What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-02-28 compared with 2024-02-26 · 82 added, 71 removed, 368 unchanged (29% of the section changed)

8 unchanged sentences

economy, or reductions in information technology spending, could limit our ability to grow our business and negatively affect our operating results.

has recently experienced negative macroeconomic conditions, including as the result of significant inflationary pressures, elevated interest rate levels, and challenging labor market conditions.

has experienced challenging macroeconomic conditions in recent periods in certain respects, including as the result of significant inflationary pressures, ongoing elevated interest rate levels, and challenging labor market conditions.

Continued global economic uncertainty, political conditions, and fiscal challenges in the U.S.

and abroad, such as inflation and potential recessionary conditions, have, among other things, limited our ability to forecast future demand for our products and services, contributed to increased volatility in customer demand, and could constrain future access to capital for ourselves, our suppliers, customers, and partners.

In this regard, we have recently experienced, and believe that many of our customers have experienced, increased labor, supply chain, capital, and other expenditures associated with current inflationary pressures.

While inflationary conditions have decreased in comparison to recent periods, we believe that many of our customers have experienced increased labor, supply chain, capital, and other expenditures associated with recent inflationary pressures.

Moreover, these conditions impacting the U.S.

1 unchanged sentence

In addition, if current economic conditions in the U.S.

significantly deteriorate, any such developments could materially and adversely affect our results of operations, financial position, and/or cash flows.

significantly deteriorate, including as a result of the impact of increased tariffs or trade restrictions, our results of operations, financial position, and/or cash flows could be materially and adversely affected.

Our operating results may vary based on the impact of changes in our industry or the economy on us or our clients.

3 unchanged sentences

To the extent that economic uncertainty or weak economic conditions cause our clients and potential clients to freeze or reduce their headcount or operations, demand for our products may be negatively affected.

Moreover, prior economic downturns and the current economic circumstances have resulted in overall reductions in spending by some healthcare providers as well as pressure from some clients and potential clients for extended billing terms.

If ongoing negative economic conditions persist or deteriorate, our clients and potential clients may elect to decrease their budgets for our solutions by deferring or reconsidering purchases, which would limit our ability to grow our business and negatively affect our operating results.

If current economic conditions deteriorate, our clients and potential clients may elect to decrease their budgets for our solutions by deferring or reconsidering purchases or could file for bankruptcy, which has occurred from time to time.

Such budget decreases or bankruptcy filings would limit our ability to grow our business and negatively affect our operating results.

Moreover, other economic, regulatory, or other developments that adversely or disproportionately impact the healthcare industry may reduce spending on information technology by healthcare organizations and otherwise adversely affect our customer base.

1 unchanged sentence

These developments could reduce our sales or adversely impact the ability of our customers to pay for our products and services.

In addition, any reductions in government health care spending in an effort to reduce the U.S.

federal deficit could result in reduced demand for our products or additional pricing pressure.

Further, there is ongoing uncertainty regarding the federal budget and federal spending levels, including the possible impacts of a failure to increase the “debt ceiling.” Any U.S.

In addition, budget pressures at the federal and state levels have had and may continue to have a negative impact on spending for many health and human services programs, including Medicare and Medicaid, which represent significant payor sources for our customers.

We anticipate that federal and state budget deficits and growing governmental healthcare expenditures will continue to place pressure on governmental healthcare programs.

Any reductions in government healthcare spending, including as a result of deficit reduction initiatives, could result in reduced demand for our products or additional pricing pressure.

Further, there is ongoing uncertainty regarding the federal budget and federal spending levels, including the possible impacts of a failure to increase the “debt ceiling.” Additionally, the current presidential administration has announced a planned advisory commission, the "Department of Government Efficiency," to reform federal government process and reduce expenditures, which could reduce federal spending or give rise to separate efforts at the state level to reduce governmental spending, in a manner that could adversely impact our healthcare clients and, ultimately, us.

Moreover, any U.S.

government default on its debt could have broad macroeconomic effects.

Moreover, any future shutdown of the federal government or failure to enact annual appropriations could adversely affect our financial results due to the reliance of many of our customers on payments from third-party healthcare payors, including Medicare, Medicaid, and other government-sponsored programs.

In addition, pressures on and uncertainty surrounding the US.

