRA), a retiree HRA or be integrated with another group health plan. HRAs can be customized by employers so employers have the freedom to determine what expenses are eligible for reimbursement under these arrangements. At the end of the plan year, employers have the option to allow all or a portion of the unused funds to roll over and accumulate year-to-year if not spent. All amounts paid by employers into HRAs are deductible for tax purposes by the employer and tax-free to the employee. COBRA. We offer COBRA continuation services to employer clients to meet the employer’s obligation to make available continuation of coverage for participants who are no longer eligible for the employer’s COBRA covered benefits, which include medical, dental, vision, HRAs and certain healthcare FSAs. COBRA requires employers to make health coverage available for qualified beneficiaries for a period of up to 36 months post-termination. As part of our COBRA program, we offer a direct billing service where former employee participants pay us directly as opposed to their employers for coverage they elect to continue. We handle the accounting and customer services for such terminated employees, as well as interfacing with the carrier regarding the employees’ eligibility for participation in the COBRA program. The American Rescue Plan Act of 2021 provided a temporary 100% subsidy of COBRA premium payments for eligible individuals who lost coverage due to an involuntary termination for up to six months, which ended September 30, 2021. Commuter Programs. We administer pre-tax commuter benefit programs. Employers are permitted to provide employees with commuter benefits including qualified transit (which includes vanpooling) and parking. The maximum monthly federal (and sometimes state) tax free exclusion is indexed for inflation. For 2022, the maximum pre-tax monthly limits are $280 for qualified transit and $280 for qualified parking. The Luum technology platform provides employers with various commuter services, including access to real-time commute data, to help them design and implement flexible return-to-office and hybrid-workplace strategies and benefits. Our technology Technology solution. Our proprietary technology is deployed as a cloud-based solution that is accessible to customers online and through our mobile app. We utilize a multi-tenant architecture that allows changes made for one Network Partner to be extended to all others. This architecture provides operating leverage by reducing costs and improving efficiencies, enabling us to maximize the utilization of our infrastructure capacity with a reduction in required maintenance. We are increasing investment in our technology and communications systems to support new opportunities and enhance security, privacy, and platform infrastructure. Our solution is hosted via cloud-based services and on a virtual private cloud with an ability to scale on demand. This allows us to quickly support our current and projected growth. We utilize regional cloud failover and multiple redundant third-party data centers to ensure continuous access and data availability. The data centers are purpose-built facilities for hosting mission critical systems with multiple built-in redundancy layers to minimize service disruptions and meet industry-standard measures. Data security and protection. Due to the sensitive nature of our customers’ data that we hold, we have a heightened focus on data security and protection. We maintain administrative, technical, and physical safeguards designed to protect confidential data. Our Risk and Security team identifies security risks by working with state and federal law enforcement, security information-sharing organizations, and 24/7 system surveillance through internal and external detection and response teams. In the event a security risk is detected, or a breach occurs, we are prepared with appropriate response protocols based on National Institute of Standards & Technology ("NIST") guidelines. Our Security Incident Response Plan defines roles and responsibilities, incident severity levels, key contacts, post-incident steps, and guidelines for -5- Table of Contents testing. Our procedures cover response steps for phishing attacks, ransomware, data breaches, and major vulnerabilities. Lastly, we have an organic threat model that evaluates our security controls to help protect against attacker tactics, techniques, and procedures. To help ensure our approach to customer privacy and security is effective and in line with industry standards, we follow risk management standards established by the Statement on Standards for Attestation Engagements 18 (SSAE-18) and Service and Organization Controls (SOC 1 and 2) reporting. Our competitive landscape Our direct competitors are HSA custodians and other CDB providers. Many of these are state or federally chartered banks and other financial institutions for which we believe benefits administration services are not a core business. Some of our direct competitors (including healthcare service companies such as United Health Group's Optum, Webster Bank, and well-known retail investment companies, such as Fidelity Investments ) are in a position to devote more resources to the development, sale and support of their products and services than we have at our disposal. In addition, numerous indirect competitors, including benefits administration service providers, partner with banks and other HSA custodians to compete with us. Our Network Partners may also choose to offer competitive services directly, as some health plans have done. Our success depends on our ability to predict and react quickly to these and other industry and competitive dynamics. Our competitive strengths and strategy We believe we are well-positioned to benefit from the transformation of the healthcare benefits market. Our technology platforms are aligned