HEALTHSTREAM INC 10-K

Item 1. Business OVERVIEW AND HISTORY HealthStream’s focus is and has always been on improving the quality of healthcare through the development of the dedicated individuals who deliver care. Like healthcare itself, our mission remains constant, but how we accomplish that mission continues to evolve and improve over time. Originally, we pioneered the use of online learning to hospitals, which began with courses specifically tailored to educate healthcare professionals and meet hospitals' required regulatory needs, and we remain a leading innovator in those areas today. Since our inception, the scope of HealthStream’s Software-as-a-Service (SaaS) solutions has expanded well beyond our governance, risk, and compliance (GRC) offerings to include a diverse ecosystem of applications that optimize and support the healthcare workforce and the students preparing to enter that workforce. Today, we are characterized by our single platform strategy, which is designed to create interoperability among the various applications in our ecosystem through our proprietary hStream technology platform. We believe that our single platform strategy, as represented by hStream, is the best way to realize our mission of improving the quality of care by developing the people who deliver care, and the best way to create value for our shareholders in the process. For healthcare organizations—our primary customers—HealthStream’s solutions help to effectively onboard, retain, engage, educate, manage, and develop workforce talent; meet rigorous GRC requirements; optimize staff scheduling and capacity management; and automate the management of medical staff credentialing, privileging, and enrollment. For healthcare professionals and students—our primary end users—HealthStream’s solutions help them to professionally develop their knowledge and skills, manage and fulfill their required continuing education and certifications, manage their schedules, including swapping and filling shifts, engage with peers, provide personalized competency development, and optimize their career pathways. For both healthcare organizations and healthcare professionals and students, HealthStream’s solutions are generally accessed through SaaS application suites that are increasingly enhanced through our hStream technology platform. Our learning, credentialing, and scheduling application suites are designed to help solve the most critical problems facing the healthcare workforce today. They accomplish this by utilizing a combination of established and cutting-edge technologies, such as initiative and workflow management capabilities; proprietary taxonomy engines; dynamic engagement models; artificial intelligence (AI) driven clinical assessments; physical-based simulations; healthcare-specific benchmarks; and automated license monitoring and validation. HealthStream’s success in offering the largest, most diverse ecosystem of workforce solutions in healthcare has made it a thought leader and barometer of innovation for the industry. From its roots in originating online learning for healthcare organizations to the Company's more recent release of "Jane AI," the first AI-driven clinical assessment application, HealthStream continues to believe that the key to quality patient care lies in the people who deliver care. To that end, we are solely dedicated to providing solutions for the healthcare workforce and for those about to enter it. The Company was incorporated in 1990. It began providing its SaaS-based workforce solutions in 1999, its provider solutions in 2012, and launched the hStream technology platform in 2018. Since January 2023, the Company’s operations have been streamlined around a consolidated, enterprise approach such that, beginning January 1, 2023, the Company ceased having two reportable business segments (Workforce Solutions and Provider Solutions). As such, since January 1, 2023, the Company has had a single reportable segment and presents financial information on a single segment basis. HealthStream is headquartered in Nashville, Tennessee and had 1,079 full-time and 13 part-time employees as of December 31, 2023. 1 Table of Contents INDUSTRY BACKGROUND According to the Centers for Medicare & Medicaid Services (CMS), spending in the healthcare industry reached nearly $4.5 trillion in 2022, or 17.3% of the U.S. gross domestic product. The growth in 2022, which was an increase of 4.1% over the prior year, reflected growth in Medicaid and private health insurance spending that was partially offset by continued declines in supplemental funding by the federal government associated with the COVID-19 pandemic. Hospital care expenditures in 2022 accounted for approximately 30% of the $4.5 trillion industry. While hospital spending increased 2.2% in 2022 to reach nearly $1.4 trillion, the rate of increase was slightly lower in 2022 (4.5%) compared to the prior year due to a slower growth in hospital prices and a decline in hospital days and discharges. According to the Bureau of Labor Statistics, as of January 2024, approximately 22 million professionals are employed in the healthcare and social services segment of the domestic economy, with approximately 5.4 million employed in acute-care hospitals and, according to CMS, approximately 5.9 million employed in healthcare organizations throughout the continuum of care, the primary target markets for our products. (Organizations in the continuum of care employ approximately 2.2 million employees in ambulatory centers, approximately 2.8 million employees in post-acute care facilities, and over 0.9 million employees in health & human services facilities.) All of the approximately 5.4 million hospital-based healthcare professionals that work in the nation’s approximately 5,400 inpatient hospitals that are registered with Medicare are required by federal and state mandates and accrediting bodies to complete training in a number of areas. This training includes safety training mandated by both the Occupational Safety and Health Administration (OSHA) and The Joint Commission (an independent, not-for-profit organization that accredits and certifies healthcare organizations and programs in the United States), as well as training on patient information confidentiality required under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). In hospitals, staffing issues and personnel shortages have contributed to the need for more effective and efficient workflows, including scheduling and capacity management as well as credentialing and privileging. Staffing shortages have also increased the need for facility-based workforce development as well as additional assessment and competency-based training. An ongoing nursing shortage, for example, is resulting in skill gaps and rising costs. Employment