Federal government's budget and potential changes in spending levels, as well as any shutdown of the federal government, failure to enact annual appropriations, or holds on congressionally authorized spending, could adversely affect our financial results due to the reliance of many of our customers on payments from third-party healthcare payors, including Medicare, Medicaid, and other government-sponsored programs.

We may be unable to effectively execute our business strategy, which could have an adverse effect on our business and competitive position in the industry.

15 unchanged sentences

failure of the market for our products and services to grow to a sufficient size or at a sufficient rate;

negative impact on our customers and our business related to the ongoing impact of the pandemic (or concerns over the possibility of another public health crisis or pandemic);

inability to hire sufficient number of qualified employees to execute and support the growth of the Company.

3 unchanged sentences

In the event that we are unable to effectively execute on this strategy or are otherwise adversely affected by our shift to this One HealthStream approach, our business and financial results may be adversely affected.

A deterioration of public health conditions associated with COVID-19, a future pandemic, epidemic, or public health event, or a future catastrophic event, could adversely affect our business and financial results.

If public health conditions related to COVID-19 significantly worsen, our business and financial results could be adversely impacted.

Moreover, conditions related to COVID-19 continue to evolve, and we may not be able to predict or effectively respond to future developments.

We face a wide variety of risks related to potential future public health crises, epidemics, pandemics, or similar events, including as a result of the potential impact of any such events on our healthcare customers that could in turn adversely impact us.

If a new health epidemic or outbreak were to occur, our business and financial results could be adversely impacted, including in a similar or more extensive manner to how our business was adversely impacted by COVID-19.

If any such event were to occur or if public health conditions in the U.S.

were to significantly deteriorate, our business and financial results could be adversely affected.

Our business could also be adversely impacted by catastrophic events (particularly in areas where we have office locations and/or where we have network infrastructure), such as fires, earthquakes, hurricanes, natural disasters, civil unrest, military conflicts or warfare (such as the war in the Ukraine or the conflict in the Middle East), geographic instability, terrorist attacks, pandemics or other public health emergencies, or the effects of climate change (such as drought, flooding, wildfires, increased storm severity and sea level rise).

A deterioration of public health conditions associated with a future pandemic, epidemic, or public health event, or a future catastrophic event, could adversely affect our business and financial results.

We face a wide variety of risks related to the emergence and effects of potential future epidemics, pandemics, outbreaks of infectious disease or other public health crises.

Our primary customers are healthcare organizations, which are particularly vulnerable to health and economic effects of public health conditions.

The potential impact of a future public health crisis on our customers could, in turn, adversely impact our business, including in a similar or more extensive manner to how our business was adversely impacted by COVID-19.

It is difficult to predict how and when a future public health crisis may evolve, and we may not be able to predict or effectively respond to any such future developments.

If a new public health crisis emerges or if public health conditions in the U.S.

significantly deteriorate, our business and financial results could be adversely affected.

Our business could also be adversely impacted by catastrophic events (particularly in areas where we have office locations and/or where we have network infrastructure), such as fires, earthquakes, hurricanes, natural disasters, social or civil unrest, military conflicts or warfare (such as the war in the Ukraine or the conflict in the Middle East), geographic instability, terrorist attacks, or the effects of climate change (such as drought, flooding, wildfires, increased storm severity and sea level rise).

We may be unable to effectively identify, complete, or integrate the operations of acquisitions, joint ventures, collaborative arrangements, or other strategic investments, which would inhibit our ability to execute upon our growth strategy.

As part of our growth strategy, we actively review possible acquisitions, joint ventures, collaborative arrangements, or strategic investments that complement or enhance our business.

For example, in 2024, we completed the acquisitions of TCPS and The Clinical Hub.

However, we may be unable to source or complete future acquisitions, joint ventures, collaborative arrangements, or other strategic investments on acceptable terms or at all.

19 unchanged sentences

Further, valuations of non-marketable equity investments are inherently complex due to the lack of readily available market data.

We may experience additional volatility to our financial results due to changes in market prices of our marketable equity investments, the valuation and timing of observable price changes or impairments of our non-marketable equity investments, including impairments to such investments as a result of current negative macroeconomic conditions, and changes in the proportionate share of earnings and losses or impairment of our equity investments accounted for under the equity method.

We may experience additional volatility to our financial results due to changes in market prices of our marketable equity investments, the valuation and timing of observable price changes or impairments of our non-marketable equity investments, including impairments to such investments as a result of challenging conditions or other developments, and changes in the proportionate share of earnings and losses or impairment of our equity investments accounted for under the equity method.