with a healthcare environment that rewards consumer engagement and fosters an integrated consumer experience. Leadership. We have established a defensible leadership position in the HSA industry through our focus on innovation, and differentiated capabilities. Our leadership position is evidenced by the increase in our market share (measured by HSA Assets), from 4% in December 2010 to 18% in December 2021, as noted by the 2021 Devenir HSA Research Report, which indicates we are the second largest HSA custodian by market share measured by HSA Assets. Complete solution for managing consumer healthcare saving and spending. Our members utilize our platforms in a number of ways and in varying frequencies. For example, our members utilize our HSA platform to evaluate and pay healthcare bills through the member portal, which allows members to pay their healthcare providers, receive reimbursements and learn of savings opportunities for prescription drugs. Members also utilize the platform’s mobile app to view and pay claims on-the-go, including uploading medical and insurance documentation to the platform with their mobile phone cameras. Bundled solution for HSAs and complementary CDBs. We are the largest custodian and administrator of HSAs (by number of accounts), as well as a market-share leader in each of the major categories of complementary CDBs, including FSAs and HRAs, COBRA and commuter benefits administration. Our Clients and their benefits advisors increasingly seek HSA providers that can deliver an integrated offering of HSAs and complementary CDBs. With our CDB capabilities, we can provide employers with a single partner for both HSAs and complementary CDBs, which is preferred by the vast majority of employers, according to research conducted for us by Aite Group. We believe that the combination of HSA and complementary CDB offerings significantly strengthens our value proposition to employers, health benefits brokers and consultants, and Network Partners as a leading single-source provider. Proprietary and integrated technology solution. We have a proprietary cloud-based technology solution, developed and refined during more than a decade of operations and acquired through the WageWorks Acquisition, which we believe is differentiated in the marketplace for a number of key reasons: • Purpose-built technology: Our solution was designed specifically to serve the needs of healthcare consumers, health plans and employers. We believe they provide greater functionality and flexibility than the technologies used by our competitors, many of which were originally developed for banking, benefits administration or retirement services. We believe we are one of few providers with a solution that encompass all of the core functionality of healthcare saving and spending in integrated, secure, and compliant systems, including custodial administration of individual savings and investment accounts, card and electronic funds transaction processing, benefits enrollment and eligibility, electronic and paper medical claims processing, medical bill presentment, tax-advantaged reimbursement account and health incentive administration, HSA trust administration, online investment advice, and sophisticated analytics. -6- Table of Contents • Data integration: Our technology solution allows us to integrate data from disparate sources, which enables us to seamlessly incorporate personal health information, clinical insight, and individually tailored strategies into the consumer experience. We currently have more than 20,000 distinct integrations with health plans, pharmacy benefit managers, employers, and other benefits provider systems. Many of our partners’ systems rely on custom data models, non-standard formats, complex business rules, and security protocols that are difficult or expensive to change. • Configurability: Our flexible technology solution enables us to create a unique solution for each of our Network Partners. For example, a HealthEquity team member can readily configure product attributes, including integration with a partner’s chosen healthcare price transparency or wellness tools, single sign on, sales and broker support sites, branding, member communication, custom fulfillment and payment card, savings options and interest rates, fees, and mutual fund investment choices. Differentiated consumer experience. We have designed our solution and support services to deliver a differentiated consumer experience, which is a function of our culture and technology. We believe this provides an advantage relative to legacy competitors whom we believe prioritize transaction processing and benefits administration. • Culture: We call our culture “DEEP Purple,” which we define as driving excellence, ethics, and process while providing remarkable service. Our DEEP Purple culture is a significant factor in our ability to attract and retain customers and to nimbly address opportunities in the rapidly changing healthcare sector. • Technology: Our technology helps us to deliver on our commitment to DEEP Purple. We tailor the content of our platforms and the guidance of our experts to be timely, personal, and relevant to each member. For example, our technology generates health savings strategies that are delivered to our members when they interact with our platforms or call us. We employ individuals who provide real-time assistance to our members via telephone, email, or chat. • Customer service and education: As a key part of our strategy and commitment to DEEP Purple, our team members work directly with our Network Partners to engage with consumers, educating them about the benefits of our HSAs and our other products and providing personalized guidance. We believe our DEEP Purple culture drives our success. Large and diversified channel access. We believe our differentiated distribution platforms provide a competitive advantage by