of registered nurses is projected to grow 6% from 2022 to 2032, faster than the average for all occupations, according to the U.S. Bureau of Labor Statistics. We believe that offering training and education and other engagement solutions for hospital personnel is increasingly being utilized as a retention and recruitment incentive. We also believe that offering training to nursing schools and nursing students can help address personnel shortages and lead to more efficient and effective transition from school to employment. Many healthcare professionals use continuing education to keep abreast of clinical and other industry developments as well as to meet licensing and certification requirements. Continuing education is required for nurses, emergency medical services personnel, first responder personnel, radiologic personnel, and physicians, among many other healthcare professionals. Pharmaceutical and medical device companies must also provide their medical industry sales representatives with training mandated for the healthcare industry and training for new products. Such companies also provide support and content for education and training of audiences that use their products in healthcare organizations. The healthcare education and training industry is highly fragmented, varies significantly in delivery methods (i.e., online products, live events, written materials, and technology-enabled manikins for simulation-based training), and is composed of a wide variety of entities competing for customers. The sheer volume of healthcare information available to satisfy continuing education needs, rapid advances in medical developments, and the time constraints that healthcare professionals face can make it difficult to quickly and efficiently access the continuing education content most relevant to an individual’s practice or profession. Historically, healthcare professionals have received continuing education and training through offline publications, such as medical journals or by attending conferences and seminars. Other healthcare workers and pharmaceutical and medical device manufacturers’ sales and internal regulatory personnel usually fulfill their training from external vendors or internal training departments. While these approaches satisfy the ongoing education and training requirements, they are typically costly and inconvenient. In addition, live courses are often limited in the breadth of offerings and do not provide an automated method for tracking training completion. The effectiveness of these traditional methods, both from a business and compliance standpoint, is difficult to track and measure. Provider data management has become more complex and arduous for healthcare organizations. Spurred by The Joint Commission Medical Staff standards and other regulatory requirements, credentialing and privileging has been transformed from a periodic review to a continuous, evidence-driven analysis of professional competency and provider performance. This transformation requires ongoing, automatic monitoring of licenses, sanctions, and exclusions, as well as expanding the scope of review at initial credentialing and re-credentialing. In addition, provider enrollment processes have compounded in difficulty. For example, a single provider may need to enroll annually with some 30 to 40 payers, with each payer application often taking two to four hours to complete. Healthcare organizations continue to operate under ongoing pressure to reduce costs as a result of actual and potential reductions in reimbursement rates and increased focus on cost containment consistent with participation of patients in managed care programs, among other factors. In addition, many care settings, including hospitals, surgery centers, telehealth companies, outpatient centers, and skilled nursing facilities, may continue to experience rising operating costs, coupled with increased pressure to measure and report on the outcomes of the dollars spent on training. Our products and services are designed to meet these needs by reducing healthcare organizations’ costs of training while improving learning outcomes, enhancing reporting capabilities, and supporting customers’ business objectives. HEALTHSTREAM ’ S SOLUTIONS HealthStream’s products, services, and operations are organized and managed under our One HealthStream approach. Through this One HealthStream approach, we collectively help healthcare organizations meet their ongoing learning, clinical development, credentialing, and scheduling needs. HealthStream’s solutions are provided to a wide range of customers within the healthcare industry. 2 Table of Contents All of our solutions are powered by our hStream technology platform, which enables activity across HealthStream's diverse ecosystem of solutions. At December 31, 2023, HealthStream had contracts with customers for approximately 5.79 million subscriptions to hStream, compared to 5.54 million subscriptions as of December 31, 2022. Under our One HealthStream approach, the hStream technology platform benefits both customers and partners. Our underlying solutions are comprised primarily of SaaS, subscription-based applications that are used by healthcare organizations to meet a broad range of their workforce development needs around learning, clinical development, credentialing, and scheduling. Nursing schools, nursing students, as well as individual healthcare professionals are also beginning to utilize our training and education solutions. Our numerous content libraries allow customers to subscribe to a wide array of courseware, which includes content from leading healthcare and nursing associations, medical and healthcare publishers, and other content providers. Our scheduling solutions provide customers with real-time visibility into clinical staff scheduling that enables them to optimize their workforce, reduce costs, and improve care. Our flagship credentialing, privileging, and enrollment solution, CredentialStream, provides customers an intuitive, modern user experience with a continual stream of enhancements, evidence-based content, and curated data, all which provides healthcare organizations with tools to support the provider lifecycle management from recruiting, application submission, verification of licensure and other credentials, privileging, appointments by credentialing committees, enrollment, network, management, onboarding, and performance evaluations of providers. Pricing for hStream and HealthStream’s products is primarily subscription-based, with fees based on the number of subscriptions, solutions provided, and other factors. We offer implementation, training, and account management services to facilitate adoption of our subscription-based solutions. Fees for implementation services are based on