This volatility could be material to our results in any particular period.

Our financial performance may be difficult to predict as the result of lengthy and widely varying sales cycles and other factors.

The period from our initial contact with a potential customer and such customer’s first purchase of our solution typically ranges from three to nine months, and in some cases may be significantly longer.

The period from our initial contact with a potential customer and such customer’s first purchase of our solutions typically ranges from three to nine months, and in some cases may be significantly longer.

Sales of additional solutions to existing customers may also experience sales cycles ranging from three to nine months, or longer.

The range in the sales cycle can be impacted by multiple factors, including an increasing trend towards more formal request for proposal processes and more competition within our industry, delays associated with the impact of the pandemic, as well as formal budget timelines which impact timing of purchases by target customers.

The range in the sales cycle can be impacted by multiple factors, including customer size, an increasing trend towards more formal request for proposal processes and more competition within our industry, increased customer-driven security assessments, as well as formal budget timelines which impact timing of purchases by target customers.

New products, including those that may compete with or replace our former product offerings, tend to have a longer and more unpredictable revenue ramp period because of varying customer adoption rates.

8 unchanged sentences

We encounter direct competition from both large and small companies focused on providing solutions that compete with those we offer.

Given the profile and growth of the healthcare industry and the ongoing need for training, simulation, scheduling, credentialing, and other information products and services, it is likely that additional competitors will emerge.

Additionally, mergers of or other strategic transactions by our competitors could weaken our competitive position.

1 unchanged sentence

These companies may be able to respond more quickly than we can to new or changing opportunities, technologies, standards, or customer requirements.

Additionally, given the evolving nature of technology, our technology enabled offerings may be disrupted by innovative or emerging technologies, such as artificial intelligence, blockchain, Web3, or quantum computing technologies, and such disruption could adversely impact our ability to compete.

Additionally, the development of AI/ML and other emerging technologies is complex and uncertain and presents various risks and uncertainties, including as the result of the rapidly evolving legal, regulatory, and ethical landscape associated with the use of AI/ML, and could subject us to competitive harm, legal and regulatory risk, and increase our cybersecurity, intellectual property, and privacy risks.

Further, given the evolving nature of technology, our technology enabled offerings may be disrupted by innovative or emerging technologies, such as AI/ML, blockchain, Web3, or quantum computing technologies, and such disruption could adversely impact our ability to compete.

Further, most of our customer agreements are for terms ranging from one to five years, with no obligation to renew.

2 unchanged sentences

The Company has expanded its business model by offering third parties the ability to utilize their sales teams to market and sell their third-party products and have such products delivered through the Company’s technology platform, provided such third parties pay a network connectivity fee when such products are sold to customers in our network.

Given that these third parties are responsible for their products and the marketing and selling thereof, the Company may not always be able to ensure the operational, financial, or security-related performance or impact of products controlled by a third party.

While we have contractual protections with third parties regarding their products, including but not limited to service levels, information security, confidentiality, data rights, and indemnification against certain breaches, these may not be sufficient to ensure the predictability or performance of such products, or potential negative impacts related thereto.

41 unchanged sentences

A termination or material modification of our agreements with any of our significant customers or a failure of these customers to renew their contracts on favorable terms, or at all, could have an adverse effect on our business.

However, during the years ended December 31, 2024, 2023, and 2022, no single customer accounted for 10 percent or more of our annual revenue.

A significant portion of our business is subject to renewal.

24 unchanged sentences

Additionally, our subscription model also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as revenue from new customers must be recognized over the applicable subscription term.

Moreover, as noted above, we generally have contract terms ranging from one to five years, and the fees payable under a majority of contracts were often determined without reference to any increases in the consumer price index or similar inflation-related metric over the term of such contract, although we intend to implement such provisions going forward to the extent possible.

Moreover, as noted above, we generally have contract terms ranging from one to five years, and the fees payable under a majority of contracts were often determined without reference to any increases in the consumer price index or similar inflation-related metric over the term of such contract, although we have begun to implement such provisions in contracts executed in 2024.