efficiently enabling us to reach a growing consumer market. Our solution is built on a business-to-business-to-consumer, or B2B2C, channel strategy, whereby we work with Network Partners and Clients to reach consumers in addition to marketing our services to these potential members directly. Reaching the consumer is critical in order for us to increase the number of our HSA members. We work directly with our Network Partners and Clients to reach the consumer in various ways. Our health plan and administrator partners collectively employ thousands of sales representatives and account managers who promote both the health plan and administrators partner’s health insurance products, such as HDHPs, and our HSAs. Our Clients collectively employ thousands of human resources professionals who are tasked with explaining the benefits of our HSAs to their employees. Our sales and account management teams work with and train the sales representatives and account management teams of our Network Partners and the human resource professionals of our Clients on the benefits of enrolling in, contributing to, and saving and spending through our HSAs, and our Network Partners and Clients then convey these benefits to prospective members. As a result of this collaboration, we develop relationships with each member who enrolls in an HSA with us. This personalized engagement with our members constitutes our B2B2C channel strategy. Scalable operating model. We believe that our model is scalable because our services are accessed primarily through our cloud-based technology platforms. After initial on-boarding and a period of education, our service costs for any given customer typically decline over time. Our opportunity to earn high-margin revenue from existing HSA members grows over time because our HSA members’ balances typically grow, increasing custodial revenue without significant incremental cost to us. Strong customer retention rates . Retention of our HSA members has been strong over time. Individually owned trust accounts, including HSAs, have inherently high switching costs, as switching requires a certain amount of effort on the part of the account holder and may result in closure fees. We believe that our retention rates are also high due to our HSA platform’s integration with the broader healthcare system used by our HSA members and our customer engagement and focus on the consumer experience. Selectively pursue strategic acquisitions. We have historically acquired HSA portfolios and businesses that strengthen our business. We expect to continue this growth strategy and regularly evaluate opportunities. We have -7- Table of Contents developed an internal capability to source, evaluate, and integrate acquisitions that have created value for stockholders. We believe the nature of our competitive landscape provides significant acquisition opportunities. Many of our competitors view their HSA businesses as non-core functions. We believe they may look to divest these assets and, in certain cases, be limited from making acquisitions due to depository capital requirements. Government regulation Our business is subject to extensive, complex, and rapidly changing federal and state laws and regulations. IRS regulations We are subject to applicable IRS regulations, which lay the foundation for tax savings and eligible expenses under the HSAs, HRAs, and FSAs we administer. The IRS issues guidance regarding these regulations regularly. In addition, we are subject to conflict of interest and other prohibited transaction rules that are enforced through excise taxes under the Internal Revenue Code. Although the excise taxes are enforced by the IRS, the underlying rules are promulgated by the Department of Labor. In February 2006, HealthEquity, Inc. received designation by the U.S. Department of Treasury to act as a passive non-bank custodian, which allows HealthEquity, Inc. to hold custodial assets for individual account holders. In July 2017, HealthEquity, Inc. received designation by the U.S. Department of Treasury to act as both a passive and non-passive non-bank custodian, which allows HealthEquity, Inc. to hold custodial assets for individual account holders and use discretion to direct investment of such assets held. As a passive and non-passive non-bank custodian, the Company must maintain net worth (assets minus liabilities) greater than 2% of passive custodial funds held at each fiscal year-end and 4% of the non-passive custodial funds held at each fiscal year-end in order to take on additional custodial assets. As of January 31, 2022, the Company's year-end for trust and tax purposes, the net worth of the Company exceeded the required thresholds. Privacy and data security regulations In the provision of HSA custodial services and directed TPA services for FSAs and HRAs, we are subject to the Financial Services Modernization Act of 1999 (Gramm-Leach-Bliley Act or GLBA), the Health Insurance Portability and Accountability Act of 1996 (HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act), and similar state laws. GLBA imposes financial privacy and security requirements on financial institutions that relate to the collection, storage, use, and disclosure of an account holder’s nonpublic personal information. Nonpublic personal information includes information that is collected or generated in the course of offering a financial product or service. For example, nonpublic personal information includes information submitted by a prospective account holder in an application, an account holder’s name and contact information, and transaction information. Because part of our business is the administration of financial products such as HSAs, we are required under the Consumer Financial Protection Bureau’s financial privacy rule under GLBA to send a notice of privacy practices to account holders and to comply with restrictions on the