the time and efforts of the personnel involved. Training fees vary based on the size, scope, and complexity of the project. Our platform and subscription-based solutions are hosted on a combination of private-cloud infrastructure and public-cloud infrastructure, leveraging Amazon Web Services and Azure, which allows authorized personnel access to our services through the Internet, thereby eliminating the need for onsite local implementations of installed workforce development products. HealthStream also sells a growing number of products directly to individuals in the healthcare industry and these products are primarily based on per-unit retail price. Other Applications on our Platform — HealthStream offers an array of other applications on our platform, each serving a unique function for healthcare customers. Each application on our platform has its own value. Examples of individual applications that are offered on our platform include applications for performance appraisal, competency management, disclosure management, clinical competency, assessment, development, simulation-based education, clinical rotation and onboarding management, quality management, scheduling, and industry training. BUSINESS ACQUISITIONS As part of our overall growth strategy, we evaluate opportunities for mergers and acquisitions, and since the beginning of 2022, we have completed two acquisitions. In May 2022, we acquired the remaining ownership interest (representing approximately 82% of the outstanding equity interests) of CloudCME, LLC (CloudCME) and in December 2022, we acquired substantially all of the assets of Electronic Education Documentation System (d/b/a eeds) (eeds). For additional information regarding acquisitions, please see Note 8 of the Consolidated Financial Statements and “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Part II, Item 7 of this Form 10-K. CUSTOMERS We provide our solutions to customers across a broad range of individuals and entities within the healthcare industry, including private, not-for-profit, and government entities, as well as pharmaceutical and medical device companies. More recently, HealthStream has begun to market and sell its solutions to nursing schools and students as well. We derive a substantial portion of our revenues from a relatively small number of customers that are healthcare providers. However, during the year ended December 31, 2023, no single customer accounted for 10% or more of our annual revenue. 3 Table of Contents SALES AND MARKETING We market our products and services primarily through our direct sales teams, who are located throughout the United States. We conduct a variety of marketing programs to promote our products and services, including via our hStream content marketplace, user groups, trade shows, social media, Internet promotion and demonstrations, digital marketing campaigns, public relations, distribution of product-specific literature, direct mail, advertising, and in partnership with third parties. We have marketing teams that are responsible for these initiatives and for working with and supporting our product management and sales teams. OPERATIONS AND TECHNOLOGY We believe our ability to establish and maintain long-term customer relationships, obtain recurring sales, and develop and maintain new and existing products are dependent on the strength of our operations, customer service, product development and maintenance, training, and other support teams. Our operations teams are primarily associated with technical support, customer implementation and training, product management, software development and quality assurance, and other functions. Our services are designed to be reliable, secure, and scalable. Our software is a combination of proprietary and commercially available software and operating systems. We designed the applications that provide our services to allow each component to be independently scaled by adding commercially available hardware and a combination of commercially available and proprietary software components. Our software applications, servers, and network infrastructure that deliver our services are hosted by a combination of third-party data center providers and cloud-based infrastructure. We maintain fully redundant disaster recovery data centers that are located in geographically separate locations. Our technology equipment is maintained in secure, limited access environments, supported by redundant power, environmental conditioning, and network connectivity. For information on our cybersecurity risk management, strategy, and governance, see Item 1C. Cybersecurity . COMPETITION In addition to the competing healthcare education delivery methods in the industry, we also have direct competitors. A number of companies offer competitive learning, scheduling, and credentialing solutions, some of which are focused on multiple industries and some of which are focused on the healthcare industry. We compete with companies such as Cornerstone OnDemand, Ultimate Kronos Group, Oracle, SAP, Infor, and Workday, which provide their services to multiple industries, including healthcare. We also compete with companies that are dedicated to, or have operating units focused on healthcare, such as Relias Learning, RLDatix, Symplr, Verisys, MD-Staff, AMN Healthcare, as well as with an array of smaller companies. We believe our hStream technology platform and the interoperability it has begun to enable provides us a competitive advantage by facilitating education, training, assessment, engagement, scheduling, credentialing, privileging, validation, and development for healthcare professionals through a wide assortment of content, functionality, and applications. We also believe that our hStream platform technology is beginning to accelerate the scope and quality of our products, capability to connect medical staff credentialing with provider enrollment, and innovative new predictive analytics, all of which we believe provide us with a competitive advantage. We believe that the principal competitive factors affecting the marketing of our solutions to the healthcare industry include: • our hStream technology platform, which combines SaaS-based capabilities and certain Platform-as-a-Service (PaaS) capabilities to help capture, track, manage, and report on activities, such as learning, performance, scheduling, credentialing, and privileging across various modalities, and provides interoperability with external systems such as HRIS and other systems utilized by our customers; 4 Table of Contents • scope and variety of Internet-based solutions available, including, without limitation, learning and education, clinical, GRC, resuscitation, revenue cycle, talent management, scheduling, credentialing, and privileging solutions; • our singular