As such, particularly for longer term contracts, we have been, and may continue to be, adversely impacted by inflationary conditions such as those that the U.S.

economy is currently experiencing given that the fees that we are receiving during the outstanding term of such contracts will not be impacted by general price increases resulting from inflation whereas such inflationary conditions may increase the amount of labor, capital, and other expenditures we incur in connection with the operation of our business.

economy has experienced in recent periods given that the fees that we are receiving during the outstanding term of such contracts will not be impacted by general price increases resulting from inflation whereas such inflationary conditions may increase the amount of labor, capital, and other expenditures we incur in connection with the operation of our business.

We may not be able to meet our strategic business objectives unless we obtain additional financing, which may not be available to us on favorable terms or at all.

6 unchanged sentences

At December 31, 2024, we had approximately $97.2 million in cash, cash equivalents, and marketable securities.

We also have up to $50.0 million of availability under our Revolving Credit Facility, subject to certain covenants, which expires in October 2026.

We also have up to $50.0 million of availability under our Revolving Credit Facility, subject to certain covenants and minimum liquidity requirements, which expires in October 2026.

We cannot be assured that if we need additional financing, it will be available on terms favorable to us or at all.

6 unchanged sentences

Economic, legal, regulatory, competitive, reputational, contractual, and other factors could result in future declines in the operating results of our business units or market values that do not support the carrying value of goodwill, identifiable intangible assets, long-lived assets, and strategic investments.

Moreover, the risk of such declines in operating results and market values, and thus, potential goodwill impairment, may be increased by current negative macroeconomic conditions.

Moreover, the risk of such declines in operating results and market values, and thus, potential goodwill impairment, may be increased as the result of negative macroeconomic conditions.

If the value of our goodwill, intangible assets, long-lived assets, or strategic investments is impaired, accounting principles require us to reduce their carrying value and report an impairment charge, which would reduce our reported assets and earnings for the period in which an impairment is recognized.

1 unchanged sentence

Our clients are concentrated in the healthcare industry, which is subject to changing regulatory, economic, and political conditions.

In recent years, there have been significant changes at the federal and state levels, many of which have been aimed at reducing costs and government spending and increasing access for health insurance.

The most prominent of these reform efforts, the Patient Protection and Affordable Care Act, as amended by the Healthcare and Education Reconciliation Act of 2010 (collectively, the ACA), affects how healthcare services are covered, delivered, and reimbursed and expanded health insurance coverage.

The ACA has been, and continues to be, subject to legislative and regulatory changes and court challenges.

There is uncertainty regarding whether, when, and how the ACA will be further changed and how the law will be interpreted and implemented.

The healthcare industry has been and continues to be impacted by healthcare reform effects at the federal and state levels.

Many recent changes have been aimed at reducing costs and government spending and increasing access to health insurance.

For example, the Patient Protection and Affordable Care Act, as amended by the Healthcare and Education Reconciliation Act of 2010 (collectively, the ACA), increased health insurance coverage through a combination of public program expansion and private sector insurance reforms.

However, changes in the law’s implementation, subsequent legislation and regulations, state initiatives, and other factors have affected and may continue to affect health insurance coverage and various other elements of the ACA.

In addition, the Medicare and Medicaid programs are subject to change, including as a result of the recent change in the presidential administration.

For example, some members of Congress have proposed measures intended to accelerate the shift from traditional Medicare to Medicare Advantage, or repealing the Affordable Care Act or eliminating some of its consumer protections.

Changes in governmental administration, including changes in agency structures and staffing, such as reduction or elimination of personnel and agencies, may also result in changes to established rulemaking conventions and timelines, including for regularly issued reimbursement rules, among other effects.

Other recent health reform initiatives and proposals at the federal and state levels include those focused on price transparency and out-of-network charges, such as the No Surprises Act, and those intended to advance value-based payment efforts.

Some members of Congress have proposed significantly expanding the coverage of government-funded programs, while others have proposed reducing them.

At the state level, there has been increasing acceptance of interstate licensure compacts and uniformity in licensure requirements, which may reduce continuing education requirements for some professionals and impact demand for our services.

2 unchanged sentences

Other reforms or industry changes may reduce payments from third-party healthcare payers, including Medicare and Medicaid, to our customers.

There is uncertainty regarding whether, when, and what other health reform initiatives will be adopted and the impact of such efforts on the healthcare industry.

Any legal or regulatory developments, or other developments affecting participants in the healthcare industry.

that adversely impact the business or financial condition of our clients could reduce the amount of business we receive from such clients and thus have an adverse effect on our results of operations.