disclosure of nonpublic personal information to non-affiliated third parties. We are also required under GLBA to establish reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of nonpublic personal information pursuant to the Federal Trade Commission’s safeguards rule. Violations of GLBA can result in civil and criminal penalties. HIPAA covered entities and their business associates are required to adhere to HIPAA privacy and security standards. Covered entities include most healthcare providers, health plans, and healthcare clearinghouses. Because we perform services (such as FSA services) for covered entities that include processing protected health information, we are a business associate and subject to HIPAA. The two rules that most significantly affect our business are: (i) the Standards for Privacy of Individually Identifiable Health Information, or the Privacy Rule; and (ii) the Security Standards for the Protection of Electronic Protected Health Information, or the Security Rule. The Privacy Rule restricts the use and disclosure of protected health information, and requires us to safeguard that information and provide certain rights to individuals with respect to that information. The Security Rule establishes requirements for safeguarding protected health information transmitted or stored electronically. Both civil and criminal penalties apply for violating HIPAA, which may be enforced by both the Department of Health and Human Services’ Office for Civil Rights and state attorneys general. Violations of HIPAA may also subject us to contractual remedies under the terms of agreements with covered entities. Various states also have laws and regulations that impose additional restrictions on our collection, storage, and use of personally identifiable information. Privacy regulation in particular has become a priority issue in many states, including California, which in 2018 enacted the California Consumer Privacy Act ("CCPA") broadly regulating California residents’ personal information and providing California residents with various rights to access and control -8- Table of Contents their data. Additional privacy requirements are applicable to us as a result of the California Privacy Rights Act of 2020, which significantly modified the CCPA by expanding consumers’ rights with respect to certain sensitive personal information. ERISA Our private-sector clients’ FSAs, HRAs, COBRA continuation insurance, and other account-based retirement plans are covered by the Employee Retirement Income Security Act of 1974, as amended, or ERISA, which governs “employee benefits plans.” Title I of ERISA does not generally apply to HSAs. ERISA generally imposes extensive reporting requirements on employers, as well as an obligation to provide various disclosures to covered employees and beneficiaries; and employers and third-party administrators that have authority or discretion over management, administration, or investment of plan assets are subject to fiduciary responsibility under ERISA. ERISA's requirements affect our FSAs, HRAs, and COBRA administration businesses. The Department of Labor can bring enforcement actions or assess penalties against employers, investment advisers, administrators, and other service providers for failing to comply with ERISA’s requirements. Participants and beneficiaries may also file lawsuits against employers, investment advisers, administrators, and other service providers under ERISA. Department of Labor The Department of Labor, or the DOL, regulates plans that are subject to ERISA, including health FSAs, HRAs, and 401(k) and other retirement plans, as well as COBRA administration. The DOL also issues guidance related to fiduciary responsibility and prohibited transactions under ERISA and the Internal Revenue Code that affect administration of HSAs (as well as health FSAs, HRAs, and retirement plans). The DOL issues regulations, technical releases, and other guidance that apply to employee benefit plans, tax-favored savings arrangements (including HSAs) and COBRA administration, generally. In addition, in response to a request by an individual or an organization, the DOL’s Employee Benefits Security Administration may issue an advisory opinion that interprets and applies ERISA and/or corresponding prohibited transaction rules under the Internal Revenue Code to a specific situation, including issues related to consumer-centric healthcare accounts and retirement plans. Healthcare reform In March 2010, the federal government enacted significant reforms to healthcare benefits through the Affordable Care Act. The legislation amended various provisions in many federal laws, including the Internal Revenue Code and ERISA. The reforms included new excise taxes that incentivize employers to provide health benefits (including HSA-compatible benefits) to all full-time employees and new coverage mandates for health plans. The rules directly affect health FSAs and HRAs and have an indirect effect on HSAs. Further changes to the Affordable Care Act and related healthcare regulation remain under consideration, including "Medicare for all" plans. Investment Advisers Act of 1940 Our subsidiary HealthEquity Advisors, LLC is an SEC-registered investment adviser that provides web-only automated investment advisory services to members. As an SEC-registered investment adviser, it must comply with the requirements of the Investment Advisers Act of 1940, or the Advisers Act, and related Securities and Exchange Commission, or SEC, regulations and is subject to periodic inspections by the SEC staff. Such requirements relate to, among other things, fiduciary duties to clients, disclosure obligations, recordkeeping and reporting requirements, marketing restrictions limitations on agency cross and principal transactions between the adviser and its clients, and general anti-fraud prohibitions. The SEC is authorized to