focus on the healthcare industry and our deep healthcare expertise; • scope and quality of professional services offered, including implementation, benchmarking, and training; • competitive pricing, which supports a return on investment to customers; • customer service and support; • mobility, security, uniqueness, and value of underlying data sets and embedded content; • effectiveness of sales and marketing efforts; and • company reputation. We believe these factors provide us with the ability to improve the quality of healthcare by developing the people who deliver care. GOVERNMENT REGULATION OF THE INTERNET AND THE HEALTHCARE INDUSTRY Regulation of the Internet and the Privacy and Security of Personal Information We are subject to various legal requirements related to the Internet and the privacy and security of personal information, which legal requirements may change rapidly. The following are areas of law in this regard that are significant to our business: • Privacy and Security Laws. Federal, state, and foreign privacy and security laws and regulations restricting the collection, use, retention, deletion, security, disclosure, and other processing of personal information limit our ability to collect information or use and disclose the information in our databases or that we derive from other sources to generate revenues. These laws and regulations are rapidly evolving and could have an adverse effect on our operations. For example, various states have passed privacy laws that impose restrictive requirements on the use and disclosure of personal information, some of which were recently enacted and will be implemented over the course of 2024. Moreover, additional states have been considering similar legislation, and privacy laws have been proposed at the federal level as well. Additionally, we have expanded our business in recent years into new markets and jurisdictions (including foreign jurisdictions), which may subject our business to additional privacy and data protections laws and regulations, such as the Family Educational Rights and Privacy Act (FERPA), the Canadian Personal Information Protection and Electronic Documents Act, the New Zealand Privacy Act 2020, the Australia Privacy Act 1988, and the European Union’s General Data Protection Regulation. Many of the data privacy requirements in foreign jurisdictions are more stringent than those imposed by the U.S. federal and state governments. The significant differences among various privacy and security laws introduces complexity in our compliance efforts. It may be costly to implement measures (such as certain security requirements, contracting terms, assessments, and registrations with authorities) that are designed to comply with new legal requirements, changes to existing legal requirements, or legal requirements in jurisdictions into which we have recently expanded or are planning to expand. The obligations and requirements applicable to companies under these laws and regulations are subject to uncertainty in how they may be interpreted by government authorities and regulators. We may be audited or subject to an investigation by a federal, state, or foreign regulator regarding our compliance with privacy and security laws and regulations. If the Company is determined by a regulator or court to fail to comply with such laws and regulations, the Company may become subject to penalties and the Company’s business and reputation could be negatively impacted. • Content Regulation and Artificial Intelligence. Both foreign and domestic governments have adopted and proposed laws and regulations governing content and materials transmitted over the Internet. These include laws relating to obscenity, indecency, libel, and defamation. We could be liable if content created, stored, or delivered by us is determined to be in violation of these laws and regulations. In addition, various jurisdictions (both in the U.S. and in foreign jurisdictions) have enacted and/or are considering laws and regulations applicable to the use of artificial intelligence and machine learning applications and tools, particularly on the use of artificial intelligence to facilitate healthcare, education, employment, or hiring decisions. • Information Security Accountability Regulation. As a HIPAA business associate of certain of our customers, we are required to report certain breaches of protected health information to our customers, who must in turn notify affected individuals, the U.S. Department of Health and Human Services (HHS) and/or other governmental agencies, and, in certain situations, the media. In addition, we are subject to various foreign and state laws and regulations that relate to data security, some of which require reporting of security breaches. For example, California law requires notification of security breaches involving personal information and medical information. We may incur costs to comply with these notification requirements that are difficult to estimate. 5 Table of Contents • Sales and Use Tax. We collect sales, use, or other taxes on taxable transactions in states and foreign jurisdictions in which we have employees, have a significant level of sales activity, or otherwise determine that such collection is appropriate. While HealthStream believes that this approach is appropriate, other states or foreign jurisdictions may seek to impose tax collection obligations on companies like us that engage in online commerce. If they do, these obligations could limit the growth of electronic commerce in general and adversely impact our business. Laws and regulations directly applicable to content regulation, e-commerce, Internet communications, the privacy and security of personal information, and artificial intelligence are becoming more prevalent and/or broader in scope. The dynamic nature of this regulatory environment increases the uncertainty regarding the marketplace impact of such regulation. New or changes to existing laws or regulations may increase our cost of conducting business or otherwise harm our business, financial condition, and operating results. Regulation of Education, Training, and Other Services for Healthcare Professionals and Students Occupational Safety and Health Administration. OSHA regulations require certain employers to provide training to certain employees to minimize the risk of injury from various potential workplace hazards. Employers in the healthcare industry may be required to provide training with respect to various topics, including, but not limited to, blood borne pathogens exposure control, laboratory safety, and tuberculosis infection control. OSHA regulations further require employers to keep records of their employees’ completion of training with respect to these workplace hazards, as applicable. The