There is uncertainty regarding whether, when, and what other public policy initiatives will be adopted through governmental avenues and/or the private sector, the timing and implementation of any such efforts, and the impact of those efforts on providers and other healthcare industry participants.

It is difficult to predict the nature and/or success of current and future public policy changes, any of which may have an adverse effect on the operations, business, or financial condition of our clients.

If our clients or potential clients are adversely affected by public policy developments, it could reduce the amount of business we receive from such clients, negatively impact our ability to attract new clients, or require us to make changes to our operations or consider price concessions or other less favorable contract terms, which could reduce our revenues and otherwise have an adverse effect on our results of operations.

We may discover weaknesses in our internal controls over financial reporting, which may adversely affect investor confidence in the accuracy and completeness of our financial reports and consequently the market price of our securities.

41 unchanged sentences

Our network infrastructure and computer systems and software may fail.

The performance of our information systems is critical to our business operations.

An unexpected event (including but not limited to a cyber-security incident, such as a ransomware attack, denial-of-service attack, security compromise, or other attempts to misappropriate our confidential information;

telecommunications failure;

public health crisis, such as an epidemic or pandemic;

public health crisis;

or other catastrophic loss) at or impacting our Internet service providers’ facilities, our on-site data center facilities, or our public-cloud infrastructure providers, could cause the loss of critical data and prevent us from offering our products and services for an unknown period of time.

Our or a third party's disaster recovery planning cannot account for all eventualities, or may not be sufficient to mitigate against or recover from any of these events.

Although we have taken measures intended to prevent potential problems that could affect our information systems, our or a third party's disaster recovery planning cannot account for all eventualities, or may not be sufficient to mitigate against or recover from any of these events.

We also may incur increased operating expenses to recover data, including ransom payments made to cyber-attackers, repair or remediate systems, equipment or facilities, and to protect ourselves from such disruptions.

In addition, we may encounter challenges as a result of increased acceptance of remote work environments.

For example, the daily activities and productivity of our workforce is now more closely tied to key vendors, such as video conference services, consistently delivering their services without material disruption.

In addition, we may encounter challenges as a result of reliance on remote work environments.

For example, the daily activities and productivity of our workforce is tied to key vendors, such as video conference services, consistently delivering their services without material disruption.

Our ability to deliver information using the Internet and to operate in a remote working environment may be impaired because of infrastructure failures, service outages at third party Internet providers, malicious attacks or other factors.

3 unchanged sentences

While our service providers have planned for certain contingencies, the failure by any of these third parties to provide these services satisfactorily and our inability to find suitable replacements would impair our ability to access archives and operate our systems and software, and our customers may encounter delays.

Such disruptions could harm our reputation and cause customers to become dissatisfied and possibly take their business to a competing provider, which would adversely affect our financial performance.

A data breach or cybersecurity incident could result in a loss of confidential data, give rise to remediation and other expenses, expose us to liability under federal and state data protection and data privacy requirements, foreign data privacy regulations, consumer protection laws, common law theories, and other laws, rules and regulations, subject us to litigation and governmental inquiries and actions, damage our reputation, and otherwise adversely impact our financial results and business.

Such disruptions could harm our reputation, cause customers to become dissatisfied and possibly take their business to a competing provider, and negatively impact our ability to attract new customers, which would adversely affect our financial performance.

A data breach or cybersecurity incident could result in a loss of confidential data, give rise to remediation and other expenses, expose us to liability, subject us to litigation and governmental inquiries and actions, damage our reputation, and otherwise adversely impact our financial results and business.

We collect and store personal data and sensitive information, including intellectual property, protected health information (PHI) as defined under HIPAA and other individually identifiable health information, provider credentialing and privileging data, education records, and other sensitive personal information, on our networks.

In addition, there are a variety of other national, foreign, and international laws and regulations that apply to the collection, use, retention, protection, security, disclosure, transfer, and other processing of personal data, including, but not limited to:

the Family Educational Rights and Privacy Act (FERPA), the European Union’s General Data Protection Regulation (GDPR), the United Kingdom's General Data Protection Regulation (which implements the GDPR into U.K.

law), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Australia's Privacy Act 1988, and New Zealand's Privacy Act 2020.

In addition, various states, including California, Virginia, Colorado, Utah, and Connecticut, have passed data privacy laws, and federal lawmakers have proposed additional legislation.