institute proceedings and impose sanctions for violations of the Advisers Act, ranging from fines and censure to termination of an investment adviser’s registration. Investment advisers also are subject to certain state securities laws and regulations. Failure to comply with the Advisers Act or other federal and state securities and regulations could result in investigations, sanctions, profit disgorgement, fines or other similar consequences. Intellectual property Intellectual property is important to our success. We rely on trademarks and other forms of intellectual property rights and measures, including trade secrets, know-how and other unpatented proprietary processes, and nondisclosure agreements, to maintain and protect proprietary aspects of our products and technologies. We require our team members and consultants to execute confidentiality agreements in connection with their employment or consulting relationships with us. We also require our team members and consultants to disclose and assign to us all inventions conceived during the term of their employment or engagement while using our property or which relate to our business. -9- Table of Contents Geographic areas Our sole geographic market is the U.S. Human capital HealthEquity is comprised of people dedicated to empowering consumers to connect health and wealth by delivering remarkable service. We refer to our culture as “DEEP Purple,” which stands for Driving Excellence, Ethics and Process while providing remarkable service to our clients and members. We believe that our DEEP Purple culture is a key differentiator that drives the success of our company through, among other things, attracting and retaining top talent. DEEP Purple is the essence of our company, and we invest a lot of time and energy to support and maintain it. Our board of directors and its committees provide oversight on certain human capital matters. The Talent, Compensation and Culture Committee of our board of directors acts on behalf of the board to review and determine executive compensation plans, policies and programs, oversee the Company’s culture and related strategies, programs and risks, and oversee the Company’s talent management, development and retention efforts and related strategies, programs, and risks, including with respect to diversity and inclusion. As of January 31, 2022, we had 3,688 full-time team members and 27 part-time team members, including 2,297 in service delivery, 655 in technology and development, and 763 in sales and marketing, and general and administrative positions. As January 31, 2022, our team members had the following demographic characteristics: Executive Leadership Team People Leaders All HealthEquity Team Members Women 29 % 54 % 68 % Men 71 % 46 % 32 % Under age 30 0 % 5 % 18 % Between ages 30 and 50 43 % 63 % 56 % Over age 50 57 % 32 % 26 % People of color 14 % 22 % 34 % Diversity and inclusion As an employer, we celebrate the diversity of our team members and strive for consistent inclusion. We strive to make HealthEquity a place where diversity of thought, culture, orientation, identity, and experience enhance every aspect of what we do. We recognize the value of diversity and inclusion in our business practices. We believe that justice, equity, diversity, and inclusion ("JEDI") in the workplace are key to team members feeling they can bring their true authentic self to their work environment and that this translates to higher productivity, increased motivation and improved performance. At the heart of our JEDI efforts is the "Created Equal program". Led by a diverse council, Created Equal promotes JEDI initiatives and our teammate-led business resource groups, which we call "Connections" groups. We believe that a diverse workforce is critical to our success, and we continue to focus on the hiring, retention and advancement of women and underrepresented populations. Our recent efforts have focused on three areas: inspiring authenticity through an inclusive and diverse culture; identifying diverse organizations to expand our candidate pool; and strategically partnering with our Connections groups to accelerate our JEDI efforts. Health, Safety and Wellness HealthEquity also seeks to ensure that team members have the working conditions they need to succeed. The health and well-being of our team members at work are foremost among our concerns. We encourage our team members to follow common sense safety practices and correct any unsafe condition or report it to their supervisor. We are committed to maintaining a safe workplace free from unlawful drugs and alcohol in accordance with applicable law and free from harassment. HealthEquity supports these measures through extensive training as well as formal grievance procedures and policies. In response to the COVID-19 pandemic, we have prioritized the health and safety of our team members. This includes having the majority of our team members work from home, while implementing additional safety measures for team members continuing critical on-site work. In addition, the Company has established a conditionally based paid leave policy to support team members who have been directly impacted by COVID-19. HealthEquity has also helped team members maintain a healthy work-life balance and juggle competing needs during the pandemic by supporting flexible work schedules. HealthEquity has maintained a strong focus to support the holistic health of our -10- Table of Contents team members, offering a variety of recurring sessions addressing their mental, emotional, and physical health and that of their dependents. In September 2021, the President of the United States signed an executive order, and related guidance was published that, together, require certain COVID-19 precautions for federal contractors, including mandatory COVID-19 vaccines for employees of federal contractors (subject to medical and