Joint Commission. The Joint Commission accreditation and certification standards require employers in the healthcare industry to provide certain workplace safety and patient interaction training to employees. Training required by The Joint Commission may include programs on infection control, patient bill of rights, radiation safety, and incident reporting. Healthcare organizations are required to provide and document training on these topics to receive accreditation from The Joint Commission. In addition, The Joint Commission imposes continuing education requirements on physicians that relate to each physician’s specific staff appointments. HIPAA. HIPAA and its implementing regulations restrict how certain organizations (known as covered entities), including most healthcare providers and health plans, use and disclose protected health information. HIPAA requires these organizations to provide reasonable and appropriate safeguards to protect the privacy, integrity, and confidentiality of protected health information, whether in paper, oral, or electronic form. Covered entities are required to establish, maintain, and provide training with regard to their policies and procedures for protecting the integrity and confidentiality of protected health information and must document training on these topics to support their compliance. Certain HIPAA privacy and security requirements apply to entities (known as business associates) that handle protected health information on behalf of covered entities or other business associates. Covered entities, business associates, and their subcontractors may be directly subject to criminal and civil sanctions for violations of HIPAA privacy and security standards. FERPA. FERPA and its implementing regulations prohibit institutions of higher learning that receive funds through an applicable program of the U.S. Department of Education, such as nursing schools, from disclosing personally identifiable information from a student’s record without the student’s consent. Third parties acting on behalf of an educational institution are indirectly subject to FERPA and, as such, may not transfer or otherwise disclose any personally identifiable information from a student’s record to another party other than as permitted by FERPA. Institutions and organizations subject to FERPA may be subject to an enforcement action by the U.S. Department of Education, which may include, among other things, financial penalties. The American Nurses Credentialing Center (ANCC). ANCC, a subsidiary of the American Nurses Association (ANA), provides individuals and organizations throughout the nursing profession with resources intended to assist with achieving practice excellence. ANCC’s credentialing programs certify nurses in specialty practice areas; recognize healthcare organizations for promoting safe, positive work environments through the Magnet Recognition Program® and the Pathway to Excellence® Program; and accredit providers of continuing nursing education. ANCC maintains seventeen certification exams to validate nurses’ skills, knowledge, and abilities. The ANCC Magnet Recognition Program recognizes healthcare organizations that provide the best in nursing care and professionalism in nursing practice. The program also provides a vehicle for disseminating best practices and strategies among nursing systems. The ANCC Magnet Recognition Program is a highly regarded standard for nursing excellence. The Pathway to Excellence Program recognizes the essential elements of a high standard nursing practice environment. The designation is earned by healthcare organizations that create work environments where nurses can develop professionally. The award substantiates the professional satisfaction of nurses and identifies best places to work. Continuing Nursing Education (CNE). State nurse practice laws generally authorize a state’s board of nursing to establish CNE requirements for professional nurses to maintain valid licensure. CNE requirements vary widely from state to state, with reporting generally required on a bi-annual basis. In some states, the CNE requirement only applies to re-licensure of advance practice nurses, while in other states, additional CNEs may be required of this category of nurses. Board certifications (e.g., Certified Nurse Operating Room (CNOR) – certification of perioperative nursing) also require CNE hours/credits, with certain percentages required in specific categories based on the certification type. Failure to obtain the requisite CNE could result in non-renewal of the license or certification. The ANCC Commission on Accreditation is responsible for accrediting or approving organizations to award ANCC nursing continuing professional development (NCPD) credit (contact hours) to activities for a national audience of nurses. State boards of nursing approve individual CNE activities or continuing education providers that offer CNE activities primarily for nurses within the state. ANCC NCPD credit for online activities is accepted by all state boards of nursing within the United States and each of its territories. Our HealthStream CNE Provider Unit is accredited as a provider of NCPD by ANCC. We are also approved by the California Board of Registered Nursing and the Florida Board of Nursing. 6 Table of Contents Continuing Medical Education (CME). State licensing boards, professional organizations, and employers require physicians to certify that they have accumulated a minimum number of CME hours to maintain their licenses. Generally, each state’s medical practice laws authorize the state’s board of medicine to establish and track CME requirements. Medical licensing boards in most U.S. states and territories currently have CME requirements, and certain state medical societies and practice specialty boards also require CME. The failure to obtain the requisite amount and type of CME could result in non-renewal of the physician’s license to practice medicine and/or membership in a medical or practice specialty society. The American Medical Association (AMA) classifies CME activities as either Category 1, which includes formal CME activities, or Category 2, which includes self-designated credit for informal activities that meet certain requirements. Most boards of medical examiners nationwide that require CME participation specify AMA PRA Category 1 Credit . Only institutions and organizations accredited to provide CME can designate an activity for AMA PRA Category 1 Credit . The Accreditation Council for Continuing Medical Education (ACCME) is responsible for awarding accreditation status to state medical societies, medical schools, and other institutions and organizations that provide CME activities, typically for a national audience of physicians. State medical societies, operating