The laws and regulations to which we are subject are rapidly evolving and changing and could have an adverse effect on our operations.

Companies’ obligations and requirements under these laws and regulations are subject to uncertainty in how they may be interpreted by government authorities and regulators.

The costs of compliance with, and the other burdens imposed by, these and other laws or regulatory actions may increase our operational costs, affect our customers’ willingness to permit us to use and store personal data and sensitive information, prevent us from selling our products or services, and/or affect our ability to invest in or jointly develop products.

We may be exposed to litigation, including through private rights of action, regulatory fines, penalties, or other sanctions and damage to our reputation if the personal, confidential, or proprietary information of our customers is not handled in compliance with these laws or is otherwise mishandled or misused by us or any of our suppliers, ecosystem partners, counterparties, or other third parties, or if such third parties do not have appropriate controls in place to protect such personal, confidential, or proprietary information.

We may also face audits or investigations by one or more domestic or foreign government agencies relating to our compliance with these regulations.

We are directly subject to certain HIPAA privacy and security requirements.

The secure maintenance of personal data and sensitive information is critical to our business operations.

As a result, the continued development and enhancement of controls, processes, and practices designed to protect our information systems from attack, damage, or unauthorized access remain a priority for us.

If the security measures that we use to protect personal data and sensitive information, or other data of our customers and business relations, are ineffective, we may lose users of our services, which could reduce our revenue, tarnish our reputation, and subject us to significant liability.

In addition, if our subcontractors, subprocessors, or various other vendors and service providers on which we rely fail or if they fail to use adequate security or data protection processes or use personal data and sensitive information in an unpermitted or improper manner, we may be liable for losses as a result of their breach and, as a result, we may incur damage to our reputation.

Additionally, our costs and efforts associated with obtaining and maintaining certain certifications related to data privacy and protection may also increase, to the extent we are able to obtain or maintain such certifications at all.

If the security measures that we use to protect personal data, sensitive information, or other data of our customers and business relations, are ineffective, we may lose users of our services, which could reduce our revenue, tarnish our reputation, and subject us to significant liability.

In addition, if our subcontractors, subprocessors, or various other vendors and service providers on which we rely fail to use adequate security or data protection processes or use personal data and sensitive information in an unpermitted or improper manner, we may be liable for losses as a result of their breach and, as a result, we may incur damage to our reputation.

Additionally, we may encounter challenges obtaining and maintaining certifications related to data privacy and protection, or the costs and efforts associated with maintaining these certifications may increase.

The current cyber threat environment presents increased risk for all companies, including companies in our industry, and cyberattacks have become increasingly frequent, sophisticated, and difficult to detect.

While we have implemented multiple layers of security measures to protect personal data and sensitive information that we collect and store, there is no assurance that these security measures will not be circumvented, including by new technological developments.

While we have implemented multiple layers of security measures to protect our information technology structure and the personal data and sensitive information that we collect and store, there is no assurance that these security measures will not be circumvented, including by new technological developments.

Moreover, advanced new attacks that may be directed at us or our third-party vendors create risk of cybersecurity incidents, including ransomware, malware, and phishing incidents.

1 unchanged sentence

Additionally, in the current environment, it has become increasingly prevalent for malicious actors to target vendors, such as ourselves, as a means through which to gain unauthorized access to the systems and sensitive information of organizations such as healthcare providers, which comprise our primary customer base.

In addition, the rapid evaluation and increased adoption of artificial technologies may heighten our cybersecurity risks by making cybersecurity attacks more difficult to detect, contain, and mitigate.

In addition, the rapid evaluation and increased adoption of AI and other emerging technologies may heighten our cybersecurity risks by making cybersecurity attacks more difficult to detect, contain, and mitigate.

Further, the audit processes, penetration and vulnerability testing, and controls used within our production platforms may not be sufficient to identify and prevent errors or deliberate misuse.

4 unchanged sentences

For example, third-party IT vendors may not provide us with fixes or updates to hardware or software in a manner as to avoid an unauthorized loss, access, or disclosure of data or to address a known vulnerability, which may subject us to known threats and cause system failures or disruptions.

Third-party vendors that store or have access to our data may not have effective controls, processes, or practices to protect our information or systems from attack, damage, or unauthorized access.

Third-party vendors that store or have access to our data, or operate networks or services on which we rely, may not have effective controls, processes, or practices to protect our information or systems from attack, damage, or unauthorized access.