religious exemptions) (the “Vaccine Mandate”). While the Vaccine Mandate has been stayed by the courts, we are classified as a federal contractor due to a number of our agreements and believe we will be subject to the Vaccine Mandate if it is reinstated. HealthEquity’s compliance with the Vaccine Mandate has and could continue to result in increased team member attrition and absenteeism. Regardless of the Vaccine Mandate, HealthEquity has strongly encouraged all team members to work with their medical provider to get vaccinated against COVID-19. In addition to providing practical education on the vaccine, HealthEquity has held multiple town halls for team members to ask questions and receive important information on vaccination. Equitable Pay Philosophy and Benefits HealthEquity is proud to be a workplace where hard work is valued and rewarded. We are committed to pay equity, which is being implemented through our Total Rewards program. Our pay philosophy is intended to foster a program that supports the Company’s mission, values, and culture. We believe that our greatest asset is our people, and our Total Rewards program, which includes salary, incentive pay, equity, retirement, and health benefits, is designed to attract and retain talented team members who drive the Company’s success. The program is intended to be fair and easy to understand so that all team members and their managers understand the goals and outcomes. HealthEquity strives to administer the program in a manner that is applied consistently, equitably, and free of discrimination, as follows: • Maintaining competitive pay by reviewing market data annually; • Ensuring that similar jobs are paid equitably across the organization; • Rewarding team members based on their abilities, competencies, experience, and performance levels; • Effectively communicating our Total Rewards policies and practices; and • Complying with all applicable federal, state, and local laws and requirements. HealthEquity believes in sharing the financial success of the Company and rewarding individual performance through offering participation in a bonus plan to all non-commissioned team members. The bonus pool is funded based on the financial performance of the Company, and team members' performance against objectives determines the individual payouts earned. To ensure the Total Rewards program is managed in a consistent and equitable way, all positions at HealthEquity are assigned a job and an associated pay grade. That pay grade is determined using a formal job evaluation methodology based on a job’s purpose and key accountabilities described in the job description. These components are the same for all positions across HealthEquity, regardless of level. We believe in approaching team member health holistically. Our benefits philosophy is rooted in the foundational beliefs that – first – all areas of health are intertwined, and – second – that when team members are thriving in mental, emotional, physical, social, and financial health, they are in the best position to succeed personally and provide remarkable service professionally. Accordingly, HealthEquity provides our team members a variety of comprehensive, consumer-driven healthcare medical plans offered in conjunction with generous HSA contributions from the Company, a 401(k) plan that offers Company contributions, a subsidized dental plan, voluntary vision coverage, paid maternity and parental leaves, and importantly, a holistic wellness plan that supports the continued development of our team members’ mental, physical, financial, emotional, and social health. Team Member Engagement HealthEquity also considers team member engagement an important metric of organizational health. We seek team member feedback, measure team member engagement, and measure our team member Net Promoter Score℠, or NPS ® , twice a year through a survey. The team member NPS framework surveys team members to generate a total score based on the percentage of those who are promoters (responding with a score of 9 or 10), passives (a score of 7 or 8), and detractors (a score of 0 to 6). Scores are calculated by subtracting the percentage of detractors from the percentage of promoters (the percentage of passives is not used in the formula). Team member NPS scores can range from -100 to 100. As of January 31, 2022, our team member NPS was 37, based on a participation rate of 89 percent. Out of all responders, 55 percent were promoters, 27 percent were passives, and 18 percent were detractors. -11- Table of Contents "NPS ® " is a registered trademark of Bain & Company, Inc., Satmetrix Systems, Inc., and Fred Reichheld. Net Promoter Score℠ is a service mark of Bain & Company, Inc., Satmetrix Systems, Inc., and Fred Reichheld." Corporate information HealthEquity, Inc. was incorporated as a Delaware corporation on September 18, 2002. Our principal business office is located at 15 W. Scenic Pointe Dr., Ste. 100, Draper, Utah 84020. Our website address is www.healthequity.com. We do not incorporate the information contained on, or accessible through, our corporate website into this Annual Report on Form 10-K, and you should not consider it to be part of this report. Where you can find additional information Our website is located at www.healthequity.com, and our investor relations website is located at ir.healthequity.com. Information on our website is not incorporated into this report. Copies of our Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, and any amendments to these reports filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act are available, free of charge, on our investor relations website as soon as reasonably practicable after we file such material electronically with or furnish it to the SEC. The SEC maintains an internet site that contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC at www.sec.gov. -12- Table of Contents