under the aegis of the ACCME, accredit institutions and organizations that provide CME activities primarily for physicians within the state or bordering states. We are recognized as an accredited provider of CME for physicians by the ACCME. Centers for Medicare & Medicaid Services (CMS). The CMS National Quality Strategy is focused on ensuring that all persons receive equitable, high-quality, and value-based care, with an emphasis on shaping a health care system that incorporates quality and safety as foundational components to delivering value as part of the overall care journey. The goals of the initiative include: embedding quality into the care journey; advancing health equity; promoting safety; embracing the digital age; ensuring resilience to adapt to future challenges and emergencies; incentivizing innovation and technology; and increasing alignment across CMS, its partners, and stakeholders. Value-based purchasing (VBP), which links payment more directly to the quality of care provided, is a strategy that aims to transform the current payment system by rewarding providers for delivering high quality, efficient clinical care. Through a number of public reporting programs, demonstration projects, pilot programs, and other initiatives, some voluntary and some mandatory, CMS has launched VBP initiatives in various settings, including hospitals, physician offices, nursing homes, home health services, and dialysis facilities. Through its “Meaningful Measures” initiative, CMS identifies priorities for quality measurement and improvement. The framework is intended to improve patient outcomes while also reducing burdens on providers. Interoperability Initiatives. CMS interoperability programs encourage eligible professionals, eligible hospitals, and critical access hospitals to adopt electronic health record (EHR) technology by imposing payment reductions for failure to demonstrate meaningful use of certified EHR technology. Providers that meaningfully use an EHR system may reap benefits such as reduction in errors, availability of records and data, reminders and alerts, clinical decision support, and e-prescribing/refill automation. Further, the 21st Century Cures Act and implementing regulations promote interoperability and the exchange of patient health information through a number of requirements including a ban on information blocking by healthcare providers, health IT developers, and certain other entities. Information blocking is generally defined as engaging in activities that are likely to interfere with the access, exchange, or use of electronic health information, subject to limited exceptions. Allied Disciplines. Various allied health professionals are required to obtain continuing education to maintain their licenses. For example, emergency medical technician (EMT) personnel may be required to attain a minimum number of continuing education hours per year, all or a portion of which can be fulfilled online. These requirements vary by state and depend on the professional classification of the individual. HealthStream is an organization accredited and/or approved by the Commission on Accreditation for Prehospital Continuing Education (CAPCE) and the Florida Department of Health. Regulation of Educational Program Sponsorship and Support There are a variety of laws and regulations that affect the relationships between our medical device and pharmaceutical customers and the users of our products and services, including the sponsorship and support of educational programs. For example, the Physician Payments Sunshine Act (Sunshine Act) requires manufacturers of drugs, biological devices, and medical devices covered by Medicare, Medicaid, or the Children’s Health Insurance Program to report annually to CMS payments and other transfers of value given by such manufacturers to physicians, certain other healthcare professionals, and teaching hospitals, including educational programs, with limited exceptions. CMS regulations generally require manufacturers to report the recipient’s name, business address, and national provider identifier as well as other information about the payment or transfer of value including the amount, date, form, and nature of what is offered. CMS publishes the information on its Open Payments website. Manufacturers that do not meet the reporting obligations are subject to significant monetary penalties. 7 Table of Contents Further, the Office of Inspector General (OIG) has issued Compliance Program Guidance for Pharmaceutical Manufacturers and for the Durable Medical Equipment, Prosthetics, Orthotics, and Supply Industry (collectively, the Guidelines). The Guidelines address compliance risks raised by the support of continuing educational activities by pharmaceutical and medical device companies. The Guidelines have affected and may continue to affect the type and extent of commercial support we receive for our continuing education activities. The trade associations for the pharmaceutical and medical device industries (PhRMA and AdvaMed, respectively) have also promulgated their own codes of ethics that further restrict the interactions between industry and health care professionals. In addition, the AMA has established its own code of ethics that provides standards of conduct for physicians, addressing professional-self regulation and including a policy regarding Gifts to Physicians from Industry . Some continuing education organizations issue standards applicable to our services. For example, we comply with the ACCME’s Standards for Integrity and Independence in Accredited Continuing Education to ensure that our CME and CNE activities are evidence-based, designed to improve patient care and/or community health, and are free from commercial influence. We follow all standards/criteria/guidelines set-forth by ACCME, ANCC, and other continuing education organizations regarding the regulation of educational program sponsorship and support. The U.S. Food and Drug Administration (FDA) and the Federal Trade Commission (FTC) Current FDA and FTC rules and enforcement actions and regulatory policies, or those that the FDA or the FTC may develop in the future, could have a material adverse effect on our ability to provide existing or future applications or services to our end users or obtain the necessary corporate sponsorship to do so. The FDA and the FTC regulate the form, content, and dissemination of labeling, advertising, and promotional materials, including direct-to-consumer prescription drug and medical device advertising, prepared by, or for, pharmaceutical, biotechnology, or medical device companies. The FTC regulates over-the-counter drug advertising and, in some cases, medical device advertising. Generally, regulated companies must limit their advertising and promotional