These risks may be heightened in connection with employees and service providers working from remote work environments, as our dependency on certain service providers, such as video conferencing and web conferencing services, has significantly increased.

2 unchanged sentences

Moreover, in spite of our security measures, we have experienced data and cybersecurity incidents from time to time in the course of our business and have handled those incidents in accordance with our internal policies and our understanding of applicable laws.

There is no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident or data breach in the future that will materially affect us.

There is no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident or data breach in the future bypassing our security measures that materially affects us, including as the result of a loss of personal data or other confidential information, or the disruption of our information systems or business.

In the future, data breaches or security incidents could result from a variety of circumstances and events, including third party action or inaction, system errors or downtime, employee negligence or error, malfeasance, failures during the process of upgrading or replacing software, databases, or components thereof, power outages, hardware failures, telecommunication failures, user errors, catastrophic events, or threats from malicious persons and groups, new vulnerabilities, and advanced new attacks against information systems, including those against our vendors and customers.

7 unchanged sentences

and otherwise adversely impact our business.

There can be no assurance that we will not be subject to cybersecurity incidents that bypass our security measures, result in loss of personal data or other confidential information, or disrupt our information systems or business.

In addition, data and cybersecurity incidents, particularly if a large number of individuals are affected or if the compromised information is highly sensitive, could expose us and our customers to liability under privacy, security, and consumer protection laws, such as HIPAA, FERPA, and state privacy laws, and foreign data privacy regulations, or subject us to litigation under these or other laws, including common law theories.

Moreover, such incidents could subject us to federal and state governmental disclosure requirements, inquiries, or enforcement, result in civil monetary penalties, settlement agreements, corrective action plans, and monitoring requirements, require us to devote significant management resources to address and respond to any such cybersecurity events, interfere with the pursuit of other important business strategies, and/or cause us to incur additional expenditures, which could be material, including to investigate such events, remedy cybersecurity problems, recover lost data, and adapt systems and practices in response to such events.

In addition, data and cybersecurity incidents, particularly if a large number of individuals are affected or if the compromised information is highly sensitive, could expose us and our customers to litigation and liability under federal, state, and foreign privacy, security, and consumer protection laws and regulations, such as HIPAA and FERPA or common law theories.

Such incidents could also subject us to federal and state governmental disclosure requirements, inquiries, or enforcement, result in civil monetary penalties, settlement agreements, corrective action plans, and monitoring requirements, require us to devote significant management resources to address and respond to any such cybersecurity events, interfere with the pursuit of other important business strategies, and/or cause us to incur additional expenditures, which could be material, including to investigate such events, remedy cybersecurity problems, recover lost data, and adapt systems and practices in response to such events.

Moreover, there is no assurance that any remedial actions will meaningfully limit the success of future attempts to breach our information systems or the information systems of third parties with which we interact.

Further, we are subject to an increasing number of cybersecurity reporting obligations in different jurisdictions that vary in their scope and application, which may create conflicting reporting obligations and inhibit our ability to quickly provide complete and reliable information about cybersecurity incidents to customers, counterparties, and regulators, as well as the public.

In addition, our cyber liability and business interruption insurance may not cover or adequately compensate us for losses that may occur in connection with any cybersecurity incident.

Furthermore, we have acquired a number of companies, products, services, and technologies in recent years.

Although we devote significant resources to address any security issues with respect to such acquisitions, we still may inherit additional security risks when we integrate those companies within HealthStream.

Although we devote resources to address any security issues with respect to such acquisitions, we still may inherit additional security risks when we integrate those companies within HealthStream.

Moreover, if a high-profile security breach occurs with respect to an industry peer, our customers and potential customers may lose trust in the security of our solutions in general.

8 unchanged sentences

Further, a list of providers’ privileges may be made available to the general public by hospitals and medical practices, and errors in credentialing and privileging may result in damage to the hospital, medical practice, or provider.

We may also be required to indemnify against such claims and defending against any such claims could be costly and time-consuming and could negatively affect our business and may not be fully insured.

We may also be required to indemnify against such claims and defending against any such claims could be costly, could negatively affect our business, and may not be fully insured.

Risks Related to Government Regulation, Content, and Intellectual Property

1 unchanged sentence

The laws and regulations that govern our business change rapidly, are often inconsistent between jurisdictions, and in certain respects have become, and may continue to become, more complex and restrictive.