materials to discussions of the FDA-approved indications. Therefore, any information that promotes the use of pharmaceutical or medical device products that is presented with our services is subject to the FDA and FTC requirements and regulatory oversight including criminal, civil, and administrative actions. We believe that banner advertisements, sponsorship links, and any educational programs we may present with our services, even if we lack independent editorial control over it, could be subject to FDA or FTC regulation. While the FDA and the FTC place the principal burden of compliance with advertising and promotional regulations on the advertiser, if the FDA or FTC finds that any regulated information presented with our services violates FDA or FTC regulations, they may take regulatory action against us or the advertiser or sponsor of that information. In addition, the FDA may adopt new regulatory policies that more tightly regulate the format and content of promotional information on the Internet. ENVIRONMENTAL MATTERS We are subject to a number of federal, state, and local environmental laws, rules, and regulations. In addition, we could be affected by climate change to the extent that climate change results in severe weather conditions or other disruptions impacting the communities in which we have office locations and/or where we have network infrastructure or adversely impacts general economic conditions. Moreover, legal requirements regulating greenhouse gas emissions and energy inputs or otherwise associated with the transition to a lower carbon economy could increase in the future, which could increase our costs associated with compliance and otherwise disrupt and adversely affect our operations. At the current time, our compliance with environmental legal requirements, including legal requirements relating to climate change, does not have a material effect on our capital expenditures, financial results, or operations, and we did not incur material capital expenditures with respect to environmental matters during the year ended December 31, 2023. However, it is possible that future environmental-related developments may impact us, including as a result of climate change and/or legal requirements associated with the transition to a lower carbon economy in a manner that we are currently unable to predict. INTELLECTUAL PROPERTY AND OTHER PROPRIETARY RIGHTS To protect our proprietary rights, we rely generally on copyright, trademark, patent, and trade secret laws; confidentiality agreements, contracts, and procedures with employees, consultants and other third parties; contractual provisions in license agreements with consultants, vendors, and customers; and use measures designed to control access to our software, documentation, and other proprietary information. We own federal trademark and service mark registrations for several marks, including, without limitation “HEALTHSTREAM”, “HEALTHSTREAM LEARNING CENTER”, "HSTREAM", "JANE", “HEALTHSTREAM EPORTFOLIO”, and “COMPLYQ”. We also have obtained registration of the “HEALTHSTREAM” mark in certain other countries. Additionally, we hold a number of patents related to the solutions we provide. Applications for several trademarks and patents are currently pending. However, there can be no assurance that we will be successful in obtaining registration of trademarks and patents for which we have applied. The content we license to our customers is developed through a combination of license agreements with publishers and authors, assignments and work-for-hire arrangements with third parties, and development by employees. We require publishers, authors, and other third parties to represent and warrant that their content does not infringe on or misappropriate any third-party intellectual property rights and that they have the right to provide their content and have obtained all third party consents necessary to do so. Our publishers, authors, and other third parties also agree to indemnify us against certain liability we might sustain due to the content they provide. 8 Table of Contents If a third party asserts a claim that we or our third party partners have infringed its patents or other intellectual property right, we may incur costs to defend against that claim, and we may be required to redesign or discontinue products that we currently offer or enter into royalty or licensing agreements, which may result in negative publicity, harm to our reputation, or an adverse effect on our results of operations. In addition, we license technologies from third parties for incorporation into our services. Licensing agreements with these third parties may not be available on terms acceptable to us, if at all. Additionally, despite the steps we have taken to protect our intellectual property and proprietary rights, our efforts may not be adequate. Third parties may infringe or misappropriate our intellectual property, and such violations of our intellectual property are difficult to detect and police. Competitors may also independently develop technologies that are substantially equivalent or superior to the technologies we employ in our products or services. If we are unable to safeguard our proprietary rights adequately, our competitors could offer similar services, potentially significantly harming our competitive position and decreasing our revenues. We hold inbound licenses for certain intellectual property that is used internally, and in some cases, utilized in HealthStream’s products or services. While it may be necessary in the future to seek or renew licenses relating to various aspects of our products and services, we believe, based upon past experience and industry practice, such licenses generally can be obtained on commercially reasonable terms. We believe our operations and products and services are not materially dependent on any single license or other agreement with any third party. AVAILABLE INFORMATION The Company files reports with the SEC, including annual reports on Form 10-K, quarterly reports on Form 10-Q, and other reports from time to time. The SEC maintains an Internet site at http://www.sec.gov that contains the reports, proxy, and other filings made by us electronically. Our website address is www.healthstream.com. Please note that our website address is provided as an inactive textual reference only. We make available, free of charge through our website, our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, all amendments to those reports, and other filings made by us with the SEC, as soon as reasonably practicable after such material is electronically filed with or furnished to the SEC. The information provided on our website is not part of this report and is not incorporated by reference herein. HUMAN CAPITAL RESOURCES As of December 31, 2023, the Company had 1,079 full-time and 13 part-time employees. The Company operates under a hybrid work policy that allows employees to work remotely if they so choose and if the scope of their job duties is suitable for remote work. As of December 31, 2023, approximately 48% of employees worked within a commutable distance from one of the Company's three offices, while the remaining 52% did not. HealthStream’s culture is both exemplified and driven by our Constitution, which is a living document and the lens through which we endeavor to view and shape our actions. Our Constitution is comprised of the Company’s vision statement, values, and business principles. Upon being hired at HealthStream, each employee completes a course on our Constitution, which we view to be an important step in engagement, development, and training of our employees. Our Constitution is available on our website on the Investor Relations page. This and other information on our website is not a part of this Annual Report on Form 10-K and is not incorporated by reference herein. HealthStream is committed to recruiting, maintaining, and growing a diverse, equitable, and inclusive workforce that helps us live our Constitutional values as we strive to achieve positive results for our shareholders, employees, customers, and community. The labor market for personnel, including technical personnel, continues to be competitive. For additional information regarding risks related to the current competitive labor market, see Item 1A. Risk Factors — “We operate in a challenging market for talent and may fail to attract and retain qualified personnel, including key management personnel.” INFORMATION ABOUT OUR EXECUTIVE OFFICERS The following is a brief summary of the business experience of each of the executive officers of the Company. Executive officers of the Company are elected by the Board of Directors and serve at the pleasure of the Board of Directors. The following table sets forth certain current information regarding the executive officers of the Company: Name Age Position Robert A. Frist, Jr. 56 Chief Executive Officer and Chairman of the Board of Directors Michael M. Collier 48 Executive Vice President, Corporate Strategy and Development Michael Sousa 55 Executive Vice President, Enterprise Applications Scott A. Roberts 47 Senior Vice President and Chief Financial Officer Jeffrey D. Cunningham 57 Senior Vice President and Chief Technology Officer Trisha L. Coady 48 Senior Vice President, Workforce Development Solutions M. Scott McQuigg 56 Senior Vice President, Digital & Network Development Kevin O’Hara 54 Senior Vice President, Platform Solutions Scott Fenstermacher 55 Senior Vice President, Sales 9 Table of Contents Robert A. Frist, Jr., one of our co-founders, has served as our chief executive officer and chairman of the board of directors since 1990. Mr. Frist is the company’s chief operating decision maker. He graduated with a Bachelor of Science in Business with concentrations in Finance, Economics, and Marketing from Trinity University. Michael M. Collier joined the Company in August 2011 as vice president and general counsel, began serving as the vice president of business development and general counsel shortly thereafter, was promoted to senior vice president in July 2017, and was promoted to executive vice president, corporate strategy and development in April 2022. From August 2011 through the end of 2022, Mr. Collier also served as the Company’s Corporate Secretary. He graduated with bachelors and masters degrees in Philosophy and Religion from University of Tennessee-Knoxville and earned a Juris Doctorate (J.D.) from University of California, Berkeley – School of Law. Michael Sousa joined the Company in October 2004 and served as senior vice president of sales from January 2010 to June 2014. In June 2014, he was promoted to senior vice president of business development. In February 2015, he was named president of HealthStream’s Provider Solutions business segment, while continuing to serve as a senior vice president of the Company. In February 2023, he was promoted to executive vice president, Enterprise Applications. He earned a Bachelor of Science degree from Boston College and a Master of Business Administration from Boston University. Scott A. Roberts joined the Company in January 2002 and served as vice president of accounting and finance beginning in January 2015, following service in multiple positions to which he was promoted. Thereafter, Mr. Roberts was appointed as interim chief financial officer in February 2019 and was appointed as chief financial officer and senior vice president of the Company in September 2019. He earned a Bachelor of Business Administration degree from Middle Tennessee State University. Jeffrey D. Cunningham joined the Company in July 2017 as senior vice president and chief technology officer. Prior to joining the Company, he founded and served as chief technology officer and chief strategy officer for Informatics Corporation of America for twelve years. He earned a Bachelor of Science in Computer Science from University of North Texas. Trisha L. Coady joined the Company in January 2014 and served as associate vice president and subsequently vice president and general manager of clinical development solutions from June 2015 to November 2018. In November 2018, she was promoted to senior vice president and general manager of clinical solutions. Ms. Coady currently serves as senior vice president of workforce development solutions. She earned a Bachelor of Science in Nursing degree from Université de Moncton. M. Scott McQuigg joined the Company in January 2019 as senior vice president of hStream solutions and then served as general manager of scheduling solutions. Mr. McQuigg currently serves as senior vice president of digital & network development. Prior to joining the Company, he co-founded and served as chief executive officer for GoNoodle for thirteen years. Before this role, he co-founded and served as chief executive officer of HealthLeaders. Kevin O’Hara joined the Company in January 2021 as senior vice president and general manager of platform solutions and currently serves as senior vice president of platform solutions. Prior to joining the Company, he served as chief product officer for Caresyntax for one year and as chief executive officer for Syus, a predecessor entity, for eight years. He earned a Bachelor of Arts in Public Policy Studies and a J.D. from Vanderbilt University. Scott Fenstermacher joined the Company in 2012 and served as vice president of sales beginning in 2017 and was promoted to senior vice president of sales in January 2021. He graduated from University of Pittsburgh with a Bachelor of Arts and a Bachelor of Science. 10 Table of Contents