Evolving areas of law that are relevant to our business include privacy and security laws, proposed encryption laws, content regulation, information security accountability regulation, sales and use tax laws, laws related to the use of artificial intelligence and machine learning applications, and regulations and attempts to regulate activities on the Internet.

Evolving areas of law that are relevant to our business include privacy and security laws, proposed encryption laws, content regulation, information security accountability regulation, sales and use tax laws, laws related to the use of AI/ML applications, and regulations and attempts to regulate activities on the Internet.

For example, we are directly subject to certain requirements of the HIPAA privacy and security regulations.

1 unchanged sentence

Further, government laws and regulations that directly affect our customers can have an indirect impact on our business.

FERPA, the European Union’s General Data Protection Regulation (GDPR), the United Kingdom's General Data Protection Regulation (which implements the GDPR into U.K.

law), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Australia's Privacy Act 1988, and New Zealand's Privacy Act 2020.

In addition, many states have passed consumer data privacy laws, and federal lawmakers have proposed additional legislation.

The laws and regulations to which we are subject are rapidly evolving and changing and could have an adverse effect on our operations.

The obligations and requirements under these laws and regulations are subject to uncertainty in how they may be interpreted by government authorities and regulators.

We may also face audits or investigations by one or more domestic or foreign government agencies relating to our compliance with these regulations.

We may also be required to develop features, enhancements, or modifications to our products to support our customers’ evolving compliance obligations.

9 unchanged sentences

The rapidly evolving and uncertain regulatory and technology environment could require us to change how we do business or incur additional costs.

It may be difficult to predict how changes to these laws and regulations might affect our business.

While we strive to adhere our practices and procedures to the laws that are applicable to our business, we may not be able to timely adapt to evolving rules and regulations, interpretations, and regulator discretion.

It may be difficult to predict how changes to applicable laws and regulations and current and future initiatives related to technology might affect our business.

Different interpretations or enforcement of, or changes to, relevant laws and regulations in the future could subject our current or past practices to allegations of impropriety or illegality and could require us to alter to our operations.

Further, a regulator or court could disagree with our interpretation of these laws and regulations.

Failure to comply with applicable legal or regulatory requirements in the U.S.

or in any of the countries in which we operate could result in significant legal and financial exposure, damage to our reputation, subject us to contractual penalties (including termination of our customer agreements), adversely affect our ability to retain clients and attract new clients, or otherwise have a material adverse effect on our business operations, financial condition, and results of operations.

or in any of the countries in which we operate could result in significant legal and financial exposure, damage to our reputation, subject us to administrative, civil, and contractual penalties (including termination of our customer agreements), adversely affect our ability to retain clients and attract new clients, or otherwise have a material adverse effect on our business operations, financial condition, and results of operations.

Any reduction or change in the regulation of continuing education and training in the healthcare industry may adversely affect our business.

A portion of our business model is dependent in part on required training and continuing education for healthcare professionals and other healthcare workers resulting from regulations of state and federal agencies, state licensing boards, and professional organizations.

Any change in these regulations and professional standards that reduce the requirements for continuing education and training for the healthcare industry could harm our business.

Any change in these regulations and professional standards that reduce the requirements for continuing education and training for the healthcare industry could reduce the demand for our services and harm our business.

In addition, a portion of our business with pharmaceutical and medical device manufacturers and hospitals is predicated on our ability to maintain accreditation status with organizations such as the ACCME and ANCC.

30 unchanged sentences

We use open source software in our products and may use more open source software in the future.

From time to time, there have been claims challenging the ownership of open source software against companies that incorporate it into their products.

As a result, we could be subject to suits by parties claiming ownership of what we believe to be open source software.

From time to time, there have been claims challenging the use of open source software against companies that incorporate it into their products.

As a result, we could be subject to suits by parties claiming rights in our proprietary products that include certain open source software.

Litigation could be costly for us to defend, have a negative effect on our operating results and financial condition, or require us to devote additional research and development resources to change our products.

23 unchanged sentences

increased financial accounting and reporting burdens and complexities associated with implementing and maintaining adequate internal controls;

regulations, health guidelines, and safety protocols in foreign jurisdictions related to the pandemic;

potential regulations, health guidelines, and safety protocols in foreign jurisdictions related to public health emergencies within those jurisdictions;

restrictions on repatriation of earnings.

16 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors