Privia Health Group, Inc. 10-K

ITEM 1A. RISK FACTORS RISK FACTORS Investing in our common stock involves a high degree of risk. You should carefully consider the risks and uncertainties described below, together with all of the other information contained in this report, including our consolidated financial statements and the related notes thereto, before making a decision to invest in our common stock. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that affect us. If any of the following risks occur, our business, financial condition, operating results and prospectus could be materially and adversely affected. In that event, the price of our common stock could decline, and you could lose all or part of your investment. Risk Factor Summary The following is a summary of risks factors that could materially and adversely affect our business, financial conditions and results of operations. • we conduct business in a heavily regulated industry, and if we fail to comply with applicable healthcare laws and government regulations, which may change from time to time, we could incur financial penalties, become excluded from participating in government health care programs, and be required to make significant operational changes or experience adverse publicity, which could harm our business; • our business model could be challenged and, if any challenges are successful, we could incur financial penalties, become excluded from participating in government health care programs, be required to make significant operational changes or experience adverse publicity, which could harm our business; • our actual or perceived failure to adequately protect the privacy and security of our patients’ information, or a breach of our patient’s information could result in financial penalties, require us to incur significant costs to mitigate such, and result in adverse publicity, which could harm our business; • our history of net losses, and our ability to achieve or maintain profitability in an environment of increasing expenses; • evolving government regulations may increase costs or negatively impact our results of operations; • the COVID-19 pandemic may continue to, or other national or global issues may arise that could, have an adverse impact on our business, operations, and the markets and communities in which we operate; • the impact on our business of security breaches, loss of data or other disruptions causing the compromise of sensitive information or preventing us from accessing critical information, put our patient data at risk, and result in financial penalties and require us to incur significant costs to mitigate such, and result in adverse publicity, which could harm our business; • our ability to compete in the healthcare industry; • our dependence on reimbursements by third-party payers and payments by individuals; • our reliance on third-party vendors to host and maintain the Privia Technology Solution; • failure to maintain and renew existing physician practices, Privia Physicians, health system or hospital partners, or commercial payer customers do not continue to renew their contracts with us; • failure to adequately expand our direct sales force and our business development staff; • the viability of our growth strategy and our ability to realize expected results; • the impact on our business of disruptions in our disaster recovery systems or management continuity planning; • our ability to develop and maintain proper and effective internal control over financial reporting; • the potential adverse impact of legal proceedings and litigation; • our ability to maintain and enhance our reputation and brand recognition; • our ability to properly structure and perform under our value-based care programs; • our ability to retain senior management team and other key employees given the current labor market, escalating inflation and salary demands; and • overall business results may suffer from an economic downturn. 27 Table of Contents Risks Related to Government Regulation, Our Business and Our Industry We conduct business in a heavily regulated industry, and if we fail to comply with applicable healthcare laws and government regulations, we could incur financial penalties, become excluded from participating in government health care programs, be required to make significant operational changes or experience adverse publicity, which may adversely affect our business. The U.S. healthcare industry is heavily regulated and closely scrutinized by federal, state and local authorities. Comprehensive statutes and regulations govern the manner in which our Medical Groups provide and bill for services and collect reimbursement from governmental health care programs and commercial payers, our contractual relationships with our Privia Providers, vendors, health network partners and customers, how we contract with commercial payers, our marketing activities and other aspects of our operations. Of particular importance are: • state laws that prohibit general business corporations, such as us, from practicing medicine, controlling Privia Physicians’ medical decisions or engaging in practices such as splitting professional fees with Privia Physicians; • federal and state laws pertaining to non-physician clinicians, such as nurse practitioners and physician assistants, including requirements for physician supervision of such practitioners and reimbursement-related requirements; • the federal physician self-referral law, commonly referred to as the Stark Law, which, subject to certain exceptions, prohibits physicians from referring Medicare or Medicaid patients to an entity for the provision of certain “designated health services”, or DHS, such as laboratory and other ancillary health care services if the physician or a member of the physician’s immediate family has a direct or indirect financial relationship (including an ownership interest or a compensation arrangement) with the entity, and prohibits the entity from billing Medicare or Medicaid for such DHS; • the federal Anti-Kickback Statute, or AKS, which, subject to certain exceptions known as “safe harbors,” prohibits the knowing and willful offer, payment, solicitation or receipt of any bribe, kickback, rebate or other remuneration, directly or indirectly, overtly or covertly in cash or in kind, to induce, or in return for, either the referral of an individual, or the lease, purchase, order or recommendation of, items or services covered, in whole or in part, by government healthcare programs such as Medicare and Medicaid. Although there are a number of statutory exceptions and regulatory safe harbors protecting some common activities from prosecution, the exceptions and safe harbors are drawn narrowly. By way of example, the AKS safe harbor for value-based arrangements requires, among other things, that the arrangement does not induce a person or entity to reduce or limit medically necessary items or services furnished to any patient. Failure to meet the requirements of a safe harbor, however, does not render an arrangement illegal, although such arrangements may be subject to greater scrutiny by government authorities. Further, a person or entity can be found guilty of violating the statute without actual knowledge of the statute or specific intent to violate it; • federal and state civil and criminal false claims laws, including the False Claims Act, or FCA, which prohibit, among other things, individuals or entities from knowingly presenting, or causing to be presented, false or fraudulent claims for payment to, or approval by Medicare, Medicaid, or other federal health care programs, knowingly making, using or causing to be made or used a false record or statement material to a false or fraudulent claim or an obligation to pay or transmit money to the federal government, or knowingly concealing or knowingly and improperly avoiding or decreasing an obligation to pay money to the federal government. There are many potential bases for liability under the FCA. The government has used the FCA to prosecute Medicare and other government healthcare program fraud such as coding errors, billing for services not provided, and providing care that is not medically necessary or that is substandard in quality. In addition, we could be held liable under the FCA if we are deemed to “cause” the submission of false or fraudulent claims by, for example, providing inaccurate billing, coding or risk adjustment information to our Medical Groups and Privia Providers. The government may also assert that a claim including items or services resulting from a violation of the AKS or Stark Law constitutes a false or fraudulent claim for purposes of the FCA. The FCA also permits a private individual acting as a “whistleblower” to bring actions on behalf of the federal government alleging violations of the FCA and to share in any monetary recovery; • the criminal healthcare fraud provisions of the federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, and their implementing regulations, or collectively, HIPAA, and related rules that prohibit knowingly and willfully executing, or attempting to execute, a scheme or artifice to defraud any healthcare benefit program or obtain, by means of false or fraudulent pretenses, representations, or promises, any of the money or property owned by, or under the custody or control of, any healthcare benefit program, regardless of the payer (e.g., public or private), and knowingly and willfully falsifying, concealing or 28 Table of Contents covering up by any trick or device a material fact or making any material false, fictitious or fraudulent statement in connection with the delivery of or payment for health care benefits, items or services. Similar to the federal Anti-Kickback Statute, a person or entity can be found guilty of violating the statute without actual knowledge of the statute or specific intent to violate it; • civil monetary penalties laws, which impose civil fines for, among other things, the offering or transferring of remuneration to a Medicare or state healthcare program beneficiary if the person knows or should know it is likely to influence the beneficiary’s selection of a particular provider, practitioner, or supplier of services reimbursable by Medicare or a state healthcare program, unless an exception applies; • federal and state laws that prohibit our Medical Groups from billing and receiving payment from Medicare and Medicaid for services unless the services furnished by our Privia Providers are medically necessary, adequately and accurately documented, timely submitted and billed using codes that accurately reflect the type and level of services rendered; • Medicare and Medicaid regulations, manual provisions, local coverage determinations, national coverage determinations and agency guidance that impose complex and extensive requirements upon healthcare providers, including our Medical Groups and Privia Providers; • state laws that prohibit physicians from splitting professional fees with non-physicians, whether individuals or entities, or place restrictions on how such professional fees may be split with non-physicians, including, for instance, prohibitions on percentage-based management fees; • federal and state laws that regulate healthcare-related debt collection practices, pricing transparency and protecting patients from surprise billings; • a provision of the Social Security Act that imposes criminal penalties on healthcare providers who fail to disclose, or refund known overpayments; • federal and state antitrust laws that prohibit or limit exclusive contracting relationships with healthcare providers, prohibit or limit the sharing of cost and pricing data, prohibit competitors from taking collective action to set commercial payer reimbursement rates, and determine when a joint venture or health care network is sufficiently integrated, by either sharing substantial financial risk or substantial clinical integration, to jointly contract with commercial payers; • federal and state laws and policies related to healthcare providers’ licensure, certification, accreditation, Medicare and Medicaid program enrollment and reassignment of benefits; • federal and state laws and policies related to the prescribing, administrating and dispensing of pharmaceuticals and controlled substances; • state laws related to the advertising and marketing of services by healthcare providers, including Medical Group and Privia Physicians; • federal laws that impose civil administrative sanctions for, among other violations, inappropriate billing of services to government health care programs or employing or contracting with individuals who are excluded from participation in government health care programs; • laws and regulations limiting the use of funds in health savings accounts for individuals with high deductible health plans; • federal and state laws regarding such telemedicine services, including necessary technological standards to deliver such services, coverage restrictions associated with such services, and the amount of reimbursement for such services; • state laws pertaining to anti-kickback, fee splitting, self-referral and false claims, some of which are not consistent with comparable federal laws and regulations, including, for example, not being limited in scope to relationships involving government health care programs; • federal and state laws pertaining to the collection, use, retention, protection, security, disclosure, transfer and processing of personal data; and 29 Table of Contents • state insurance laws governing what healthcare entities may bear financial risk and the allowable types of financial risks, including direct primary care programs, provider-sponsored organizations, ACOs, independent practice associations, and provider capitation. To enforce compliance with the federal laws, the U.S. Department of Justice and the U.S. Department of Health and Human Services Office of Inspector General, or OIG, regularly scrutinize healthcare providers, which has led to a number of investigations, prosecutions, convictions and settlements in the healthcare industry. Responding to and managing government investigations can be time and resource-consuming, divert management’s attention from the business and generate adverse publicity. Any such investigation or settlement could increase our costs or otherwise have a negative impact on our business, even if we are ultimately found to be in compliance with the relevant laws. Moreover, if one of our physician or health system partners, or another third party fails to comply with applicable laws and becomes the target of a government investigation, government authorities could require our cooperation in the investigation, which could cause us to incur additional legal expenses, divert management’s attention from the business and result in adverse publicity. In addition, because of the potential for large monetary exposure under the federal False Claims Act, which provides for treble damages and significant penalties, healthcare providers often settle allegations without admissions of liability for significant amounts to avoid the potential of penalties and treble damages that may be awarded in litigation proceedings. Such settlements often contain additional compliance and reporting requirements as part of a consent decree, settlement agreement or corporate integrity agreement, which may result in significant costs for several years after resolution of the original allegations and may slow our overall growth. Given the significant size of actual and potential settlements, it is expected that the government will continue to devote substantial resources to investigating healthcare providers’ compliance with the myriad of healthcare reimbursement rules and fraud and abuse laws. Because of the breadth of these laws and the narrowness of the statutory exceptions and safe harbors available, it is possible that some of our business activities could, despite our efforts to comply, be subject to challenge under one or more of such laws. Achieving and sustaining compliance with these laws may prove costly. The risk of our being found in violation of these laws and regulations is increased by the fact that many of them have not been fully interpreted by regulatory authorities or the courts, and their provisions are sometimes complex and open to a variety of interpretations. Our operating model seeks to structure each Medical Group as a “group practice” for purposes of the Stark Law. The Stark Law’s “group practice” definition is subject to a multi-factor analysis under the current regulatory scheme with many of the factors having multiple options for compliance. Many of the individual factors have not been subject to meaningful judicial interpretation or regulatory agency guidance, and such regulatory agency guidance is subject to change periodically. Furthermore, the test is not static, and our Medical Groups and their relationships with Privia Physicians must be periodically reviewed to ensure that they continue to meet the definition and that the safeguards built into the various agreements are being implemented and administered as required. It is possible that governmental and enforcement authorities will conclude that our business practices may not comply with the Stark Law, current or future statutes, regulations or case law interpreting applicable fraud and abuse or other healthcare laws and regulations. Depending on the circumstances, failure to meet applicable regulatory requirements can result in civil, administrative, and criminal penalties such as criminal prosecution, fines, damages, disgorgement, individual imprisonment, recoupments of overpayments, imprisonment, loss of enrollment status, exclusion from participation in federal and state funded health care programs, contractual damages, reputational harm and the curtailment or restricting of our operations, as well as additional reporting obligations and oversight if we become subject to a corporate integrity agreement or other agreement to resolve allegations of non-compliance with these laws. In addition, in order to achieve compliance with current and future regulatory requirements, we may need to discontinue an aspect of our current business or expend significant costs altering our business structure, operations, or relationship with certain third-parties, including Privia Providers and health system partners, payers, and vendors. Our failure to accurately anticipate the application of these laws and regulations to our business or any other failure to comply with current or future regulatory requirements could create liability for us and negatively affect our business. Any action against us for violation of these laws or regulations, even if we successfully defend against it, could cause us to incur significant legal expenses, divert our management’s attention from the operation of our business and result in adverse publicity. Our business could be adversely affected by legal challenges to our Medical Groups’ ability to provide services via telehealth in certain jurisdictions. The ability to conduct telehealth services in a particular state is directly dependent upon the applicable laws governing remote healthcare, the practice of medicine and healthcare delivery in general in such jurisdiction, which are subject to new laws and regulations, and changing interpretations of existing laws and regulations. In the past, state medical boards have implemented new rules or interpreted existing rules in a manner that has limited or restricted the ability of our Medical Groups to provide telehealth services, such as laws that require a provider to be licensed and/or physically located in the same state where the patient is located. Federal and state laws regarding such services, necessary technological standards to deliver such services, coverage restrictions associated with such services, and the amount of reimbursement for such services are subject to changing political, regulatory and other influences. For example, of the jurisdictions in which we currently operate, Virginia, Texas, Florida and the District of Columbia are not members of the Interstate Medical Licensure Compact, which streamlines the process by which physicians licensed in one state are able to practice in other participating states. Failure to comply with these laws could result in denials of reimbursement for our 30 Table of Contents Privia Providers’ services (to the extent such services are billed), recoupments of prior payments, professional discipline for our Privia Providers and/or civil or criminal penalties against our Medical Groups. During the COVID-19 pandemic, many states enacted waivers and adopted other temporary measures that lifted certain restrictions on out-of-state providers and waived certain license requirements to allow greater access to telehealth services during the public health emergency period. The CMS, the federal agency responsible for administering the Medicare program, also made several changes in the manner in which Medicare pays for telehealth visits, many of which relaxed previous requirements, including originating site requirements for both the providers and patients, telehealth modality requirements and others. Many of these measures are effective only for the duration of the COVID-19 public health emergency, which is scheduled to end on May 11, 2023. The Consolidated Appropriations Act of 2023 extended many of the COVID-19 public health emergency provisions related to telehealth until December 31, 2024. It is unclear which, if any, of these changes related to telehealth will remain in place permanently and which will be rolled-back after December 31, 2024. Similarly, any state law and enforcement changes that arose as part of the public health emergency declaration may cease or be rolled back after May 11, 2023. Although we are still gauging the overall impact of such changes to our business, the expiration of the public health emergency will result in certain costs that have been borne by the government being passed on to patients and will reduce funding to state Medicaid agencies, which will result in less patients covered by Medicaid thereby increasing both the cost of collections and potential bad debt to health care providers. All of these changes could adversely affect our financial conditions and results of operations. Our revenues and profits could be diminished if we fail to retain our Privia Physicians or fail to recruit new Privia Physicians to affiliate with our Medical Groups. Our operating model relies significantly on aggregating a sufficient number of Privia Physicians in each of our Medical Groups. The number of Privia Physicians in a particular market impacts our ability to negotiate competitive reimbursement rates with commercial payers, impacts our attributed lives for VBC purposes, impacts our unit cost in furnishing our services across geographic markets, and, our revenue from the provision of management services through the MSA we enter into with the Non-Owned Medical Groups. We still experience provider attrition within our Medical Groups resulting from retirement, disability, death and Privia Physicians pursuing other opportunities including hospital or health system employment, concierge medicine practices, and the sale of their Affiliated Practices. The departure of large number of Privia Providers, or the departure of key Privia Physicians’ Affiliated Practices with large patient populations, could negatively impact our revenue in the short term, and may adversely affect our ability to perform under our VBC arrangements, including our financial performance and our ability to timely and accurately meet reporting requirements. Further, the loss of any Privia Physician may result in such Privia Physician’s patient population transferring to a non-Privia Provider, which could reduce our overall revenues and profits. Moreover, we may not be able to attract new Privia Physicians to replace the services of departing Privia Physicians or to service our obligations under a government health care program, such as the MSSP or Medicare Advantage plans, or a VBC arrangement with a commercial payer. Our standard agreements between our Medical Groups and our Privia Physicians do not generally prohibit Privia Physicians from competing with us after the term of the agreements. Further, in our deals with certain Medical Groups where we have post-termination non-compete obligations and other restrictive covenants that prohibit our Privia Providers from working with a competitor of ours, there can be no assurance that such non-compete agreements when asserted against a departing Privia Provider will be found enforceable if challenged in certain states. In such event, we could be unable to prevent such departing Privia Provider and other providers formerly affiliated with us from competing with us and/or our Medical Groups, potentially resulting in the loss of some of our patients, which could negatively affect our overall revenues and profits. Further, as we move into new markets, our success in each market is dependent on our ability to recruit a sufficient number of Privia Providers to allow us to fully implement our operating model. Our failure to do so may ultimately result in our inability to compete effectively in such market. In addition, as we incur significant upfront time and costs in operating in a new market, including management time and attention, our failure to compete effectively in a new market could negatively affect our profits as well as our reputation within the larger physician community. We are dependent on our relationships with Medical Groups, some of which we do not own, to furnish Privia Providers, to provide professional services to patients on behalf of federal health care programs as defined in 42 U.S.C. 1320a-7(f) and commercial payers, and our business could be adversely affected by legal challenges to our business model. Our operating model includes Owned Medical Groups, Non-Owned Medical Groups, MSOs that furnish management services on behalf of our Medical Groups and ACOs, a technology-enabled platform that overlays our Privia Providers’ EMR, and, in most markets, a separate legal entity that serves as an ACO under the MSSP as established by the Patient Protection and Affordable Care Act and a provider network vehicle for VBC on behalf of our Medical Groups as well as, in certain markets, independent, non-Privia Providers. Our ability to conduct business in each state is dependent upon that specific state’s treatment of each component of the Privia operating model under such state’s laws, regulations and policies governing the practice of medicine, physician fee splitting prohibitions, state restrictions on the use and disclosure of patient health information and other confidential information among the various components of our operating model, restrictions on the types of provider entities that can take financial risk or the types of 31 Table of Contents financial risks that can be assumed by providers before triggering the state’s insurance laws requiring licensure from the state’s insurance department or agency. The laws of many states, including states in which we currently operate, prohibit us from exercising control over the medical judgments or decisions of our Privia Physicians and from engaging in certain financial arrangements, such as splitting professional fees with Privia Providers or incentivizing certain types of utilization. These laws and their interpretations vary from state to state, and are enforced by state courts and regulatory authorities, each with broad discretion. We have relationships with Medical Groups in each of our markets which our Privia Providers join to furnish healthcare services as an integrated, single-TIN legal entity. When permitted under state law, these are structured as Owned Medical Groups and we own a majority interest in all of our Owned Medical Groups but, even in such markets, we and our MSOs are still prohibited from controlling any aspect of the practice of medicine, including, without limitation, decisions regarding professional medical judgment, diagnosis and treatment of patients and supervisory responsibility for all licensed non-physician clinicians, unlicensed individuals to whom the physician delegates nondiscretionary duties and any other individual providing any service that could constitute the practice of medicine. Our financial statements are consolidated in accordance with applicable accounting standards and include the accounts of our majority-owned subsidiaries. Such consolidation for accounting and/or tax purposes does not, is not intended to, and should not be deemed to, imply or provide us any control over the medical or clinical affairs of such practices. In other states, such as California, Texas and Tennessee, we are prohibited from having any ownership interest or governance control in our Medical Groups and these are structured as Non-Owned Medical Groups. In such instances, (i) we generally appoint a Privia Physician licensed in the market to the governing board of such Non-Owned Medical Groups but we have little in the way of governance control of the Non-Owned Medical Groups other than through our MSAs; or (ii) alternatively, in certain markets, we have begun to have certain licensed physicians with Privia leadership positions form professional entities to own the majority interest in Friendly Medical Groups. If a jurisdiction’s prohibition on the corporate practice of medicine is interpreted in a manner that is inconsistent with our practices, we could be required to restructure or terminate our arrangements with our Non-Owned Medical Groups and Friendly Medical Groups and could result in additional penalties, damages and fines. We enter into agreements with our Medical Groups in our various markets and through which our Privia Providers furnish healthcare services on behalf of our Medical Groups. In addition, we enter into contracts on behalf of our Medical Groups and ACOs with federal health care programs and commercial payers to deliver healthcare services in exchange for fees. Such fees may be structured as FFS, VBC or both. We also enter into exclusive MSAs with our Medical Groups pursuant to which the Medical Groups reserve exclusive control and responsibility for all aspects of the practice of medicine and the delivery of medical services. Our Medical Groups also enter into services arrangements with our Privia Physicians’ Affiliated Practices to provide certain services to support our Privia Physicians at their historic practice locations. Although we seek to substantially comply in all material respects with applicable state laws, including prohibitions on the corporate practice of medicine and fee splitting, state officials who administer these laws or other third parties may challenge our existing organization and contractual arrangements. If such a claim were successful, we could be subject to civil and criminal penalties and could be required to restructure or terminate the applicable contractual arrangements. A determination that these arrangements violate state statutes, or our inability to successfully restructure our relationships with our Medical Groups to comply with these statutes, could jeopardize our performance in federal health care programs and commercial payer arrangements, could result in a decrease in management fees under our MSAs, could slow our growth by making it harder to recruit Privia Physicians to join our Medical Groups, and could result in a renegotiation of our existing agreements with Privia Physicians, all of which could have a material adverse effect on our business, financial condition and the results of operations. The transition from fee-for-service to value-based reimbursement models may have a material adverse effect on our operations. Healthcare reform is causing some payers to transition from fee-for-service to value-based reimbursement models, which can include risk-sharing, bundled payment and other innovative approaches. While these models may provide us and our Medical Groups with opportunities to provide new or additional services and to participate in incentive-based payment arrangements, there can be no assurance that such new models and approaches will be profitable to us or our Medical Groups. Further, new models and approaches may require investment by us to develop technology or expertise to offer necessary and appropriate solutions or support to our Medical Groups, and we do not fully know the amount and timing for return of such investment at this time. In addition, some of these new models are being offered as pilot programs and there is no assurance that they will continue or be renewed. Many states in which these new value-based structures are being developed also lack regulatory guidance or a well-developed body of law for these new models and approaches, or may not have updated their laws or enacted legislation yet to reflect the new healthcare reform models. As a result, new and existing laws, regulations or guidance could have a material adverse effect on our operations and could subject us to the risk of restructuring or terminating our arrangements with our Medical Groups, as well as the risk of regulatory enforcement, penalties and sanctions, if state and federal enforcement agencies disagree with our interpretation of these laws. Regulation of downstream risk-sharing arrangements, including, but not limited to, capitation and other value-based arrangements, varies significantly from state to state. Some states require downstream entities and risk-bearing entities, or RBEs, to obtain an insurance license, a certificate of authority, or an equivalent authorization, in order to participate in downstream risk-sharing arrangements with payers. In some states, statutes, regulations and/or formal guidance explicitly address whether and in what manner the state regulates the transfer of risk by a payer to a downstream entity. However, the majority of states do not explicitly address the issue, and in such states, regulators may nonetheless interpret statutes and regulations to regulate such activity. If downstream risk- 32 Table of Contents sharing arrangements are not regulated directly in a particular state, the state regulatory agency may nonetheless require oversight by the licensed payer as the party to such a downstream risk-sharing arrangement. Such oversight is accomplished via contract and may include the imposition of reserve requirements, as well as reporting obligations. Further, state regulatory stances regarding downstream risk-sharing arrangements can change rapidly and codified provisions may not keep pace with evolving risk-sharing mechanisms and other new value-based reimbursement models. Certain of the states where we currently operate or may choose to operate in the future regulate the operations and financial condition of risk bearing entities. These regulations can include capital requirements, licensing or certification, governance controls and other similar matters. While these regulations have not had a material impact on our business to date, as we continue to expand, these rules may require additional resources and capitalization and add complexity to its business. The ACA also required CMS to establish a Medicare shared savings program that promotes accountability and coordination of care through the creation of Accountable Care Organizations, or ACOs. The Medicare shared savings program allows for providers, physicians and other designated health care professionals and suppliers to form ACOs and voluntarily work together to invest in infrastructure and redesign delivery processes to give coordinated high quality care to their Medicare patients, avoid unnecessary duplication of services and prevent medical errors. ACOs that achieve quality performance standards established by CMS are eligible to share in a portion of the Medicare program’s cost savings. Our ACOs include physicians and advanced practitioners in Florida, Georgia, Maryland, Tennessee, Texas, Virginia and Washington, DC in 2022. These ACOs participate in the MSSP, and are subject to ACO program methodologies and participation requirements that are updated by CMS for each performance year. We and our Medical Groups as ACO participants are expected to comply with such program requirements and are required to report to CMS on performance after the close of the year. Failure to comply with such program requirements could subject us and our Medical Groups to significant penalties and, in some cases, termination from participating in MSSP. Additionally, the Center for Medicare and Medicaid Innovation continues to test an array of value-based alternative payment models, including the recent replacement of the Global and Professional Direct Contracting, or GPDC, Model with the ACO Reach program as of January 1, 2023, through which providers can negotiate directly with the government to manage traditional Medicare beneficiaries and share in the savings and risks generated from managing such beneficiaries. Although we currently do not participate in all of these payment models, we may choose to do so in the future. In addition, there likely will continue to be regulatory proposals directed at containing or lowering the cost of healthcare, as government healthcare programs and other third-party payers transition from fee-for-service, or FFS, to value-based reimbursement models, which can include risk-sharing, bundled payment and other innovative approaches. It is possible that the federal or state governments will implement additional reductions, increases, or changes in reimbursement in the future under government programs that may adversely affect us or increase the cost of providing our services. The implementation of cost containment measures or other healthcare reforms may prevent us from being able to generate revenue or attain growth, any of which could have a material adverse effect on our business. Our operating model also seeks to structure each Medical Group with sufficient integration to allow such Medical Group to negotiate on behalf of its Privia Providers with both federal health care programs and commercial payers. That is, from federal and state antitrust law perspectives, each Medical Group is structured to be a single entity, with a single-TIN, fully capable of establishing the prices for which it sells its products and services. Our new Privia Care Partners model, which is less integrated than our historical Medical Groups, creates additional legal concerns especially under state and federal antitrust laws. We have structured these arrangements, often with the knowledge and support of payers, to either have significant clinical integration or share significant financial risk so as to allow for single signature contracting authority with payers. Similarly, our operational ACOs, which all participate in the MSSP, have been structured so that all participants in the ACO, including our Medical Groups, are substantially clinically integrated in accordance with guidance from the Federal Trade Commission to allow our ACOs to negotiate payer contracts, including pricing terms, on behalf of our participating providers, including our Medical Groups. We have not, however, requested a formal advisory opinion from the Federal Trade Commission or a business review from the Department of Justice Antitrust Division for either our Medical Groups or our ACO model. With respect to our ACOs, such entities typically participate in both the MSSP and commercial VBC arrangements. Given our MSSP participation, under the FTC and DOJ’s Statement of Antitrust Enforcement Policy Regarding Accountable Care Organizations Participating in the Medicare Shared Savings Program (the “Policy Statement”), our ACOs would be subject to a rule of reason analysis. Although we have not conducted a full calculation of our ACOs’ share of primary specialty services in each ACO participant’s Primary Service Area (“PSA”), our preliminary analysis is that each of our ACOs would fall outside of the Policy Statement’s safety zone (i.e., no more than 30% share of services in each PSA) and therefore, the FTC or DOJ could challenge our ACO as anticompetitive. We have, however, adopted policies and practices to ensure our compliance with the antitrust laws including limiting the anti-competitive effect of our higher share of physician services within our geographic markets. The Biden Administration appears committed to increasing antitrust enforcement and the scope of current antitrust laws as evidenced by Executive Order 14036 “Promoting Competition in the American Economy,” which, among other things, expresses concern about excessive market concentration in health care markets, including the insurance, hospital and prescription drug markets. Agency action to implement the Executive Order could limit, or increase the cost associated with, our growth plans, including limiting our ability to acquire competitors and grow at rates similar to our historic growth rates. Further, on February 3, 2023, the Department of Justice announced that it was withdrawing from its joint statements with the FTC, including the Policy Statement, and will determine the 33 Table of Contents anticompetitive nature of such relationships on a case by case basis. It is anticipated that the FTC will take a similar position in the coming weeks. Although the effect of such withdrawal on enforcement priorities and standards is unclear at this time, we do expect more antitrust scrutiny of health care industry generally and targeted scrutiny of companies such as ours that aggregate providers. A successful challenge of any of these components of our operating model could result in our restructuring our relationships with our Medical Groups and ACOs, and where such relationships cannot be successfully restructured could result in our inability to furnish services in certain markets. Further, depending on the enforcement agency an antitrust violation can result in enforcement actions against us, our Medical Groups and/or ACOs ranging from a cease and desist demand, to criminal enforcement with the potential for treble damages. Any such outcome could damage our reputation, jeopardize our existing business arrangements, and could have a material adverse effect on our business, financial condition and the results of operations. Even a successful defense of an antitrust claim can be very expensive, may distract key management, and can damage our reputation and impair our ability to recruit new physicians. We are dependent on our EMR vendor, athenahealth, Inc., which the Privia Technology Solution is integrated and built upon, and which we require all of our Owned Medical Groups to utilize and which is utilized by most of the Non-Owned Medical Groups, and our business could be adversely affected if that relationship were disrupted. Although we own all aspects of our athenaNet services, the Privia Technology Solution is not currently usable with other EMRs, and to move our Privia Providers to another EMR provider we would have to duplicate our services on that platform, which could require considerable effort, time and expense. While we have a positive working relationship with athenahealth, Inc., and while being one of their larger enterprise clients gives us priority access in resolving issues with the EMR and preferred pricing relative to going market rates, there is no assurance we will be able to maintain the relationship on positive terms. In addition, our dependency on athenahealth, Inc. creates significant risks related to service disruptions, potential cyberattacks experienced by athenaNet, cessation of operations of athenahealth, Inc., or price leveraging by athenahealth, Inc. A material change in our relationship with athenahealth, Inc., whether resulting from a dispute, a change in government regulation, or the loss of this relationship, could impair our ability to provide the same level of services to our Privia Providers for some period of time and could have a material adverse effect our business, financial condition and results of operations. We have a history of net losses, we anticipate increasing expenses in the future, and we may not be able to maintain profitability. We reported net (loss) income of $(8.6) million, $(188.2) million, and $31.2 million for the years ended December 31, 2022, 2021 and 2020, respectively. Our accumulated deficit is $(216.7) million and $(208.1) million as of December 31, 2022 and 2021, respectively. We expect our aggregate costs will increase substantially in the foreseeable future and we may experience losses as we expect to invest heavily in increasing and expanding our operations, hiring additional employees and operating as a public company. These efforts may prove more expensive than we currently anticipate, and we may not succeed in increasing our revenue sufficiently to offset these higher expenses. To date, we have financed our operations principally from revenue earned from our Medical Group’s billing and collection for healthcare services furnished by Privia Providers, revenues earned from VBCs with our ACOs, the incurrence of indebtedness and the sale of our equity. We may not generate positive cash flow from operations or achieve profitability in any given period, and our limited operating history may make it difficult for you to evaluate our current business and our future prospects. We have encountered and will continue to encounter risks and difficulties frequently experienced by growing companies in rapidly changing industries, including increasing expenses as we continue to grow our business. We expect our operating expenses to increase significantly over the next several years as we continue to hire additional personnel, expand our operations and infrastructure, and continue to expand to reach more patients. In addition to the expected costs to grow our business, we also expect to incur additional legal, accounting and other expenses as a newly public company. These investments may be more costly than we expect, and if we do not achieve the benefits anticipated from these investments, or if the realization of these benefits is delayed, they may not result in increased revenue or growth in our business. If our growth rate were to decline significantly or become negative, it could adversely affect our financial condition and results of operations. If we are not able to achieve or maintain positive cash flow in the long term, we may require additional financing, which may not be available on favorable terms or at all and/or which could be dilutive to our stockholders. If we are unable to successfully address these risks and challenges as we encounter them, our business, results of operations and financial condition could be adversely affected. Our failure to achieve or maintain profitability could negatively impact the value of our common stock. Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our patients, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, operations and our reputation. In the ordinary course of our business, we collect, store, use and disclose sensitive data, including PHI and other types of personal data or personal information, relating to our employees, our Privia Providers’ patients and others. We also process and store, and use third-party service providers to process and store, sensitive information, including intellectual property, trade secrets, confidential information and other proprietary business information. We manage and maintain such sensitive data and information utilizing a combination of managed data center systems and cloud-based computing center systems. 34 Table of Contents We are highly dependent on information technology networks and systems, including the internet, to securely process, transmit and store this sensitive data and information. Our information technology systems and those of our third-party service providers, strategic partners and other contractors or consultants are vulnerable to attack and damage or interruption from physical or electronic break-ins, computer viruses, and malware (e.g., ransomware), malicious code, natural disasters, terrorism, war, telecommunication, attacks by hackers, and employee or contractor error, negligence or malfeasance, denial or degradation of service attacks, sophisticated nation-state and nation-state-supported actors or unauthorized access or use by persons inside our organization, or persons with access to systems inside our organization. We utilize third-party service providers for important aspects of the collection, storage, processing and transmission of employee and patient information, and other confidential and sensitive information, and therefore rely on third parties to manage functions that have material cybersecurity risks. Because of the sensitivity of the PHI, other personal information and other sensitive information we, our Medical Groups and their legacy practices collect, store, transmit, and otherwise process, the security of our technology-enabled platform and other aspects of our services, including those provided or facilitated by our third-party service providers, are critical to our operations and business strategy. We take certain administrative, physical and technological safeguards to address these risks, such as evaluating such service providers before granting access to PHI or other personal information, and by requiring contractors and other third-party service providers who handle this PHI, other personal information and other sensitive information for us to enter into agreements that contractually obligate them to use reasonable efforts to safeguard such PHI, other personal information, and other sensitive information. Measures taken to protect our systems, those of our contractors or third-party service providers, or the PHI, other personal information, or other sensitive information we or contractors or third-party service providers process or maintain, may not adequately protect us from the risks associated with the collection, storage, processing and transmission of such sensitive data and information. We may be required to expend significant capital and other resources to protect against security breaches or to alleviate problems caused by security breaches. Despite our implementation of security measures, cyber-attacks are becoming more sophisticated and frequent. We experience cyber-attacks and other security incidents of varying degrees from time to time, though none which individually or in the aggregate has led to costs or consequences which have materially impacted our operations or business. On October 28, 2020, the Department of Health and Human Services (“HHS”) and the Federal Bureau of Investigation alerted health care providers that ransomware activity is currently targeting the healthcare and public health sectors. Ransomware attacks, including those from organized criminal threat actors, nation-states, and nation-state supported actors, are becoming increasingly prevalent and severe, and can lead to significant interruptions in our operations, loss of data and income, reputational loss, diversion of funds, and may result in fines, litigation and unwanted media attention. Given the current situation in Ukraine, more state-sponsored attacks on infrastructure directed towards United States infrastructure and targets, including health care organizations, may increase. Further, widely spread vulnerabilities, such as the Apache Log4j 2 vulnerability reported in December 2021, could affect our or our vendors’ systems. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting payments. Moreover, hardware, software or applications we use may have inherent vulnerabilities or defects of design, manufacture or operations or could be inadvertently or intentionally implemented or used in a manner that could compromise information security. There can be no assurance that we or our vendors and other third parties will not be subject to cybersecurity threats and incidents that bypass our or their security measures, impact the integrity, availability or privacy of personal health information or other data subject to privacy laws or disrupt our or their information systems, devices or business, including our ability to provide various health care services. Further, consumer confidence in the integrity and security of personal information and critical operations data in the health care industry generally could be shaken to the extent there are successful cyberattacks at other health care services companies, which could have a material adverse effect on our business, financial position or results of operations. We or our third-party service providers may be unable to anticipate these techniques or to implement adequate protective measures, especially as more workforce members and our vendors’ workforce continue to work remotely because of the COVID-19 pandemic. We may also experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. A security breach or privacy violation that leads to disclosure or unauthorized use or modification of, or that prevents access to or otherwise impacts the confidentiality, security, or integrity of, any personal information, patient information, including PHI subject to HIPAA or any other sensitive information we or our contractors or third-party service providers maintain or otherwise process, could harm our reputation, compel us to comply with breach notification laws, cause us to incur significant costs for remediation, fines, penalties, notification to individuals and for measures intended to repair or replace systems or technology and to prevent future occurrences, potential increases in insurance premiums, and require us to verify the accuracy of database contents, resulting in increased costs or loss of revenue. If we are unable to prevent or mitigate such security breaches or privacy violations or implement satisfactory remedial measures, or if it is perceived that we have been unable to do so, our operations could be disrupted, we may be unable to provide access to our systems, and we could suffer a loss of Privia Physicians and patients, and we may as a result suffer loss of reputation, adverse impacts on our Privia Providers, patients and investor confidence, financial loss, governmental investigations or other actions, regulatory or contractual penalties, and other claims and liability. In addition, security breaches and other inappropriate access to, or acquisition or processing of, information can be difficult to detect, and any delay in identifying such incidents or in providing any notification of such incidents may lead to increased organizational harm. Our service providers from time to time are subject to cyberattacks and security incidents. While we do not believe that we have experienced any significant system failure, accident or security breach to date, if such an event were to occur, it could compromise our 35 Table of Contents networks or data security processes and sensitive information could be made inaccessible or could be accessed by unauthorized parties, publicly disclosed, lost or stolen. Any such interruption in access, improper access, disclosure or other loss of information could result in legal claims or proceedings, liability under laws and regulations that protect the privacy of patient information or other personal information, such as HIPAA, and regulatory penalties. Unauthorized access, loss or dissemination could also disrupt our operations, including the ability of our Privia Providers to perform healthcare services, access patient health information, collect, process, and prepare company financial information, provide information about our current and future services and engage in other patient and clinician education and outreach efforts. Any such breach could also result in the compromise of our trade secrets and other proprietary information, which could adversely affect our business and competitive position. While we maintain insurance covering certain security and privacy damages and claim expenses, we may not carry insurance or maintain coverage sufficient to compensate for all liability and in any event, insurance coverage would not address the reputational damage that could result from a security incident. Further, we maintain copies of our critical operational information, including our EMR data, in different geographic settings and the cloud, and we may not be able to access such copies in the event of a national emergency or widespread natural disaster. Any such breach or interruption of our systems or those of any of our third-party service providers could have a material adverse effect on our business, results of operations, financial condition and cash flows. The healthcare industry is highly competitive. We compete directly with national, regional and local providers of healthcare services for patients, physicians, non-physician clinicians and skilled employees. There are many other companies and individuals currently providing healthcare services, including others with technology-enabled, nationally focused business models similar to ours. Many of these competitors have been in business longer than us and/or have substantially more resources than we do. Since there are virtually no substantial capital expenditures required for providing healthcare services, there are few financial barriers to entry in the healthcare industry. Other companies could enter the healthcare industry in the future and divert some or all of our business. We compete with different companies across certain lines of business, including companies with: dedicated brick-and-mortar locations which often target patients covered by Medicare Advantage plans (such as Oak Street Health), dedicated direct primary care locations which often target a commercial or employer-based patient population (such as One Medical), the ability to organize providers into accountable care organizations, allowing physicians to participate in VBC arrangements (such as Aledade) and the ability to partner with physicians groups to enable better care delivery primarily for seniors (such as Agilon Health or VillageMD). Our indirect competitors also include episodic point solutions, such as telemedicine offerings, as well as urgent care providers. We expect to face increasing competition, both from current competitors, who may be well established and enjoy greater resources or other strategic advantages to compete for some or all key stakeholders in our markets, as well as new entrants into our market. Our ability to compete successfully varies from location to location and depends on a number of factors, including the number of competing medical practices in the local market and the types of services available at those facilities, our local reputation for quality care of patients, the commitment and expertise of our Privia Physicians, our ability to obtain competitive reimbursement rates with commercial payers, our local service offerings and the success of physician sales efforts, the cost of care in each locality, and the physical appearance, location, age and condition of the various locations at which our Privia Physicians furnish patient care services. If we are unable to attract patients to our Medical Groups, our revenue and profitability will be adversely affected. Some of our competitors may have greater recognition and be more established in their respective communities than we are, and may have greater financial and other resources than we have. Competing medical practices may also offer larger facilities or different programs or services than we do, which, combined with the foregoing factors, may result in our competitors being more attractive to our current patients, potential patients and referral sources. Furthermore, while we budget for routine capital expenditures to stay competitive in our respective markets, to the extent that competitive forces cause those expenditures to increase in the future, our financial condition may be negatively affected. In addition, our relationships with federal health care programs and commercial payers are not exclusive, and our competitors have established or could seek to establish relationships with such payers to serve their covered patients. Additionally, as we expand into new geographical markets, we may encounter competitors with stronger relationships or recognition in the community in such new geography, which could give those competitors an advantage in obtaining physicians and new patients. Our Privia Providers, Non-Owned Medical Groups and companies in other healthcare industry segments, including those with which we have contracts, and some of which have greater financial, marketing and staffing resources, may become competitors in providing healthcare services, and this competition may have a material adverse effect on our business operations and financial position. Each of our revenue streams ultimately depends on reimbursements by third-party payers, as well as payments by individuals, which could lead to delays and uncertainties in the reimbursement process. The reimbursement process is complex and can involve lengthy delays. Although we recognize FFS revenue for our Owned Medical Groups when their associated Privia Providers approve the claims for providing services to patients, we may from time to time experience delays in receiving the associated reimbursement and, with respect to VBC arrangements, ultimate payment of any shared savings, bonuses, withholds and similar payments is received only after the close of the relevant measure period, which may be a calendar year, and then only after the payer has reconciled cost of care, FFS reimbursement paid, if any, reported quality data, and patient attribution resulting in significant delays between the provision of services and ultimate payment. In addition, third-party payers may disallow, in whole or in part, requests for reimbursement based on determinations that the patient is not eligible for coverage, certain amounts are not reimbursable under plan coverage or were for services provided that were not medically necessary, 36 Table of Contents not adequately documented or after submitting additional supporting documentation requested by the payer. Retroactive adjustments may change amounts realized and recognized as revenue from third-party payers. We are subject to audits by such payers, including governmental audits of our Medicare claims, and may be required to repay these payers if a finding is made that we were incorrectly reimbursed. Delays and uncertainties in the reimbursement process may adversely affect accounts receivable, increase the overall costs of collection and cause us to incur additional borrowing costs. Third-party payers are also increasingly focused on controlling healthcare costs, and such efforts, including any revisions to coverage and reimbursement policies, which may further complicate and delay our reimbursement of claims. In addition, certain of our patients are covered under health plans that require the patient to cover a portion of their own healthcare expenses through the payment of copayments or deductibles. We may not be able to collect the full amounts due with respect to these payments that are the patient’s financial responsibility, or in those instances where our Privia Physicians provide services to uninsured individuals or individuals for which the physician is out of network. To the extent permitted by law, amounts not covered by third-party payers are the obligations of individual patients for which we may not receive whole or partial payment. Any increase in cost shifting from third-party payers to individual patients, including as a result of high deductible plans for patients, increases our collection costs and reduces overall collections. As more of our Medical Groups’ revenue derive from VBC, our failure to adequately predict and control our Medical Groups’ costs and expenses, and to make reasonable estimates and maintain adequate accruals for incurred but not reported claims, could have a material adverse effect on our business, results of operations, financial condition and cash flows. To the extent that our Medical Groups’ patients require more care than anticipated or our medical costs and expenses exceed estimates, reimbursement paid under our VBC arrangements may be insufficient to cover costs. In any given situation, this may negatively impact both our revenue from Medical Groups and our revenue from the management services furnished to our Non-Owned Groups. Although we can mitigate some of this risk on a case-by case basis with stop loss coverage, we generally have little ability to increase our charges during the terms of our VBC arrangements and we may have minimal ability to control our Medical Groups’ patients’ decisions that may increase the total cost of care. The impact on us of recent healthcare legislation and other changes in the healthcare industry and in healthcare spending is currently unknown, but may adversely affect our business, financial condition and results of operations. The impact on us of healthcare reform legislation and other changes in the healthcare industry and in healthcare spending is currently unknown, but may adversely affect our business, financial condition and results of operations. Our revenue is dependent on the healthcare industry and could be affected by changes in healthcare spending, reimbursement and policy. The healthcare industry is subject to changing political, regulatory and other influences. By way of example, the ACA, which was enacted in 2010, made major changes in how healthcare is delivered and reimbursed, and it increased access to health insurance benefits to the uninsured and underinsured populations of the United States. We embrace many of the goals of the ACA, including our current ACOs actively participating in the MSSP, which have resulted in shared savings under the MSSP in excess of $380 million since we started participating in the program in 2014. Since its enactment, there have been judicial, executive and Congressional challenges to certain aspects of the ACA. On June 17, 2021, the U.S. Supreme Court dismissed the most recent judicial challenge to the ACA brought by several states without specifically ruling on the constitutionality of the ACA. Prior to the Supreme Court’s decision, President Biden issued an executive order initiating a special enrollment period from February 15, 2021 through August 15, 2021 for purposes of obtaining health insurance coverage through the ACA marketplace. The executive order also instructed certain governmental agencies to review and reconsider their existing policies and rules that limit access to healthcare. A number of legislative changes have been proposed and adopted since the ACA was enacted, including automatic, aggregate reductions to Medicare payments to providers. Although advocacy groups were successful in limiting the impact of these reductions in 2021 from 8.5% physician reimbursement reduction to a 2.5% physician reimbursement reduction, Congress continues to cut reimbursement annually and has thus far been unwilling to make any long-term legislative changes to how it reimburses for physician services. Congress, however, has passed legislation to increase the number of enrollees in exchange market plans. For example, the American Rescue Plan Act of 2021, signed into law March 11, 2021, included a number of provisions intended to shore up the ACA, including lower premiums for insurance purchased through the exchange marketplace, premium tax credits for insurance purchased by individuals on the exchange marketplace and providing significant subsidies for states that have not yet expanded their Medicaid programs under the ACA. This trend continued into 2022 with CMS adopting a final rule that went into effect January 1, 2023, which among other things, accelerates Medicare coverage for new enrollees and allows for special enrollment period in certain circumstances to reduce any gaps in Medicare coverage/ These changes as well as other administrative changes such as extending enrollment periods and increasing navigator funding may ultimately decrease our Medical Groups’ uninsured patient populations but at the same time, such changes may move patient populations from higher reimbursed commercial insurance to lower reimbursed exchange marketplace coverage. Although it is too early to determine the likely cumulative effect of these changes, such changes could negatively impact both our revenue and the revenue of our Medical Groups. Our operating model, the Privia Technology Solution and our revenue are dependent on the healthcare industry’s continued movement towards providers assuming more risk from payers for the cost of patient care. Any legislative, regulatory or industry changes that 37 Table of Contents slows or limits that movement or otherwise reduces the non-facility-based healthcare spending could most likely be detrimental to our business, revenue, financial projections and growth. VBC arrangements typically require providers to achieve certain quality indicators either as a gating prerequisite to realizing value-based revenue enhancements or as a positive or negative multiplier related to such payments, including, for example, the MSSP. Periodic changes to the quality metrics that our Privia Providers are required to report, either as to the included metric, how the metric is measured or the necessary thresholds for satisfying the metric, could adversely impact our revenue relative to such VBC arrangements. We are also impacted by the Medicare Access and CHIP Reauthorization Act, under which physicians must choose to participate in one of two Quality Payment Program (“QPP”) payment methodologies or “tracks” designed to reward physicians for delivering high-quality patient care: the Merit-Based Incentive Payment System, or MIPS; or participation in an Advanced Alternative Payment Model, or Advanced APM. CMS expects to transition increasing financial risk to providers as the QPP evolves. The Advanced APM track makes incentive payments available for participation in specific innovative payment models approved by CMS. Providers may earn a 5% Medicare incentive payment through 2024 and will be exempt from the reporting requirements and payment adjustments imposed under MIPS if the provider has sufficient participation (based on percentage of payments or patients) in an Advanced APM. Alternatively, providers may participate in the MIPS track. Currently, providers electing this option may receive payment incentives or be subject to payment reductions based on their performance with respect to clinical quality, resource use, clinical improvement activities specified by CMS, and meeting the “Promoting Interoperability” standards related to the meaningful use of EHRs. Performance data collected in 2022 may result in upward or downward payment adjustments of up to 9% in 2024. CMS makes available an exception that permits clinicians to request reweighing of any or all performance categories if they encounter an extreme and uncontrollable circumstance or public health emergency, such as COVID-19, that is outside of their control. As in 2020 and 2021, CMS continues to allow certain flexibility in its QPP for 2022 reporting under its extreme and uncontrollable circumstances policies, including, among other things, applying for a reweighting of MIPS performance categories due to the COVID-19 public health emergency and to allow individuals and groups that meet the activity criteria to receive credit for the COVID-19 clinical data reporting with or without clinical trial improvement activity through the MIPS 2022 performance period. Payments from such federal health care programs are subject to periodic statutory changes, annual regulatory changes, administrative rulings, interpretations and determinations, requirements for utilization review and federal and state funding restrictions, each of which could increase or decrease program payments, as well as affect the cost of providing service to patients and the timing of payments to our Medical Groups, and our ACOs. We are unable to predict the effect of recent and future policy changes on our operations. In addition, the uncertainty and fiscal pressures placed upon federal health care programs as a result of, among other things, deterioration in general economic conditions, reduced tax revenue and the funding requirements from the federal healthcare reform legislation, may affect the availability of taxpayer funds for such federal health care program. Current and prior healthcare reform proposals have included the concept of creating a single payer or public option for health insurance. If enacted, these proposals could have an extensive impact on the healthcare industry, including us. We are unable to predict whether such reforms may be enacted or their impact on our operations. Changes in federal health care programs may reduce the reimbursement we receive and could adversely impact our business and results of operations. As federal healthcare expenditures continue to increase, and state governments continue to face budgetary shortfalls, federal and state governments have made, and continue to make, significant changes in the Medicare and Medicaid programs. These changes include reductions in reimbursement levels and new or modified demonstration projects authorized pursuant to Medicaid waivers. Some of these changes have decreased, or could decrease, the amount of money our Medical Groups receive for furnishing patient care services relating to these programs. In some cases, private third-party payers rely on all or portions of Medicare payment systems to determine payment rates. Changes to federal health care programs that reduce payments under these programs may negatively impact the payments our Medical Groups receive from private third-party payers. We expect that additional state and federal healthcare reform measures will be adopted in the future, any of which could limit the amounts that federal and state governments and commercial payers will pay for healthcare services, which could harm our business, financial condition and results of operations. If reimbursement rates paid by commercial payers are reduced or if commercial payers otherwise restrain our ability to provide services to their enrollees through narrow network products or otherwise, our business could be harmed. Our typical agreements with commercial payers only secure agreed reimbursement rates for a relatively short period of time, generally for a period of one to three years. Likewise, at this time, all of our existing commercial payer contracts are local or regional contracts as opposed to national contracts. If any commercial payers reduce their reimbursement rates, elect not to cover some or all of our Medical Group’s healthcare services, or restrain our Privia Providers’ ability to furnish services to their patients through the use of tiered pricing or a narrow network offering, our business may be harmed. If such events were to occur, not only is revenue to our Medical Groups reduced, which in turn reduces our management fees, but if our commercial payer contracts are not competitive in a given market or we are unable to obtain a contract with certain commercial payers, we limit our ability to recruit new Privia Physicians and may not be able to achieve our growth expectations. Commercial payers often use plan structures, such as narrow networks or tiered networks, to encourage or require members to use in-network providers. In-network providers typically provide services through commercial payers for a negotiated lower rate or other less 38 Table of Contents favorable terms and achieve their margins by increased volume of services. Commercial payers generally attempt to limit the use of out-of-network providers by requiring members to pay higher copayment and/or deductible amounts for out-of-network care. Additionally, commercial payers have become increasingly aggressive in attempting to minimize the use of out-of-network providers by disregarding the assignment of payment from their enrollees to out-of-network providers (i.e., sending payments directly to members instead of to out-of-network providers), capping out-of-network benefits payable to members, waiving out-of-pocket payment amounts and initiating litigation against out-of-network providers for interference with contractual relationships, insurance fraud and violation of state licensing and consumer protection laws. If we become out-of-network for insurers, our business could be harmed and our patient service revenue could be reduced because members could stop using our services. Further, many states have laws and regulations that prevent providers from waiving patient out of pocket amounts, including out of network charges, when such providers submit their full charges to commercial payers. In December 2020, in connection with the enactment of the Consolidated Appropriations Act of 2021, the No Surprises Act introduced national limitations on billing for certain services furnished by providers who are not in-network with the patient’s self-insured health plan, individual or group health plan. On July 1, 2021, the Departments of Health and Human Services, Labor and Treasury issued an interim final rule implementing certain provisions of the No Surprises Act. On September 30, 2021, a second interim final rule was issued, subject to a public comment period, which closed on October 18, 2021. On November 17, 2021 a third interim final rule was issued, subject to a public comment period, which closed on January 24, 2022. The provisions of these rules, most of which went into effect on January 1, 2022, seek to limit excessive patient out-of-pocket amounts by limiting cost sharing for out-of-network services to in-network levels, requiring cost sharing for out-of-network payments to offset in-network deductibles, setting out-of-pocket maximums, requiring disclosure of patient protections against balance billing, and prohibiting balance billing under certain circumstances. These rules also establish the independent dispute resolution process that providers, facilities or providers of air ambulance services, and health plans or issuers will use to determine final payment beyond allowable patient cost-sharing for certain out-of-network healthcare services and require that certain providers and facilities provide a good faith estimate of the charges to uninsured (or self-pay) individuals so they can know what costs to expect when seeking healthcare. The agencies have continued to issue guidance regarding the implementation of the No Surprises Act, and the agencies’ interpretations of law’s requirements have continued to evolve. It is currently unclear how the No Surprise Act will impact our revenue, bad debt, and the competitive advantages of our Medical Groups being in network status across markets. Compliance will require additional training and the build-out of new safeguards to comport our Medical Groups’ billing and collection practices with the new requirements of these interim final rules. Reimbursement uncertainty also impacts our VBC revenue. In addition to potential changes to the terms of our existing VBC arrangements by the payers, our VBC revenue is also at risk based upon annual fluctuations in payment rates for certain VBC arrangements such as Medicare Advantage payment rates, changes in patient attribution, and changes in plan design by payers. Likewise, delay in information from payers may prevent our Medical Groups from being able to make any necessary changes to mitigate any quality concerns, attribution changes or total cost of care. Additionally, CMS’ risk adjustment payment system for health plans participating in Medicare Advantage can have a significant impact on payments our Medical Groups receive for from our contracted Medicare Advantage payers. Although we and our payers, have implemented auditing and monitoring processes to collect and provide accurate risk adjustment date to CMS such programs may be not be sufficient to ensure the accuracy of such data. CMS may also change the way they measure risk and the impact of such changes on our business are uncertain. There are significant risks associated with estimating the amount of revenues that we recognize under certain of our VBC arrangements with payers, and if our estimates of revenues are materially inaccurate, it could impact the timing and the amount of our revenue recognition or have a material adverse effect on our business, results of operations, financial condition and cash flows. There are significant risks associated with estimating the amount of revenues that we recognize under our VBC arrangements with payers in a reporting period. The billing and collection process is complex due to ongoing insurance coverage changes, geographic coverage differences, differing interpretations of contract coverage and other payer issues, such as ensuring appropriate documentation. Determining applicable primary and secondary coverage for our patients, together with the changes in patient coverage that occur each month, requires complex, resource-intensive processes. Errors in determining the correct coordination of benefits may result in refunds to payers. Revenues associated with Medicare and Medicaid programs are also subject to estimating risk related to the amounts not paid by the primary government payer that will ultimately be collectible from other government programs paying secondary coverage, the patient’s commercial health plan secondary coverage or the patient. Collections, refunds and payor retractions typically continue to occur for up to three years and longer after our Medical Groups’ services are provided. If our estimates of revenues are materially inaccurate, it could impact the timing and the amount of our revenues recognition and have a material adverse effect on our business, results of operations, financial condition and cash flows. Changes in the payer mix of patients and potential decreases in our reimbursement rates as a result of consolidation among commercial payers could adversely affect our revenues and results of operation. The amounts our Medical Groups receive for patient care services furnished to patients are determined by a number of factors, including the payer mix of our Privia Physicians’ patients and the reimbursement methodologies and rates utilized by our patients’ health insurance company. Reimbursement rates are generally higher for VBC than they are under traditional FFS arrangements, and 39 Table of Contents VBC provides us with an opportunity to capture any additional surplus we create by investing in population health services to better manage a particular patient’s care, which, in turn, should reduce the total cost of care. Under certain VBC arrangements, either our management service organizations or our ACOs may receive specific care management fees, administrative fees or other fees to cover such population health and care management services, which may be structured as a fixed fee per member per month, or PMPM, for such services. Any change in payer mix, which could result from payer restrictions on such narrow network products or economic downturn resulting in more uninsured patients or patients insured by state Medicaid programs, could adversely affect the overall reimbursement our Medical Groups receive from commercial payers. Further, changes in payer mix, may adversely impact our ability to recruit new physicians to affiliate with our Medical Groups, which could adversely affect our growth strategy and financial projections. The healthcare industry has also experienced a trend of consolidation across market segments, including the consolidation of commercial payers resulting in larger payers that have significant bargaining power, given their market share. Payments from commercial payers are the result of negotiated rates. These rates may decline based on renegotiations with larger payers resulting in higher discounted fee arrangements with healthcare providers. As a result, payers increasingly are demanding discounted fee structures or the assumption by healthcare providers of all or a portion of the financial risk related to the total cost of care of their enrollees. Reductions in the quality of services furnished by our Medical Groups or our ACO participants could have a material adverse effect on our business, results of operations, financial condition and cash flows. We monitor and manage quality metrics, including star rating for Medicare Advantage plans and MSSP quality metrics, and submit quality data on behalf of our Medical Groups, as well as our ACO participants. A failure to achieve threshold standards for quality metrics could result in the loss of any shared savings or other bonuses, or result in a reduction of such payments under VBC arrangements. Further, under the Medicare Advantage plans’ star rating system, lower star ratings correspond to lower quality ratings, and ultimately, lower payments to participating providers under the Quality Bonus Program. Further, with the implementation of MIPS and APMs, lower quality scores ultimately result in upward or downward adjustments to Privia Physicians’ Medicare Part B FFS payments. Further, lower quality ratings can potentially lead to the termination of an affiliate physician’s ability to participate in a particular commercial payer product or result in our Medical Groups not being able to participate in a particular VBC arrangement, tiered network or narrow network offering. All of these possible outcomes could have a material adverse effect on our business, results of operations, financial condition and cash flows. If we are not able to maintain and enhance our reputation and brand recognition, including through the maintenance and protection of trademarks, our business and results of operations will be harmed. We believe that maintaining and enhancing our reputation and brand recognition is critical to our relationships with Medical Groups, Privia Providers, patients, ACO participants, and commercial payers, and to our ability to attract new Medical Groups, Privia Physicians and patients. The promotion of our brand may require us to make substantial investments and we anticipate that, as our market becomes increasingly competitive, these marketing initiatives may become increasingly difficult and expensive. Our marketing activities may not be successful or yield increased revenue, and to the extent that these activities yield increased revenue, the increased revenue may not offset the expenses we incur and our results of operations could be harmed. In addition, any factor that diminishes our reputation or that of our management, including failing to meet the expectations of our Medical Groups, Privia Physicians, ACO participants, health system or hospital partners, patients, or commercial payer customers, or any adverse publicity or litigation involving or surrounding us, one of our Medical Groups, or our management, could make it substantially more difficult for us to attract new Privia Physicians. Similarly, because our existing Medical Groups often act as references for us with prospective Privia Physicians or new Medical Groups, any reputational concerns could impair our ability to secure additional new Privia Physicians and Medical Groups. In addition, negative publicity resulting from any adverse government payer audit could injure our reputation. If we do not successfully maintain and enhance our reputation and brand recognition, our business may not grow and we could lose our relationships with Privia Physicians, Medical Groups, ACO participants, health system or hospital partners, patients, or commercial payer customers, which could harm our business, results of operations and financial condition. The registered or unregistered trademarks or trade names that we own or license may be challenged, infringed, circumvented, declared generic, lapsed or determined to be infringing on or dilutive of other marks. We may not be able to protect our rights in these trademarks and trade names, which we need in order to build name recognition with patients, payers and other partners. In addition, third parties may in the future file for registration of trademarks similar or identical to our trademarks. If they succeed in registering or developing common law rights in such trademarks, and if we are not successful in challenging such third-party rights, we may not be able to use these trademarks to commercialize our technologies in certain relevant jurisdictions. If we are unable to establish name recognition based on our trademarks and trade names, we may not be able to compete effectively and our brand recognition, reputation and results of operations may be adversely affected. 40 Table of Contents Our sales and implementation cycle can be long and unpredictable and requires considerable time and expense, which may cause our results of operations to fluctuate. The sales cycle for physicians to become affiliated with our Medical Groups from initial contact with a potential lead to contract execution, varies widely and is unpredictable. Further, once a physician has executed the agreements associated with one of our Medical Groups, there is a long period of implementation where the physician and his or her staff are trained on our EMR, platform and workflows, which may range from two to eight months before the Privia Physician goes live with his or her Medical Group. During such implementation period, we are incurring costs associated with the implementation without any corresponding revenue. Our sales efforts involve educating potential Privia Physicians about our market offerings, the health care industry and the physician practice’s expected return on investment from becoming affiliated with the Medical Group. It is possible that in the future we may experience even longer sales cycles, especially with respect to moving into new geographic markets and as markets become more mature and concentrated, which could result in more upfront sales costs and less predictability in closing our Privia Physician sales. If our sales cycle lengthens or our substantial upfront sales and implementation investments do not result in sufficient sales to justify our investments, it could have a material adverse effect on our business, financial condition and results of operations. As we expect to grow rapidly, our physician recruitment costs could outpace our build-up of recurring revenue, and we may be unable to reduce our total operating costs through economies of scale such that we are unable to achieve profitability. Any increased or unexpected costs or unanticipated delays in taking a Privia Physician live on our technology-enabled platform, including delays caused by factors outside our control, could cause a Privia Physician to terminate his or her relationship prior to going live on our technology-enabled platform causing our operating results and growth targets to suffer. Further, if a Privia Physician terminates prior to the end of the initial term, we are unlikely to recover our spent acquisition costs associated with such Privia Physician, which could negatively affect our revenue and profits. If we cannot timely implement the Privia Technology Solution for Privia Physicians and new Medical Groups, or resolve Privia Provider and patients concerns, including any technical and billing issues, in a timely manner, we may lose Medical Groups, Privia Providers and their patients, and our reputation may be harmed. The seamless onboarding of Privia Physicians, whether done by ourselves or through third-party vendors, onto our technology-enabled platform, including training on conversion to and the use of our EMR, the education of Privia Physicians and their support staff, the credentialing of Privia Physicians and other providers with applicable federal health care programs and commercial payers, training on cash flow processing, website development, and the build out of workflows and customized EMR support, if any, is essential to a timely transition to our technology-enabled platform. As of December 31, 2022, practices on the Privia Platform were converted from approximately 53 different EMR vendors. If we face unanticipated implementation difficulties or Privia Physicians and their support staff are unable to smoothly transition to our operating model, we risk delaying the go live date of our new physician practices, which could negatively impact our revenue. Further, if the Privia Physician and his or her support staff’s implementation process is not executed successfully or if execution is delayed, we could incur significant costs, Privia Physicians could become dissatisfied and decide to neither continue implementation nor go live on our technology-enabled platform. In such event, we risk litigation from the Privia Physician, especially if he or she loses access to his or her historical commercial payer contracts. In addition, competitors with less robust operating models with lower implementation costs could jeopardize both our provider and commercial payer relationships. Privia Providers and their patients depend on our call center support services to resolve their operational concerns including technical issues relating to the Privia Technology Solution and services, and patient billing inquiries, and we may be unable to respond quickly enough to accommodate short-term increases in demand for support services, particularly as we increase the size of our Privia Physicians and patient bases. We also may be unable to modify the format of our support services to compete with changes in support services provided by competitors. It is difficult to predict demand for call center support services, and if demand increases significantly, we may be unable to provide satisfactory support services to our Privia Physicians and their patients. Further, if we are unable to address our Privia Physicians and their patients’ needs in a timely fashion or further develop and enhance our support services, or if a Privia Physician or patient is not satisfied with the quality of work performed by us or with the call center support services rendered, then we could incur additional costs to address the situation or, in certain markets, be required to issue credits or incur penalties related for such untimely or poor performance, and our profitability may be impaired and our Privia Physicians and their patients’ dissatisfaction with our support services could damage our ability to retain Privia Physicians and their patients. Such Privia Physicians may not renew their contracts, seek to terminate their relationship with us or renew on less favorable terms. Moreover, negative publicity related to our Privia Physician relationships, regardless of its accuracy, may further damage our business by affecting our reputation or ability to compete for new Privia Physicians in the market. If any of these were to occur, our revenue may decline and our business, financial condition and results of operations could be adversely affected. 41 Table of Contents If we do not continue to innovate and evolve our service offerings in a way that is useful to our Medical Groups, Privia Physicians and their patients, and our health system or hospital partners, we may not remain competitive, fail to meet our growth expectations, and our revenue and results of operations could suffer. The market for healthcare in the United States is in the early stages of structural change and is rapidly evolving toward a more VBC model with an increased emphasis on technological solutions and a customer centered focus. Our success depends on our ability to keep pace with technological developments, satisfy increasingly sophisticated physician, payer and patient requirements, and sustain market acceptance. Our future financial performance will depend in part on growth in the healthcare market and on our ability to adapt to emerging demands of the market, including adapting to the ways our Medical Groups, Privia Physicians and their patients, our health system and hospital partners, and our commercial payer customers access and use our technology-enabled platform, the Privia Technology Solution and our operating model. Our competitors are constantly developing products and services that may become more efficient or appealing to Privia Physicians and their patients, our health system or hospital partners or our commercial payer customers. As a result, we must continue to invest significant resources in research and development in order to enhance our existing service offerings and introduce new high-quality services and applications that such customers will want, while offering our platform, the Privia Technology Solution and the Privia operating model at competitive prices. If we are unable to predict customer preferences or industry changes, or if we are unable to modify our service offering on a timely or cost-effective basis, we may lose Medical Groups, Privia Physicians, patients, health system or hospital partners, ACO participants and payer customers. Our results of operations could also suffer if our innovations are not responsive to the needs of our multiple stakeholders, are not appropriately timed with market opportunity, or are not effectively brought to market, including as the result of delayed releases or releases that are ineffective or have errors or defects. As technology continues to develop, our competitors may be able to offer results that are, or that are perceived to be, substantially similar to, or better than, those generated by our technology-enabled platform, the Privia Technology Solution, or Privia operating model. This may force us to compete on additional service attributes and to expend significant resources in order to remain competitive. If our existing Medical Groups, Privia Providers, health system or hospital partners, ACO participants or payer customers do not continue to renew their contracts with us, renew at lower fee levels or decline to purchase additional applications and services from us, it could have a material adverse effect on our business, financial condition and results of operations. We expect to derive a significant portion of our revenue from renewal of existing contracts with our Medical Groups, Privia Providers, health system or hospital partners, ACO participants and payer customers. As part of our growth strategy, for instance, we have recently focused on expanding our revenue enhancement opportunities for Medical Groups such as our development of our virtual visits platform, our scribe program, and the opening of a centralized laboratory in our Mid-Atlantic market. As a result, achieving high customer retention rates and selling additional applications and services are critical to our future business, revenue growth and results of operations. Factors that may affect our retention rate and our ability to sell additional solutions and services include, but are not limited to, the following: • the price, performance and functionality of our technology-enabled platform and technological solutions; • Privia Physician acceptance and adoption of new services and utilization of new revenue enhancing opportunities; • the availability, price, performance and functionality of competing solutions; • our ability to develop, fairly price and sell complementary solutions and services to our Privia Physicians and payer customers; • the security, performance and stability of our technology-enabled platform, EMR, hosting infrastructure and hosting services; • changes in applicable health care laws, regulations and trends; and • the business environment of our Medical Groups, Privia Physicians, health system or hospital partners, ACO participants and payer customers. We typically enter into multiyear contracts with our Medical Groups, Privia Physicians, health system or hospital partners, ACO participants and payer customers, which often have a stated initial term of three years and automatically renew for successive one-year terms. From time to time, we may renegotiate or attempt to renegotiate contracts in the ordinary course of business prior to their applicable termination or expiration with certain of our counterparties, including as part of rate negotiations with payer customers. If our Medical Groups, Privia Physicians, health system or hospital partners, ACO participants and payer customers fail to renew their contracts, renew their contracts upon less favorable terms or at lower fee levels or fail to utilize additional products and services obtained from us, or if we fail to renegotiate contracts with our counterparties on favorable terms or at all, our revenue may decline or our future revenue growth may be constrained. Should any of our physician practices terminate their relationship with us after implementation has begun, we would not only lose our time, effort and resources invested in that implementation, but we would also have lost the opportunity to leverage those resources to build a relationship with other Privia Physicians over that same period of time. 42 Table of Contents Failure to adequately expand our direct sales force and our business development staff will impede our growth. We believe that our future growth will depend on the continued development of our direct sales force and its ability to obtain new Privia Physicians while our implementation team and practice consultants manage existing affiliate physician relationships. Additionally, we rely upon our business development staff to identify and develop potential relationships with new Medical Groups and health system or hospital partners in new geographical markets. Identifying and recruiting qualified personnel and training them requires significant time, expense and attention especially given the complexity of our business and the Privia operating model. It can take six months or longer before a new sales representative is fully trained and productive. Our business may be adversely affected if our efforts to expand and train our direct sales force and business development staff do not generate a corresponding increase in revenue. In particular, if we are unable to hire and develop sufficient numbers of productive direct sales and business development personnel or if new personnel are unable to achieve desired productivity levels in a reasonable period of time, our expected growth will be impeded. Our pricing may change over time and our ability to efficiently price the Privia Technology Solution and our Privia operating model will affect our results of operations and our ability to attract or retain Medical Groups, Privia Physicians, health system or hospital partners, ACO participants and commercial payer customers. The management and administrative fees we charge our Medical Groups have generally been set as a percentage of the Non-Owned Medical Group’s FFS collections provided, such an arrangement is allowed under state fee splitting laws. Florida, for instance, severely restricts percentage management fees and is structured as a fixed annual amount. Although subject to negotiation when a Privia Physician already receives care management fees, administrative fees or similar fees, from payers, Privia will typically retain such fees to offset their costs of providing population health services. In the past, we have allowed Privia Physicians to purchase additional services on an a la carte basis. While we determined these prices based on prior experience, the costs inputs associated with the services, and feedback from our Medical Groups, Privia Physicians, health system or hospital partners, ACO participants and payer customers, our assessments may not be accurate and we could be underpricing or overpricing the Privia Technology Solution and our operating model, which may require us to continue to adjust our pricing model. It is essential, however, that our prices remain competitive in the marketplace while providing a reasonable return on investment to allow us to economically provide such services. Additionally, such fees must generally be fair market value under federal and state fraud and abuse laws such as the Anti-Kickback Statute and the Stark Law. Furthermore, as our applications and services change, we may need to, or choose to, revise our pricing as our prior experience in those areas will be limited. Such changes to our pricing model or our inability to efficiently price our services could harm our business, results of operations, and financial condition and impact our ability to predict our future performance. Our growth strategy may not prove viable and we may not realize expected results. Our business strategy is to grow rapidly by expanding our Privia Physicians in existing markets and building new Medical Group in new geographical markets. New market growth is significantly dependent on partnering with anchor medical practices or health systems or hospitals in such new geographic markets. Likewise, our growth strategy is dependent on growing same-store sales for our Medical Groups by offering new revenue enhancing services, such as our virtual visit platform, assisting our Medical Groups in recruiting new patients, and partnering or contracting with commercial payers to enter new VBC arrangements on behalf of our Medical Groups. We seek growth opportunities both organically and through alliances with payers or other healthcare providers. Our ability to grow organically depends upon a number of factors, including how effectively we can execute our same-store sales growth strategies. We cannot guarantee that we will be successful in pursuing our growth strategy. If we fail to evaluate and execute new business opportunities properly, or if we have an adverse effect under one or more of our other “Risk Factors,” we may not achieve anticipated benefits and may incur increased costs. Our growth strategy involves a number of risks and uncertainties, including that: • we may not be able to successfully enter into contracts with commercial payers on terms favorable to our Medical Groups or at all. In addition, we compete for payer relationships with other physician practices and intermediary entities such as non-Privia ACOs, independent physician associations (IPAs), physician hospital organizations (PHOs), etc., some of whom may have greater resources than we do. This competition may intensify due to the ongoing consolidation in the healthcare industry, which may increase our costs to pursue such opportunities; • we may not be able to recruit or retain a sufficient number of new Medical Groups or Privia Physicians or patients to execute our growth strategy, and we may incur substantial costs to recruit Privia Physicians or new patients and we may be unable to recruit a sufficient number of Privia Physicians and/or new patients to offset those costs; • we may not be able execute physician services agreements with a sufficient number of Privia Physicians and may fail to integrate new Privia Physicians, their support staff, or our employees into our operating model; 43 Table of Contents • when expanding our business into new markets, we may be required to comply with laws and regulations that may differ from states in which we currently operate and compliance with such laws may slow our expected growth or limit our potential market of available physicians; and • depending upon the nature of the new geographical market, we may not be able to fully implement our Privia operating model in every geographical market that we enter, which could negatively impact our revenues and financial condition. There can be no assurance that we will be able to successfully capitalize on growth opportunities, which may negatively impact our business model, revenues, results of operations and financial condition. If we fail to manage our growth effectively, we may be unable to execute our business plan, maintain high levels of stakeholder service and patient satisfaction, or adequately address competitive challenges. We have experienced, and may continue to experience, rapid growth and organizational change, which has placed, and may continue to place, significant demands on our management and our operational and financial resources. Additionally, our organizational structure may become more complex as we improve our operational, financial and management controls, as well as our reporting systems and procedures. We may require significant capital expenditures and the allocation of valuable management resources to grow and change in these areas. We must effectively increase our headcount and continue to effectively train and manage our employees. We will be unable to manage our business effectively if we are unable to alleviate the strain on resources caused by growth in a timely and successful manner. If we fail to effectively manage our anticipated growth, the quality of our services may suffer, which could negatively affect our brand and reputation and harm our ability to attract and retain Medical Groups, Privia Providers, patients and employees. In addition, as we expand our business, it is important that we continue to maintain a high level of stakeholder service and satisfaction. As our Privia Physician base continues to grow, we will need to expand our populations health, patient services and other personnel, either through employment or contractual arrangements to provide personalized stakeholder service. If our Medical Groups are not able to continue to provide high quality cost effective healthcare services with high levels of patient satisfaction, our reputation, as well as our business, results of operations and financial condition could be adversely affected, including a failure to realize the benefits of any VBC arrangements. New Medical Groups and Privia Providers must be properly credentialed and enrolled in commercial payer plans and federal health care programs before our Medical Groups can receive reimbursement for their services, and there may be significant delays in the enrollment process. Each time a new Privia Provider joins one of our Medical Groups or we partner with a new Medical Group, we must credential and enroll the new Privia Provider or Medical Group under our applicable group identification number for the Medicare and Medicaid programs and for certain commercial payer programs before the applicable Medical Group can receive reimbursement for healthcare services furnished by the new Privia Provider to beneficiaries or enrollees of those programs. The estimated time to receive approval for the enrollment is sometimes difficult to predict. Failure to timely or accurately complete necessary credentialing information, whether such fault lies with the new Privia Provider or us, results in delayed reimbursement that may adversely affect our cash flows and revenue. With respect to Medicare, providers can retrospectively bill Medicare for services provided 30 days prior to the effective date of the enrollment so long as the individual Medicare enrollment application and assignment are correctly submitted. In addition, the enrollment rules provide that the effective date of the enrollment will be the later of the date on which the enrollment application was correctly filed and approved by the Medicare contractor, or the date on which the provider began furnishing healthcare services. If we are unable to properly enroll Privia Providers in a timely manner (at least 30 days after such provider begins furnishing patient care services), the affected Medical Group may be precluded from billing Medicare for any services which were provided to a Medicare beneficiary more than 30 days prior to the effective date of the enrollment. With respect to Medicaid, new enrollment rules and whether a state will allow providers to retrospectively bill Medicaid for services provided prior to submitting an enrollment application varies by state. Failure to timely enroll providers could reduce revenue to our Medical Groups and have a material adverse effect on the business, financial condition or results of our operations. The ACA, as currently structured, added additional enrollment requirements for Medicare and Medicaid, which have been further enhanced through implementing regulations and increased enforcement scrutiny. For example, every enrolled provider must revalidate its enrollment at regular intervals and must update the Medicare contractors and many state Medicaid programs with significant changes on a timely basis. CMS may also impose penalties upon providers who submit incomplete or inaccurate information or who have affiliations with other providers that CMS has determined pose undue risk of fraud, waste or abuse. If we fail to comply with these and other requirements to maintain our enrollment, Medicare and Medicaid could deny continued future enrollment or revoke our enrollment and billing privileges. Further, Medicare now subjects new locations at which physicians are furnishing services to Medicare beneficiaries to a location site visit to confirm enrollment information. The requirements for enrollment, licensure, certification, and accreditation may include notification or approval in the event of a transfer or change of ownership or certain other changes. Other agencies or commercial payers with which we have contracts may 44 Table of Contents have similar requirements, and some of these processes may be complex. Failure to provide required notifications or obtain necessary approvals may result in the delay or inability to complete an acquisition or transfer, loss of licensure, lapses in reimbursement, or other penalties. While we make reasonable efforts to substantially comply with these requirements, we cannot assure you that the agencies that administer these programs or have awarded us contracts will not find that we have failed to comply in some material respects. A finding of non-compliance and any resulting payment delays, refund demands or other sanctions could have a material adverse effect on our business, financial condition or results of operations. We rely on internet infrastructure, bandwidth providers, other third parties and our own systems to provide our technology-enabled platform to our Privia Physicians and their patients, and any failure or interruption in the services provided by these third parties or our own systems could expose us to litigation, result in a reduction of our management fees or the imposition of financial penalties on our management services organizations, and hurt our reputation and relationships with our Privia Physicians, our Medical Groups, and their patients. Our ability to maintain our technology-enabled platform, including our virtual health services, is dependent on the development and maintenance of the infrastructure of the internet and other telecommunications services furnished by third parties. This includes maintenance of a reliable network connection with the necessary speed, data capacity and security for providing reliable internet access and services and reliable telephone and facsimile services. Our platform is designed to operate without perceptible interruption in accordance with our service level commitments. We have, however, experienced limited interruptions in these systems in the past, including temporary slowdowns in the performance of our EMR and platform, and we may experience similar or more significant interruptions in the future. We rely on internal systems as well as third-party suppliers, including network and infrastructure equipment providers, to maintain our platform and related services. We do not currently maintain redundant systems or facilities for some of these services. Interruptions in these systems or services, whether due to system failures, cyber incidents, physical or electronic break-ins or other events, could affect the security or availability of our platform or services, including access to our EMR, patient scheduling, patient and Privia Physician portals, and prevent or inhibit the ability of our Privia Physicians and their patients to access our platform or services. In the event of a catastrophic event with respect to one or more of these systems or facilities, we may experience an extended period of system unavailability, which could result in substantial costs to remedy those problems or harm our relationship with our Privia Physicians and our business. Additionally, any disruption in the network access, telecommunications or co-location services provided by third-party providers or any failure of or by third-party providers’ systems or our own systems to handle current or higher volume of use could significantly harm our business. We exercise limited control over our third-party suppliers, which increases our vulnerability to problems with services they provide. Any errors, failures, interruptions or delays experienced in connection with these third-party technologies and information services or our own systems could hurt our relationships with our Medical Groups, Privia Physicians, patients, payers and other network participants, and expose us to third-party liabilities. The reliability and performance of our internet connection may be harmed by increased usage or by denial-of-service attacks or related cyber incidents. The services of other companies delivered through the internet have experienced a variety of outages and other delays as a result of damages to portions of the internet’s infrastructure, and such outages and delays could affect our systems and services in the future. These outages and delays could reduce the level of internet usage as well as the availability of the internet to us for delivery of our internet-based services. Any of the foregoing could harm our competitive position, business, financial condition, results of operations and prospects. Additionally, our Privia Physicians’ Affiliated Practices, which furnish certain support services on behalf of our Medical Groups, act as a business associate of their respective Medical Groups. In such capacity, they furnish certain services that support our platform, e.g., internet service access, modems, and computer hardware that access our EMR, and patient health information may, at times, reside on such hardware, including legacy servers. Although each legacy practice is obligated to furnish such services in compliance with HIPAA and state law, and to obtain cybersecurity insurance to cover any breaches or security incidents, a failure to comply with these obligations could result in the imposition of penalties against our Medical Groups as the covered entity under HIPAA. Further, such an incident could result in liability to the patient under state law and could damage our reputation among Privia Physicians and their patients all of which could adversely affect our business. We rely on third-party vendors to host and maintain our technology-enabled platform. We rely on third-party vendors to host and maintain our technology-enabled platform. Our ability to offer our solutions and services and operate our business is dependent on maintaining our relationships with third-party vendors and entering into new relationships to meet the changing needs of our business. Any deterioration in our relationships with such vendors or our failure to enter into agreements with vendors in the future could harm our business and our ability to pursue our growth strategy. Because of the large amount of data that we collect and manage, it is possible that, despite precautions taken at our vendors’ facilities, the occurrence of a natural disaster, cyber incident, decision to close the facilities without adequate notice or other unanticipated problems could result in our non-compliance with privacy laws and regulations, loss of proprietary or personal information and in lengthy interruptions in our service. These service interruptions could also cause our platform to be unavailable to our Medical Groups, Privia Providers, patients and network members, and impair our ability to deliver solutions and services and to manage our relationships with new and existing 45 Table of Contents Medical Groups, Privia Providers, patients and network members. We do, however, maintain redundancy with respect to the critical components of our platform. If our third-party vendors are unable or unwilling to provide the services necessary to support our business, or if our agreements with such vendors are terminated, our operations could be significantly disrupted. Some of our vendor agreements may be unilaterally terminated by the licensor for convenience, and if such agreements are terminated, we may not be able to enter into similar relationships in the future on reasonable terms or at all. We may also incur substantial costs, delays and disruptions to our business in transitioning such services to ourselves or other third-party vendors. In addition, third-party vendors may not be able to provide the services required in order to meet the changing needs of our business or scale as quickly as we require. Any of the foregoing could harm our competitive position, business, financial condition, results of operations and prospects. The Privia Technology Solution may not operate properly, which could damage our reputation, give rise to claims against us or divert application of our resources from other purposes, any of which could harm our business. Our technology-enabled platform provides patients with the ability to, among other things, schedule services with our Privia Physicians and communicate and interact with providers, and it allows our Privia Providers to, among other things, streamline patient charting and identify gaps in care and conduct virtual visits (via video, phone or the internet). Proprietary software development is time-consuming, expensive and complex, and may involve unforeseen difficulties. We may encounter technical obstacles, and it is possible that we may discover additional problems that prevent our proprietary software from operating properly. We are currently implementing software with respect to a number of new applications and services. If our solutions do not function reliably or fail to achieve Medical Group, Privia Provider, or patient expectations in terms of performance, we may lose or fail to grow our Privia Providers and patients, could assert liability claims against us and our Medical Groups, and our Medical Groups, affiliate providers, health system partners, and ACO participants may attempt to cancel their relationships with us. This could damage our reputation and impair our ability to attract or maintain Medical Groups, Privia Physicians, patients and relationships with commercial payers. Disruptions in our disaster recovery systems or management continuity planning could limit our ability to operate our business effectively. Our information technology systems facilitate our ability to conduct our business. While we have disaster recovery systems and business continuity plans in place, any disruptions in our disaster recovery systems or the failure of these systems to operate as expected could, depending on the magnitude of the problem, adversely affect our operating results by limiting our capacity to effectively monitor and control our operations. Despite our implementation of a variety of security measures, our information technology systems could be subject to physical or electronic break-ins, and similar disruptions from unauthorized tampering or any weather-related disruptions where our headquarters is located. In addition, in the event that a significant number of our management personnel were unavailable in the event of a disaster, our ability to effectively conduct business could be adversely affected. We may be subject to legal proceedings and litigation, including intellectual property and privacy disputes, which are costly to defend and could materially harm our business and results of operations. We may be party to lawsuits and legal proceedings in the normal course of business. These matters are often expensive and disruptive to normal business operations. We may face allegations, lawsuits and regulatory inquiries, audits and investigations regarding claim submission, supporting documentation for claimed reimbursement, coding for services furnished by our Privia Providers, data privacy, security, labor and employment, consumer protection and intellectual property infringement, misappropriation and other violations, including claims related to privacy, patents, publicity, trademarks, copyrights and other rights. We may also face allegations or litigation related to our acquisitions, securities issuances or business practices, including public disclosures about our business. Litigation and regulatory proceedings may be protracted and expensive, and the results are difficult to predict. Certain of these matters may include speculative claims for substantial or indeterminate amounts of damages and may include claims for injunctive relief. Additionally, our litigation costs could be significant. Adverse outcomes with respect to litigation or any of these legal proceedings may result in significant settlement costs or judgments, penalties and fines, or require us to modify our services or require us to stop serving certain patients or geographies, all of which could negatively impact our geographical expansion and revenue growth. We may also become subject to periodic audits, which could increase our regulatory compliance costs and may require us to change our business practices, which could negatively impact our revenue growth. Managing legal proceedings, litigation and audits, even if we achieve favorable outcomes, is time-consuming and diverts management’s attention from our business. The results of regulatory proceedings, litigation, claims, and audits cannot be predicted with certainty, and determining reserves for pending litigation and other legal, regulatory and audit matters requires significant judgment. There can be no assurance that our expectations will prove correct, and even if these matters are resolved in our favor or without significant cash settlements, these matters, and the time and resources necessary to litigate or resolve them, could harm our reputation, business, financial condition, results of operations and the market price of our common stock. We and our Medical Groups, Privia Providers, ACOs, management services organizations also may be subject to lawsuits under the FCA and comparable state laws for submitting allegedly fraudulent or otherwise inappropriate bills for services to the Medicare and Medicaid programs. These lawsuits, which may be initiated by government authorities as well as private party relators, which are often disgruntled employees or physicians, can involve significant monetary damages, fines, attorney fees and the award of bounties to private plaintiffs who successfully bring these suits, as well as to the federal health care programs. In recent years, government 46 Table of Contents oversight and law enforcement have become increasingly active and aggressive in investigating and taking legal action against potential fraud and abuse especially in the health care industry. Furthermore, our business exposes our Medical Groups and Privia Providers to potential medical malpractice, professional negligence or other related actions or claims that are inherent in the provision of healthcare services. Our management services organizations and ACOs could also be subject to malpractice claims based upon an allegation that we limited medically necessary services or were otherwise negligent in setting incentives that were adverse to patient outcomes. These claims, with or without merit, could cause us to incur substantial costs, and could place a significant strain on our financial resources, divert the attention of management from our core business, harm our reputation and adversely affect our ability to attract and retain patients, any of which could have a material adverse effect on our business, financial condition and results of operations. Although we and our Medical Groups and Privia Providers maintain third-party professional liability insurance coverage, it is possible that claims against us may exceed the coverage limits of our insurance policies, or the particular claim could be excluded from coverage (for example, a tort claim or lack of patient consent claim). Even if any professional liability loss is covered by an insurance policy, these policies typically have substantial deductibles for which we are responsible. Professional liability claims in excess of applicable insurance coverage could have a material adverse effect on our business, financial condition and results of operations. In addition, any professional liability claim brought against us, with or without merit, could result in an increase of our professional liability insurance premiums. Insurance coverage varies in cost and can be difficult to obtain, and we cannot guarantee that we will be able to obtain insurance coverage in the future on terms acceptable to us or at all. If our costs of insurance and claims increase, then our earnings could decline. Our business depends on our ability to effectively invest in, implement improvements to and properly maintain the uninterrupted operation and data integrity of our information technology and other business systems. Our business is highly dependent on maintaining effective information systems as well as the integrity and timeliness of the data we use to serve our Privia Providers’ patients, support our Privia Providers and care teams, monitor and manage our ACOs, monitor and manage, including reporting on behalf of, our management services organizations, and to otherwise operate our business. Because of the large amount of data that we collect and manage, it is possible that hardware failures or errors in our systems could result in data loss or corruption or cause the information that we collect to be incomplete or contain inaccuracies that our customers regard as significant. If our data were found to be inaccurate or unreliable due to fraud, corruption or other error, or if we, or any of the third-party service providers we engage, were to fail to maintain information systems and data integrity effectively, we could experience operational disruptions that may impact our Privia Physicians, Medical Groups, health system or hospital partners, patients and our commercial plan customers, as well as our compliance with reporting obligations under the Medicare program, Medicare Advantage plans and the MSSP, and commercial VBC arrangements, and hinder our ability to provide services, establish appropriate pricing for our services, retain and attract Medical Groups and Privia Physicians, manage VBC obligations, determine total cost of care and spend, establish appropriate reserves, report financial results timely and accurately, and maintain regulatory compliance, among other things. Our information technology strategy and execution are critical to our continued success. We must continue to invest in long-term solutions that will enable us to anticipate our Medical Groups, Privia Providers, ACOs, and commercial payers’ needs and expectations, enhance both Privia Providers’ and patients’ experience, act as a differentiator in the market and protect against cybersecurity risks and threats. Our success is dependent, in large part, on maintaining the effectiveness of existing technology systems and continuing to deliver and enhance technology systems that support our business processes in a cost-efficient and resource-efficient manner. Increasing regulatory and legislative changes will place additional demands on our information technology infrastructure that could have a direct impact on resources available for other projects tied to our strategic initiatives. In addition, recent trends toward greater patient engagement in health care require new and enhanced technologies, including more sophisticated applications for mobile devices. Connectivity among technologies is becoming increasingly important. We must also develop new systems to meet current market standards and keep pace with continuing changes in information processing technology, evolving industry and regulatory standards and patient needs. Failure to do so may present compliance challenges and impede our ability to deliver services in a competitive manner. Further, because system development projects are long-term in nature, they may be more costly than expected to complete and may not deliver the expected benefits upon completion. Our failure to effectively invest in, implement improvements to and properly maintain the uninterrupted operation and data integrity of our information technology and other business systems could adversely affect our results of operations, financial position and cash flow. If we are unable to obtain, maintain and enforce intellectual property protection for our technology or if the scope of our intellectual property protection is not sufficiently broad, others may be able to develop and commercialize technology substantially similar to ours, and our ability to successfully commercialize our technology may be adversely affected. Our business depends, in part, on internally developed technology and content, including software, databases, confidential information and know-how, the protection of which is crucial to the success of our business. We rely on a combination of trademark, trade-secret, and copyright laws and confidentiality procedures and contractual provisions to protect our intellectual property rights in our internally developed technology and content and our brand. We may, over time, increase our investment in protecting our intellectual property through additional trademark, patent and other intellectual property filings that could be expensive and time-consuming to develop and 47 Table of Contents maintain, both in terms of initial preparation and ongoing registration requirements and the costs of defending our rights. These measures, however, may not be sufficient to offer us meaningful protection. If we are unable to establish or protect our intellectual property and other rights, our competitive position and our business could be harmed, as third parties may be able to commercialize and use technologies and software products that are substantially the same as ours without incurring the development and licensing costs that we have incurred. Any of our owned or licensed intellectual property rights could be challenged, invalidated, circumvented, infringed or misappropriated, our trade secrets and other confidential information could be disclosed in an unauthorized manner to third parties, or our intellectual property rights may not be sufficient to permit us to take advantage of current market trends or otherwise to provide us with competitive advantages, which could result in costly redesign efforts, discontinuance of certain offerings or other competitive harm. Monitoring unauthorized use of our intellectual property is difficult and costly. From time to time, we seek to analyze our competitors’ services, and may in the future seek to enforce our rights against potential infringers. However, the steps we have taken to protect our intellectual property rights may not be adequate to prevent infringement, misappropriation or other violations of our intellectual property. We may not be able to detect unauthorized use of, or take appropriate steps to enforce, our intellectual property rights. Any inability to meaningfully protect our intellectual property rights could result in harm to our ability to compete and reduce demand for our technology. Moreover, our failure to develop and properly manage new intellectual property could adversely affect our market positions and business opportunities. Also, some of our services rely on technologies and software developed by or licensed from third parties, and we may not be able to maintain our relationships with such third parties or enter into similar relationships in the future on reasonable terms or at all. Uncertainty may result from changes to intellectual property legislation and from interpretations of intellectual property laws by applicable courts and agencies. Accordingly, despite our efforts, we may be unable to obtain and maintain the intellectual property rights necessary to provide us with a competitive advantage. Our failure to obtain, maintain and enforce our intellectual property rights could therefore have a material adverse effect on our business, financial condition and results of operations. Third parties may allege that we are infringing, misappropriating or otherwise violating their intellectual property rights and in some instances initiate formal legal proceedings, the outcome of which would be uncertain and could have a material adverse effect on our business, financial condition and results of operations. Our commercial success depends on our ability to develop, commercialize and protect our technology-enabled platform, the Privia Technology Solution and the Privia operating model, and use our internally developed technology without infringing, misappropriating or otherwise violating the intellectual property or proprietary rights of third parties. Intellectual property disputes can be costly to defend, may divert management’s attention or resources and may cause our business, operating results and financial condition to suffer. As the market for healthcare in the United States expands and more patents are issued, the risk increases that there may be patents issued to third parties that relate to our technology of which we are not aware or that we must challenge to continue our operations as currently contemplated. Whether merited or not, we may face allegations that we, our partners or parties indemnified by us have infringed, misappropriated or otherwise violated the patents, trademarks, copyrights or other intellectual property rights of third parties. Such claims may be made by competitors seeking to obtain a competitive advantage or by other parties. Additionally, in recent years, individuals and groups have begun acquiring intellectual property assets for the purpose of making claims of infringement and attempting to extract settlements from companies like ours. We may also face allegations that our employees have misappropriated the intellectual property or proprietary rights of their former employers or other third parties. It may be necessary for us to initiate litigation to defend ourselves in order to determine the scope, enforceability and validity of third-party intellectual property or proprietary rights, or to establish or enforce our respective rights. We may not be able to successfully settle or otherwise resolve such adversarial proceedings or litigation. If we are unable to successfully settle future claims on terms acceptable to us, we may be required to defend such claims, regardless of their underlying merit, that can be time-consuming, divert management’s attention and financial resources and can be costly to evaluate and defend. Results of any such litigation are difficult to predict and may require us to stop commercializing or using our technology, obtain licenses, modify our services and technology while we develop non-infringing substitutes or incur substantial damages, settlement costs or face a temporary or permanent injunction prohibiting us from marketing or providing the affected services. If we require a third-party license, it may not be available on reasonable terms or at all, and we may have to pay substantial royalties, upfront fees or grant cross-licenses to intellectual property rights for our services. We may also have to redesign our services so they do not infringe, misappropriate or violate third-party intellectual property rights, which may not be possible or may require substantial monetary expenditures and time, during which our technology may not be available for commercialization or use. Even if we have an agreement to indemnify us against such costs, the indemnifying party may be unable to uphold its contractual obligations. If we cannot or do not obtain a third-party license to the infringed technology at all, license the technology on reasonable terms or obtain similar technology from another source, our revenue and earnings could be adversely impacted. From time to time, we may be subject to legal proceedings and claims in the ordinary course of business with respect to intellectual property. We are not currently subject to any claims from third parties asserting infringement of their intellectual property rights. Some third parties may be able to sustain the costs of complex litigation more effectively than we can because they have substantially greater resources. Even if resolved in our favor, litigation or other legal proceedings relating to intellectual property claims may cause us to incur significant expenses, and could distract our technical and management personnel from their normal responsibilities. In 48 Table of Contents addition, there could be public announcements of the results of hearings, motions or other interim proceedings or developments, and if securities analysts or investors perceive these results to be negative, it could have a material adverse effect on the price of our common stock. Moreover, any uncertainties resulting from the initiation and continuation of any legal proceedings could have a material adverse effect on our ability to raise the funds necessary to continue our operations. Assertions by third parties that we infringe, misappropriate or otherwise violate their intellectual property rights could therefore have a material adverse effect on our business, financial condition and results of operations. If we are unable to protect the confidentiality of our trade secrets, know-how and other proprietary and internally developed information, the value of our technology could be adversely affected. We may not be able to protect our trade secrets, know-how and other internally developed information adequately. Although we use reasonable efforts to protect this internally developed information and technology, our employees, consultants, Privia Providers and other parties (including independent contractors and companies with which we conduct business) may unintentionally or willfully disclose our information or technology to competitors. Enforcing a claim that a third party illegally disclosed or obtained and is using any of our internally developed information or technology is difficult, expensive and time-consuming, and the outcome is unpredictable. In addition, courts outside the United States are sometimes less willing to protect trade secrets, know-how and other proprietary information and the laws regarding such protections vary among jurisdictions. We rely, in part, on non-disclosure, confidentiality and assignment-of-invention agreements with our employees, independent contractors, consultants, customers and other companies with which we conduct business to protect our trade secrets, know-how and other intellectual property and internally developed information. However, we may fail to enter into such agreements with all of our employees, independent contractors, consultants, customers and other companies, and these agreements may not be self-executing, or they may be breached and we may not have adequate remedies for such breach. Moreover, third parties may independently develop similar or equivalent proprietary information or otherwise gain access to our trade secrets, know-how and other internally developed information. Any restrictions on our use of, or ability to license, data, or our failure to license data and integrate third-party technologies, could have a material adverse effect on our business, financial condition and results of operations. We depend upon licenses from third parties for some of the technology and data used in the Privia Technology Solution. We expect that we may need to obtain additional licenses from third parties in the future in connection with the development of our services. In addition, we obtain a portion of the data that we use from government entities, public records and from third parties for specific engagement and uses. We believe that we have all rights necessary to use the data that is incorporated into our services. We cannot, however, assure you that our licenses for information will allow us to use that information for all potential or contemplated applications. In addition, our ability to continue to offer integrated healthcare to our patients depends on maintaining our platform, which is partially populated with data disclosed to us by our partners with their consent. If these partners revoke their consent for us to maintain, use, de-identify and share this data, consistent with applicable law, our data assets could be degraded. In the future, data providers could withdraw their data from us or restrict our usage for any reason, including if there is a competitive reason to do so, if legislation is passed restricting the use of the data or if judicial interpretations are issued restricting use of the data that we currently use to support our services. In addition, data providers could fail to adhere to our quality control standards in the future, causing us to incur additional expense to appropriately utilize the data. If a substantial number of data providers were to withdraw or restrict their data, or if they fail to adhere to our quality control standards, and if we are unable to identify and contract with suitable alternative data suppliers and integrate these data sources into our service offerings, our ability to provide appropriate services to our Privia Physicians, Medical Groups, health system or hospital partners, patients, and commercial payer customers could be materially adversely impacted, which could have a material adverse effect on our business, financial condition and results of operations. We also integrate into our internally developed applications and use third-party software to support our technology infrastructure. Some of this software is proprietary and some is open source software. These technologies may not be available to us in the future on commercially reasonable terms or at all and could be difficult to replace once integrated into our own internally developed applications. Most of these licenses can be renewed only by mutual consent and may be terminated if we breach the terms of the license and fail to cure the breach within a specified period. Our inability to obtain, maintain or comply with any of these licenses could delay development until equivalent technology can be identified, licensed and integrated, which could harm our business, financial condition and results of operations. Most of our third-party licenses are non-exclusive and our competitors may obtain the right to use any of the technology covered by these licenses to compete directly with us. Our use of third-party technologies exposes us to increased risks, including, but not limited to, risks associated with the integration of new technology into our solutions, the diversion of our resources from development of our own internally developed technology and our inability to generate revenue from licensed technology sufficient to offset associated acquisition and maintenance costs. In addition, if our data suppliers choose to discontinue support of the licensed technology in the future, we might not be able to modify or adapt our own solutions. 49 Table of Contents Our use of “open source” software could adversely affect our ability to offer our services and subject us to possible litigation. We use open source software in connection with our technology-enabled platform, the Privia Technology Solution and our Privia operating model. Companies that incorporate open source software into their technologies have, from time to time, faced claims challenging the use of open source software and/or compliance with open source license terms. As a result, we could be subject to suits by parties claiming ownership of what we believe to be open source software or claiming noncompliance with open source licensing terms. Some open source software licenses require users who use software containing open source software to publicly disclose all or part of the source code to such software and/or make available any derivative works of the open source code, which could include valuable proprietary code of the user, on unfavorable terms or at no cost. While we monitor the use of open source software and try to ensure that none is used in a manner that would require us to disclose our internally developed source code or that would otherwise breach the terms of an open source agreement, such use could inadvertently occur, in part because open source license terms are often ambiguous. Any requirement to disclose our internally developed source code or pay damages for breach of contract could have a material adverse effect on our business, financial condition and results of operations and could help our competitors develop services that are similar to or better than ours. If an author or other third party that distributes such open source software were to allege that we had not complied with the conditions of one or more of these licenses, we could be required to incur significant legal expenses defending against such allegations and could be subject to significant damages, enjoined from the commercialization of our services that contained the open source software, engaged in costly redesign efforts, and required to comply with onerous conditions or restrictions on these services, which could disrupt the distribution of services. From time to time, there have been claims challenging the ownership rights in open source software against companies that incorporate it into their products and the licensors of such open source software provide no warranties or indemnities with respect to such claims. As a result, we could be subject to lawsuits by parties claiming ownership of what we believe to be open source software. Litigation could be costly for us to defend, have a negative effect on our business, financial condition and results of operations, or require us to devote additional research and development resources to change our services. Some open source projects have known vulnerabilities and architectural instabilities and are provided on an “as-is” basis, which, if not properly addressed, could negatively affect the performance of our platform. If we inappropriately use or incorporate open source software subject to certain types of open source licenses that challenge the proprietary nature of our technology-enabled platform and service, we may be required to re-engineer our platform, discontinue the commercialization of our platform or take other remedial actions, any of which could adversely impact our business, financial condition and results of operations. We depend on our senior management team and other key employees, and the loss of one or more of these employees or an inability to attract and retain other highly skilled employees could harm our business. Our success depends largely upon the continued services of our senior management team and other key employees. We rely on our leadership team in the areas of operations, provision of medical services, information technology and security, marketing, and general and administrative functions. From time to time, there may be changes to our management team resulting from the hiring or departure of executives or key employees, which could disrupt our business. Our employment agreements with our executive officers and other key personnel do not require them to continue to work for us for any specified period and, therefore, they could terminate their employment with us at any time. The loss of one or more of the members of our senior management team, or other key employees, could harm our business. Changes in our executive management team may also cause disruptions in, and harm to, our business. Our Medical Groups are concentrated in Virginia, Maryland, the District of Columbia, Texas, Tennessee, Florida, California and Georgia, and we may not be able to successfully establish a presence in new geographic markets. A substantial portion of our revenue is driven by our medical practices in Virginia, Maryland, the District of Columbia, Texas, Tennessee, Florida, Georgia, and California. As a result, our exposure to many of the risks described herein are not mitigated by a diversification of geographic focus. Furthermore, due to the concentration of our operations in these states, our business may be adversely affected by economic conditions, natural disasters, contagious disease outbreaks, including COVID-19, political unrest, and other conditions over which we have no control that disproportionately affect these states as compared to other states. Such conditions could adversely affect our operating results and disrupt the operation of our Medical Groups and Privia Providers. To continue to expand our operations to other regions of the United States, we will have to devote resources to identifying and exploring such perceived opportunities. Thereafter, we will have to, among other things, recruit and retain qualified personnel, develop new Medical Groups and establish new relationships with physicians and other healthcare providers. In addition, we would be required to comply with laws and regulations of states that may differ from the ones in which we currently operate, and could face competitors with greater knowledge of such local markets. We anticipate that further geographic expansion will require us to make a substantial investment of management time, capital and/or other resources. There can be no assurance that we will be able to continue to successfully expand our operations in any new geographic markets. Our overall business results may suffer from an economic downturn. During periods of high unemployment and inflation, such as we are experiencing related to the COVID-19 pandemic, governmental entities often experience budget deficits as a result of increased costs and lower than expected tax collections. These budget deficits at federal, state and local government entities have decreased, and may continue to decrease, spending for federal health care programs, 50 Table of Contents including Medicare, Medicaid and similar programs, which represent significant payer sources for our Medical Groups. Other risks we face during periods of high unemployment include potential declines in the patient base, potential increases in the uninsured and underinsured populations, which could negatively impact our payer mixes, a contracting of discretionary spending by our patient base, which could negatively affect demand for the services of our Privia Physicians, and further difficulties in our collecting patient co-payment and deductible receivables. We must attract and retain highly qualified personnel, including non-physician clinicians, in order to execute our growth plan. Competition for highly qualified personnel with healthcare experience is intense and changes in the labor market resulting from COVID-19 have increased such competition while increasing pressure on wage growth to retain our existing personnel. We and our Medical Groups have, from time to time, experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications at acceptable salary ranges. Further, Privia Physicians may have similar difficulty in hiring and retaining support staff. Many of the companies and healthcare providers with which we compete for experienced personnel have greater resources than we have. If we hire employees from competitors or other companies or healthcare providers, their former employees may attempt to assert that these employees or we have breached certain legal obligations, resulting in a diversion of our time and resources. If we fail to attract new personnel or fail to retain and motivate our current personnel, our business and future growth prospects could be adversely affected. Further, such scarcity and demand can significantly drive up labor costs associated with hiring and retaining highly qualified personnel, which could negatively affect our results of operations, financial condition and cash flows. Our management team has limited experience managing a public company. Most members of our management team have limited experience managing a publicly traded company, interacting with public company investors and complying with the increasingly complex laws pertaining to public companies. Our management team may not successfully or efficiently manage us as a public company that is subject to significant regulatory oversight and reporting obligations under the federal securities laws and the continuous scrutiny of securities analysts and investors. These new obligations and constituents require significant attention from our senior management and could divert their attention away from the day-to-day management of our business, which could adversely affect our business, results of operations and financial condition. Our corporate culture has contributed to our success, and if we cannot maintain this culture as we grow, we could lose the innovation, creativity and teamwork fostered by our culture and our business may be harmed. We believe that our culture has been and will continue to be a critical contributor to our success. We expect to continue to hire aggressively as we expand, and we believe our corporate culture has been crucial in our success and our ability to attract highly skilled personnel. If we do not continue to develop our corporate culture or maintain and preserve our core values as we grow and evolve, we may be unable to foster the innovation, curiosity, creativity, focus on execution, teamwork and the facilitation of critical knowledge transfer and knowledge sharing we believe we need to support our growth. Moreover, liquidity available to our employee security holders could lead to disparities of wealth among our employees, which could adversely impact relations among employees and our culture in general. Our anticipated headcount growth and our transition from a private company to a public company may result in a change to our corporate culture, which could harm our business. If certain of our vendors do not meet our needs, if there are material price increases on vendor services and products, if we do not price our services correctly, if our Medical Groups are not reimbursed or adequately reimbursed for the costs of any vendor services or products borne by such Medical Groups, or if we are unable to effectively access new or replacement services or products, it could negatively impact our ability to effectively provide the services we offer and could have a material adverse effect on our business, results of operations, financial condition and cash flows. We have vendors that may be the sole or primary source of certain services, products or technology critical to the services either we or our Privia Providers furnish, or to which we have committed obligations to make purchases, sometimes at particular prices. If any of these vendors do not meet our needs for the services or products they supply, including in the event of a product recall, shortage or dispute, and we are not able to find adequate alternative sources, if we experience material price increases from these vendors that we are unable to mitigate, or if the costs of some of the products or services that we purchase are borne by our Medical Groups and such Medical Groups are not reimbursed or not adequately reimbursed for such products or services, it could have a material adverse effect on our business, results of operations, financial condition and cash flows. In addition, the technology related to the services or products critical to the services we provide is subject to new developments that may result in superior products. If we are not able to access new or replacement services or products on a cost-effective basis or if vendors are not able to fulfill our requirements for such services or products, or unable to scale as fast as our operations grow, we could face Privia Physician attrition and other negative consequences which could have a material adverse effect on our business, results of operations, financial condition and cash flows. 51 Table of Contents With respect to any Medicare Advantage plans with which our Medical Groups participate, our records and submissions to such plans may contain inaccurate or unsupportable information regarding risk adjustment scores of such plan’s enrollees, which could cause us to overstate or understate the average health care burden of such population, which could result in an incorrect statement of our revenue and could subject us and our Medical Groups to various penalties. We submit claims and encounter data, on behalf of our participating Medical Groups, to applicable Medicare Advantage plans that are used to establish the annual, average Medicare Risk Adjustment Factor, or RAF, scores attributable to each Medical Group’s Medicare Advantage population. These RAF scores determine, in part, the revenue to which the health plans and, in turn, our Medical Groups are entitled for the provision of medical care to such population. The data submitted to CMS by each health plan is based, in part, on medical charts and diagnosis codes that our Privia Providers prepare and we submit to the health plans. Each health plan generally relies on us and our Privia Providers to appropriately document and support such RAF data in our medical records. Each health plan also relies on us and our Privia Providers to appropriately code claims for medical services provided to members. Erroneous claims and erroneous encounter records and submissions could result in inaccurate revenue and risk adjustment payments, which may be subject to correction or retroactive adjustment in later periods. This corrected or adjusted information may be reflected in financial statements for periods subsequent to the period in which the revenue was recorded. We might also need to refund a portion of the revenue that we received, which refund, depending on its magnitude, could damage our relationship with the applicable health plan and could have a material adverse effect on our business, results of operations, financial condition and cash flows. Additionally, CMS audits Medicare Advantage plans for documentation to support RAF-related payments for enrollees chosen at random. The Medicare Advantage plans ask providers to submit the underlying documentation for members that they serve. It is possible that claims associated with members with higher RAF scores could be subject to more scrutiny in a CMS or plan audit. There is a possibility that a Medicare Advantage plan may seek repayment from us, our ACOs, or our Medical Groups should CMS make any payment adjustments to the Medicare Advantage plan as a result of its audits. CMS has indicated that payment adjustments will not be limited to RAF scores for the specific MA enrollees for which errors are found but may also be extrapolated to the entire MA plan subject to a particular CMS contract. Based on a recent final rule issued by CMS in January 2023, although 2011 to 2017 plan years are still subject to audit, overpayments to MA plans that are identified as a result of a Risk Adjustment Data Validation, or RADV, audit will only be subject to extrapolation for plan year 2018 and any subsequent plan year. In addition, CMS will not apply an adjustment factor, known as Fee-For-Service, or FFS, Adjuster in RADV audits to account for potential differences in diagnostic coding between the Medicare Advantage program and Medicare FFS program. Although we are continuing to assess the potential impact this final rule may have on our business and operations, such adjustments could adversely affect our revenue, financial conditions and results of operations. . Moreover, we may face civil and criminal liability under healthcare fraud and abuse laws, including, without limitation, the False Claims Act. By way of example, in 2018, the Department of Justice, or the DOJ, reached a $270 million settlement agreement with HealthCare Partners Holdings, LLC based upon the organization’s internal coding policies and provider education that resulted in the submission of inappropriate diagnosis codes, and the inappropriate capture of historical diagnoses both of which inflated the organization’s RAF scores and resulted in inflated payment rates. The DOJ alleged that such submissions constituted a civil False Claims Act violation. More recently, in August 2021, Sutter Health agreed to pay $90 million to resolve allegations that it violated the False Claims Act by knowingly submitting inaccurate information about health status of beneficiaries enrolled in Medicare Advantage plans and entered into a five-year Corporate Integrity Agreement with the OIG. There can be no assurance that a Medicare Advantage plan in which our Medical Groups participate will not be randomly selected or targeted for review by CMS or that the outcome of such a review will not result in a material adjustment in our revenue and profitability, even if the information we submitted to the plan is accurate and supportable. Further, although we have built safeguards in our provider education efforts and unreported diagnoses review, there can be no assurance that the CMS, the DOJ, the OIG, or a whistleblower would not allege such action constitutes a civil False Claims Act violation or, if pursued that we could successfully defend against such allegation. In such event, even if we successfully defend against it, such an allegation could cause us to incur significant legal expenses, divert our management’s attention from the operation of our business and result in adverse publicity. If the estimates and assumptions we use to determine the size of our total addressable market, or TAM, are inaccurate, our future growth rate may be impacted and our business could be harmed. Market estimates and growth forecasts are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate. The estimates and forecasts in this report relating to the size and expected growth of the TAM for available physicians with which our Medical Groups can affiliate may prove to be inaccurate. Even if the markets in which we compete meet our size estimates and forecasted growth, our business could fail to grow at similar rates, if at all. The principal assumptions relating to our determination of the TAM includes determining the total number of physicians in the geographic market reduced by hospital employed physicians and other Privia Physicians in the market that are unlikely to change their existing relationships. This calculation may not take into account physicians who are not currently available because of an exclusive arrangement with an intermediary entity or because the physician is locked out of moving while awaiting payment pursuant to a VBC arrangement. In addition to a sufficiently large TAM to allow us to affiliate with a sufficiently large number of physicians to make the market economically viable, each market is evaluated to determine if there is sufficient reimbursement variation in fee schedules paid 52 Table of Contents by commercial payers to physicians to create sufficient economic opportunity to allow such physicians to embrace our Privia operating model. Our targeted TAM is also based on the assumption that the strategic approach that our solution enables for potential Privia Physicians will be more attractive to our available physicians than many competing opportunities. If these assumptions prove inaccurate, our business, financial condition and results of operations could be adversely affected. Risks Related to the COVID-19 Pandemic The use of funds made available under the CARES Act by our Medical Groups and Privia Physicians’ Affiliated Practices could adversely affect our business. Our volumes may still periodically be impacted by COVID-19 infection rates in certain geographical markets as hospitals divert or postpone elective procedures in order to deal with infected individuals. Further, some of our Privia Physicians and/or their Affiliated Practices may have outstanding loan obligations under the Paycheck Protection Program implemented pursuant to the Coronavirus Aid, Relief, and Economic Security Act, or the CARES Act. Although we are not liable for such loan amounts, our Privia Physicians’ inability to either have such loan amounts forgiven or pay such loan amounts could negatively impact our business, including due to responding to Privia Physician bankruptcy filings and, potentially, federal seizure of assets, including federal health care program funds, which could include funds owing to us, such as management fees. Although our claims to such amounts may ultimately be released, the cost of collections could increase from our standard business model, which will negatively affect both our revenue and profits. Because of the Paycheck Protection Program affiliation rules, none of our Owned Medical Groups (as opposed to our Privia Physicians’ Affiliated Practices) borrowed any amounts under the program. One of the Non-Owned Medical Groups did partake in the Paycheck Protection Program, but the outstanding balance has already been forgiven. Likewise, none of our Medical Groups partook of CMS’ Accelerated and Advance Payment Programs under the CARES Act. Each of our Medical Groups did, however, accept funds distributed by HHS under the Provider Relief Fund enacted as part of the CARES Act. Given that each of our Medical Groups received in excess of $10,000 under the Provider Relief Fund, each Medical Group is subject to HHS’ reporting requirements for the use of such funds. Two of our Owned Medical Groups are subject to heightened reporting requirements for providers receiving more than $500,000 from the Provider Relief Fund. Independent audits were conducted to provide assurance that the Owned Medical Groups’ receipt of funds from HHS Provider Relief Fund and the American Rescue Plan followed the requirements of the statutes, regulations and the terms and conditions of the awards. It was filed in accordance with the requirements of the Consolidated Appropriations Act of 2021 and additional guidance issued by HHS. Although continued reporting obligations exist for these Owned Medical Groups, the amount of funds distributed for such periods will no longer be subject to the single audit requirements. The Owned Medical Groups will continue to have obligations regarding maintenance of documentation of such records and costs, and remain potentially subject to additional audits by HHS, the OIG, and the Pandemic Response Accountability Committee. Any recipient identified as providing inaccurate information will be subject to recoupment and deliberate omission, misrepresentation or falsification of any information associated with such reporting may be punishable by criminal, civil or administrative penalties, including but not limited to revocation of Medicare billing privileges, exclusion from federal health care programs, and/or the imposition of fines, civil damages and/or imprisonment. The law relative to the Provider Relief Fund as well as guidance from HHS continues to evolve and we cannot say definitively whether HHS will agree with our assessment that funds were appropriately utilized by the Owned Medical Groups. In the event that such funds were used inappropriately or revenue losses were insufficient, it would be necessary to reimburse HHS for Provider Relief Funds received by our Owned Medical Groups, which would have a material adverse effect on our business, financial condition, and operations. Further, a failure to adequately report and maintain records related to the use of amounts from the Provider Relief Funds could have a materially adverse effect on our business, financial condition and the results of operations. As the public health emergency for the COVID-19 pandemic continues, access to, and demand for, our services may be limited, which could adversely affect our business. Adverse market conditions resulting from the COVID-19 pandemic, including new variants, could materially adversely affect our business and the value of our common stock. If there is an increase in COVID-19 hospitalizations, it is possible that some state and local jurisdictions in our current markets may again impose shutdowns, “shelter-in-place” orders, quarantines, executive orders and similar government orders and restrictions for their residents to control the spread of COVID-19 or variants thereof. Such orders or restrictions could result in reduced staffing and services at some of our Medical Groups and Privia Physicians’ Affiliated Practices, work stoppages and slowdowns among some of our vendors and suppliers, slowdowns and delays, travel restrictions and cancellation of elective procedures and reduction in our in-person sales activity, thereby significantly and potentially negatively impacting our operations. Other potential disruptions include restrictions on the ability of our personnel to travel; inability of our suppliers to manufacture goods and to deliver these to us on a timely basis, or at all; inventory shortages or obsolescence; delays in actions of regulatory bodies; diversion of or limitations on employee resources that would otherwise be focused on the operations of our business, including because of sickness of employees or their families or the desire of employees to avoid contact with groups of people; business adjustments or disruptions of certain third parties; and additional government requirements or other incremental mitigation efforts. The extent to which future waves, of the COVID-19 pandemic or the spread of variants impact our business will depend on future developments, which are highly uncertain and cannot be predicted, including new information which may emerge 53 Table of Contents concerning the severity and spread of COVID-19 or variants, vaccination rates and the actions to contain the COVID-19 pandemic or treat its impact, among others. In addition, the COVID-19 virus disproportionately impacts older adults, especially those with chronic illnesses, which includes many of our patients, which could strain the resources of our physician practices. Even without government restrictions on travel and our operations, patients may again become reluctant to seek necessary care if the COVID-19 pandemic worsens as a result of new variants. This could have the effect of reducing the revenue of our Medical Groups and our resulting management fees. Such reluctance may result in deferring necessary healthcare services that may adversely affect the health of such patients which may exacerbate health conditions and increase the cost of care in the future, which may adversely affect our VBC performance or divert patients from our Privia Physicians to more expensive and intense providers of services. Further, as a result of the COVID-19 pandemic, we may experience slowed growth or a decline in new patient demand. We also may experience increased internal and third-party medical costs as we provide care for patients suffering from COVID-19. In addition, we may face increased competition due to changes to our competitors’ products and services, including modifications to their terms, conditions, and pricing that could materially adversely affect our business, results of operations, and overall financial condition in future periods. Further government restrictions in response to the COVID-19 pandemic and other national and international incidents could also cause our third-party data center hosting facilities and cloud computing platform providers, which are critical to our infrastructure, to shut down their business, experience security incidents that impact our business, delay or disrupt performance or delivery of services, or experience interference with the supply chain of hardware required by their systems and services, any of which could materially adversely affect our business. In addition, the COVID-19 pandemic has resulted in our employees and those of many of our vendors working from home and conducting work via the internet, and if the network and infrastructure of internet providers becomes overburdened by increased usage or is otherwise unreliable or unavailable, our employees’, and our customers’ and vendors’ employees’, access to the internet to conduct business could be negatively impacted. Limitations on access or disruptions to services or goods provided by or to some of our suppliers and vendors upon which our technology-enabled platform and business operations relies, could interrupt our ability to provide our technology-enabled platform, decrease the productivity of our workforce, and significantly harm our business operations, financial condition, and results of operations. Our technology-enabled platform and the other systems or networks used in our business may experience an increase in attempted cyber-attacks, targeted intrusion, ransomware, and phishing campaigns seeking to take advantage of shifts to employees working remotely using their household or personal internet networks and to leverage fears promulgated by the COVID-19 pandemic. The success of any of these unauthorized attempts could substantially impact our technology-enabled platform, the proprietary and other confidential data contained therein or otherwise stored or processed in our operations, and ultimately our business. Any actual or perceived security incident also may cause us to incur increased expenses to improve our security controls and to remediate security vulnerabilities. On January 12, 2023, HHS again extended the public health emergency for an additional ninety days. On January 30, 2023, the Office of Management and Budget issued a statement of policy that the Biden Administration’s intent is to extend the public health emergency to May 11, 2023, and to end the public health emergency on that date. The Consolidated Appropriations Act of 2023 extended many of the telehealth flexibilities authorized by the COVID-19 public health emergency through December 31, 2024. Nonetheless, once the COVID-19 public health emergency and the extended telehealth flexibility cease, it may be necessary to change certain of our operations to satisfy the then existing requirements, which may revert back to pre-public health emergency standards, and may result in a loss of revenue as coverage for our telehealth capabilities may cease or be significantly reduced. The extent and continued impact of the COVID-19 pandemic on our business will depend on certain developments, including: the duration and spread of the outbreak; government responses to the pandemic; the impact on our customers and our sales cycles; the impact on customer, industry, or employee events; and the effect on our partners and supply chains, all of which are uncertain and cannot be predicted. To the extent the COVID-19 pandemic adversely affects our business and financial results, it may also have the effect of heightening many of the other risks described in this “Risk Factors” section, including but not limited to those relating to cyber-attacks and security vulnerabilities, interruptions or delays due to third parties, or our ability to raise additional capital or generate sufficient cash flows necessary to fulfill our obligations under our existing indebtedness or to expand our operations. Our use, disclosure, and other processing of personal information, including health-related information, is subject to HIPAA, other federal and state privacy and security regulations, and contractual obligations, and our actual or perceived failure to comply with those regulations or contractual obligations could result in significant liability or reputational harm and, in turn, a material adverse effect on our patient base and revenue. Numerous state and federal laws and regulations govern the collection, dissemination, use, privacy, confidentiality, security, availability, integrity, and other processing of PHI and personal information. These laws and regulations include HIPAA. HIPAA establishes a set of national privacy and security standards for the protection of PHI by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates with whom such covered entities contract for services. 54 Table of Contents HIPAA requires covered entities, like us, our Owned or Non-Owned Medical Groups, and their business associates to develop and maintain policies and procedures with respect to PHI that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information. Our Medical Groups are all participants in an “Affiliated Covered Entity” under HIPAA, which is a group of legally separate covered entities that considers themselves a single covered entity due to affiliation or some common control or ownership. Participation in an affiliated covered entity allows us to share certain HIPAA compliance efforts but also provides for joint and several liability for HIPAA violations among all the participants in the Affiliated Covered Entity. In addition to our status as a covered entity, our management services organizations and ACOs are “business associates” to our Medical Groups and ACO participants. Entities that are found to be in violation of HIPAA as the result of a breach of unsecured PHI, a complaint about privacy practices or an audit by the U.S. Department of Health and Human Services, or HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. HIPAA also authorizes state attorneys general to file suit on behalf of their residents. Courts may award damages, costs and attorneys’ fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. In addition, HIPAA mandates that the Secretary of HHS conduct periodic compliance audits of HIPAA covered entities and business associates for compliance with the HIPAA Privacy and Security Standards. It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the Civil Monetary Penalty fine paid by the violator. HIPAA further requires that patients be notified of any unauthorized acquisition, access, use or disclosure of their unsecured PHI that compromises the privacy or security of such information, with certain exceptions related to unintentional or inadvertent use or disclosure by employees or authorized individuals. HIPAA specifies that such notifications must be made “without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.” If a breach affects 500 patients or more, it must be reported to HHS without unreasonable delay, and HHS will post the name of the breaching entity on its public website. Breaches affecting 500 patients or more in the same state or jurisdiction must also be reported to the local media. If a breach involves fewer than 500 people, the covered entity must record it in a log and notify HHS at least annually. A non-permitted use or disclosure of PHI is presumed to be a breach under HIPAA unless the covered entity or business associate establishes that there is a low probability the information has been compromised consistent with requirements enumerated in HIPAA. We are also subject to a provision of the federal 21st Century Cures Act that is intended to facilitate the appropriate exchange of health information. In May 2020, the United States Department of Health and Human Services Office of the National Coordinator for Health Information Technology and CMS issued complementary new rules that are intended to clarify provisions of the 21st Century Cures Act regarding interoperability and information blocking and include, among other things, requirements surrounding information blocking, changes to ONC’s health IT certification program and requirements that CMS regulated payors make relevant claims/care data and provider directory information available through standardized patient access and provider directory application programming interfaces, or APIs, that connect to provider electronic health record systems, or EHRs. The companion rules will transform the way in which healthcare providers, health IT developers, health information exchanges/health information networks, or HIEs/HINs, and health plans share patient information, and create significant new requirements for healthcare industry participants. For example, the ONC rule, which went into effect on April 5, 2021, prohibits healthcare providers, health IT developers of certified health IT, and HIEs/HINs from engaging in practices that are likely to interfere with, prevent, materially discourage, or otherwise inhibit the access, exchange or use of electronic health information, or EHI, also known as “information blocking.” To further support access and exchange of EHI, the ONC rule identifies eight “reasonable and necessary activities” as exceptions to information blocking activities, as long as specific conditions are met. Any failure to comply with these rules could have a material adverse effect on our business, results of operations and financial condition. Numerous other federal and state laws and regulations protect the confidentiality, privacy, availability, integrity and security of PHI and other types of personal information. State statutes and regulations vary from state to state, and these laws and regulations in many cases are more restrictive than HIPAA and its implementing rules. These laws and regulations are often uncertain, contradictory, and subject to changed or differing interpretations, and we expect new laws, rules and regulations regarding privacy, data protection, and information security to be proposed and enacted in the future. For example, the California Consumer Privacy Act of 2018 (the “CCPA”), which was significantly amended by the California Privacy Rights Act (“CPRA”) effective January 1, 2022, affords consumers expanded privacy protections. Additionally, Virginia, Connecticut, Utah and Colorado have passed comprehensive privacy legislation in 2021, and several additional privacy bills have been proposed both at the federal and state level that may result in additional legal requirements that impact our business. California residents also have the right to request that a business delete their personal information unless it is necessary for the business to maintain for certain purposes, to direct a business to correct errors in their personal information, and to restrict the use and disclosure of sensitive information. They have the right to know if their personal information is being sold or shared and the right to opt out of the sale or disclosure. Beginning in 2023, under the CPRA’s amendments, as well as comprehensive privacy legislation passed in Virginia, residents of those states will have additional rights with 55 Table of Contents respect to their personal information, such as a right to opt out of certain processing activities for sensitive data and a right to a portable copy of their personal information. The CPRA creates a new regulator responsible for enforcement of the CPRA, and enforcement priorities of this new regulatory body have yet to be determined. The CCPA and CPRA also provide for civil penalties for violations, as well as a private right of action for data breaches that may increase data breach litigation. Failure to comply with these and any other comprehensive privacy laws passed at the state or federal level may result in regulatory enforcement action and damage to our reputation. The potential effects of such legislation are far-reaching and may require us to modify our data processing practices and policies and to incur substantial costs and expenses to comply. Further, in the event that new data privacy or security laws are implemented that impact our operations or patients, we may not be able to timely comply with such requirements, or such requirements may not be compatible with our current processes. Changing our processes could be time consuming and expensive, and failure to timely implement required changes could subject us to liability for non-compliance. Some states may afford private rights of action to individuals who believe their personal information has been misused. This complex, dynamic legal landscape regarding privacy, data protection, and information security creates significant compliance issues for us and potentially restricts our ability to collect, use and disclose data and exposes us to additional expense, adverse publicity and liability. In the event that we are subject to or affected by the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition. Furthermore, the Federal Trade Commission, or FTC, and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. For example, according to the FTC, failing to take appropriate steps to keep consumers’ personal information secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. While we have implemented data privacy and security measures in an effort to comply with applicable laws, regulations, and contractual obligations relating to privacy and data protection, some PHI and other personal information or confidential information is transmitted to us by third parties, who may not implement adequate security and privacy measures. Additionally, we transmit PHI and other personal information or confidential information to third parties, which carries the risk of breach despite our security and privacy measures. Moreover, it is possible that laws, rules and regulations relating to privacy, data protection, or information security may be interpreted and applied in a manner that is inconsistent with our practices or those of third parties who transmit PHI and other personal information or confidential information to us. Further, any PHI or other personal information residing with a Privia Physicians’ legacy practice entity pursuant to our Support Services Agreement with such entity may not be subject to adequate security and privacy measures, which may result in a breach of its Business Associate Agreement, or BAA, with the relevant covered entity. Although a business associate may be independently found liable for a breach of the privacy or security requirements of HIPAA, we could also be held liable for such breach as the covered entity. If we or any third parties are found to have violated such laws, rules or regulations, it could result in government-imposed fines, orders requiring that we or these third parties change our or their practices, or criminal charges, which could adversely affect our business. Complying with these various laws and regulations could cause us to incur substantial costs or require us to change our business practices, systems and compliance procedures in a manner adverse to our business. Additionally, we publish privacy policies and other documentation regarding our collection, processing, use and disclosure of personal information. Although we endeavor to comply with our published policies and other documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance, including if our employees, contractors, service providers or vendors fail to comply with our published policies and documentation. Such failures can subject us to potential local, state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices. Claims that we have violated individuals’ privacy rights or failed to comply with data protection laws or applicable privacy notices, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business. Any of the foregoing consequences could have a material adverse impact on our business and our financial results. Our ability to use our net operating losses to offset future taxable income may be subject to certain limitations. In general, under Section 382 of the Internal Revenue Code of 1986, as amended (“the Code”), a corporation that undergoes an “ownership change” is subject to limitations on its ability to utilize its pre-change NOLs to offset future taxable income or taxes. A Code Section 382 ownership change generally occurs if one or more stockholders or groups of stockholders who own at least 5% of a corporation’s stock increase their ownership by more than 50 percentage points over their lowest ownership percentage within a rolling three-year period. Similar rules may apply under state tax laws. As of December 31, 2022, we had approximately $103.0 million of federal and $77.2 million of state (post-apportioned state NOL) NOL carryforwards. The federal NOL carryforwards for years before 2018 begin to expire in 2034 and the state NOL carryforwards begin to expire in 2034. Changes in the ownership of our stock in the future, including as a result of future offerings, and some of which are outside of our control, could result in an ownership change under Section 382 of the Code (or applicable state law) after such date, which could significantly limit our ability to utilize our existing and future NOL carryforwards arising at any time prior to such ownership change. 56 Table of Contents General Risks As a public reporting company, we are obligated to maintain proper and effective internal control over financial reporting in order to comply with Section 404 of the Sarbanes-Oxley Act. If we fail to maintain effective internal control over financial reporting, we may not be able to accurately report our financial results or report them in a timely manner, which may adversely affect investor confidence in us . Reporting obligations as a public company place a considerable strain on our financial and management systems, processes and controls, as well as on our personnel. As a public company, we are required to document and test our internal control over financial reporting pursuant to Section 404 of the Sarbanes-Oxley Act so that our management can certify as to the effectiveness of our internal control over financial reporting. Section 404(a) of the Sarbanes-Oxley Act (“Section 404(a)”) requires that beginning with this annual report for the year ended December 31, 2022, management assess and report annually on the effectiveness of our internal control over financial reporting and identify any material weaknesses in our internal control over financial reporting. Section 404(b) requires our independent registered public accounting firm to issue an annual report that addresses the effectiveness of our internal control over financial reporting. Our compliance with Section 404(a) has required to incur substantial expenses and expend significant management efforts. If we identify material weaknesses in our internal control over financial reporting in the future, our management will be unable to assert that our disclosure controls and procedures and our internal control over financial reporting is effective. If we are unable to assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an unqualified opinion as to the effectiveness of our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports, the market price of our common stock could be adversely affected and we could become subject to litigation or investigations by Nasdaq, the SEC, or other regulatory authorities, which could require additional financial and management resources. Increased attention to, and evolving expectations for, environmental, social, and governance (“ESG”) initiatives could increase our costs, harm our reputation, or otherwise adversely impact our business . Companies across industries are facing increasing scrutiny from a variety of stakeholders related to their ESG and sustainability practices. Expectations regarding voluntary ESG initiatives and disclosures may result in increased costs (including but not limited to increased costs related to compliance, stakeholder engagement, contracting and insurance), enhanced compliance or disclosure obligations, or other adverse impacts to our business, financial condition, or results of operations. While we may at times engage in voluntary initiatives (such as voluntary disclosures, certifications, or goals, among others) to improve the ESG profile of the Company, such initiatives may be costly and may not have the desired effect. Moreover, we may not be able to successfully complete such initiatives due to factors that are within or outside of our control. Even if this is not the case, our actions may subsequently be determined to be insufficient by various stakeholders, and we may be subject to investor or regulator engagement on our ESG efforts, even if such initiatives are currently voluntary. Certain market participants, including major institutional investors and capital providers, use third-party benchmarks and scores to assess companies’ ESG profiles in making investment or voting decisions. Unfavorable ESG ratings could lead to increased negative investor sentiment towards us, which could negatively impact our share price as well as our access to and cost of capital. To the extent ESG matters negatively impact our reputation, it may also impede our ability to compete as effectively to attract and retain employees, which may adversely impact our operations. In addition, we expect there will likely be increasing levels of regulation, disclosure-related and otherwise, with respect to ESG matters. For example, the SEC has published propose rules that would require companies to provide significantly expanded climate-related disclosures in their periodic reporting, which may require us to incur significant additional costs to comply, including the implementation of significant additional internal controls processes and procedures regarding matters that have not been subject to such controls in the past, and impose increased oversight obligations on our management and board of directors. These and other changes in stakeholder expectations will likely lead to increased costs as well as scrutiny that could heighten all of the risks identified in this risk factor. Additionally, our business partners may be subject to similar expectations, which may augment or create additional risks, including risks that may not be known to us. Risks Related to Our Indebtedness Our existing indebtedness could adversely affect our business and growth prospects. As of December 31, 2022, there was no amount outstanding under our Term Loan Facility and $65.0 million of borrowing availability under our Revolving Credit Facility. Our indebtedness, or any additional indebtedness we may incur, could require us to divert funds identified for other purposes for debt service and impair our liquidity position. If we cannot generate sufficient cash flow from operations to service our debt, we may need to refinance our debt, dispose of assets or issue equity to obtain necessary funds. We do not know whether we will be able to take any of these actions on a timely basis, on terms satisfactory to us or at all. 57 Table of Contents Our indebtedness and the cash flow needed to satisfy our debt have important consequences, including: • limiting funds otherwise available for financing our capital expenditures by requiring us to dedicate a portion of our cash flows from operations to the repayment of debt and the interest on this debt; • making us more vulnerable to rising interest rates; and • making us more vulnerable in the event of a downturn in our business. Our level of indebtedness may place us at a competitive disadvantage to our competitors that are not as highly leveraged. Fluctuations in interest rates can increase borrowing costs. Increases in interest rates may directly impact the amount of interest we are required to pay and reduce earnings accordingly. In addition, developments in tax policy, such as the disallowance of tax deductions for interest paid on outstanding indebtedness, could have an adverse effect on our liquidity and our business, financial conditions and results of operations. We expect to use cash flow from operations to meet current and future financial obligations, including funding our operations, debt service requirements and capital expenditures. The ability to make these payments depends on our financial and operating performance, which is subject to prevailing economic, industry and competitive conditions and to certain financial, business, economic and other factors beyond our control. We may not be able to generate sufficient cash flow to service all of our indebtedness, and may be forced to take other actions to satisfy our obligations under such indebtedness, which may not be successful. Our ability to make scheduled payments or to refinance outstanding debt obligations depends on our financial and operating performance, which will be affected by prevailing economic, industry and competitive conditions and by financial, business and other factors beyond our control. We may not be able to maintain a sufficient level of cash flow from operating activities to permit us to pay the principal, premium, if any, and interest on our indebtedness. Any failure to make payments of interest and principal on our outstanding indebtedness on a timely basis would likely result in penalties or defaults, which would also harm our ability to incur additional indebtedness. If our cash flows and capital resources are insufficient to fund our debt service obligations, we may be forced to reduce or delay capital expenditures, sell assets, seek additional capital or seek to restructure or refinance our indebtedness. Any refinancing of our indebtedness could be at higher interest rates and may require us to comply with more onerous covenants. These alternative measures may not be successful and may not permit us to meet our scheduled debt service obligations. In the absence of such cash flows and resources, we could face substantial liquidity problems and might be required to sell material assets or operations to attempt to meet our debt service obligations. If we cannot meet our debt service obligations, the holders of our indebtedness may accelerate such indebtedness and, to the extent such indebtedness is secured, foreclose on our assets. In such an event, we may not have sufficient assets to repay all of our indebtedness. We may be unable to refinance our indebtedness. We may need to refinance all or a portion of our indebtedness before maturity. We cannot assure you that we will be able to refinance any of our indebtedness on commercially reasonable terms or at all. There can be no assurance that we will be able to obtain sufficient funds to enable us to repay or refinance our debt obligations on commercially reasonable terms, or at all. The terms of our Credit Agreement restrict our current and future operations, particularly our ability to respond to changes or to take certain actions. The Credit Agreement contains a number of restrictive covenants that impose significant operating and financial restrictions on us and may limit our ability to engage in acts that may be in our long-term best interests, including restrictions on our ability to: • incur additional indebtedness or other contingent obligations; • create liens; • make investments, acquisitions, loans and advances; • consolidate, merge, liquidate or dissolve; • sell, transfer or otherwise dispose of our assets; • pay dividends on our equity interests or make other payments in respect of capital stock; and • materially alter the business we conduct. You should read the discussion under the heading “Description of Certain Indebtedness” for further information about these covenants. 58 Table of Contents The restrictive covenants in the Credit Agreement require us to satisfy certain financial condition tests. Our ability to satisfy those tests can be affected by events beyond our control. A breach of the covenants or restrictions under the Credit Agreement could result in an event of default under such document. Such a default may allow the creditors to accelerate the related debt, which may result in the acceleration of any other debt to which a cross-acceleration or cross-default provision applies. In the event the holders of our indebtedness accelerate the repayment, we may not have sufficient assets to repay that indebtedness or be able to borrow sufficient funds to refinance it. Even if we are able to obtain new financing, it may not be on commercially reasonable terms or on terms acceptable to us. As a result of these restrictions, we may be: • limited in how we conduct our business; • unable to raise additional debt or equity financing to operate during general economic or business downturns; or • unable to compete effectively or to take advantage of new business opportunities. These restrictions, along with restrictions that may be contained in agreements evidencing or governing other future indebtedness, may affect our ability to grow in accordance with our growth strategy. Our failure to raise additional capital or generate cash flows necessary to expand our operations and invest in new technologies in the future could reduce our ability to compete successfully and harm our results of operations. We may need to raise additional funds, and we may not be able to obtain additional debt or equity financing on favorable terms or at all. If we raise additional equity financing, our security holders may experience significant dilution of their ownership interests. If we engage in additional debt financing, we may be required to accept terms that restrict our ability to incur additional indebtedness, force us to maintain specified liquidity or other ratios or restrict our ability to pay dividends or make acquisitions. In addition, the covenants in our Credit Agreement may limit our ability to obtain additional debt, and any failure to adhere to these covenants could result in penalties or defaults that could further restrict our liquidity or limit our ability to obtain financing. If we need additional capital and cannot raise it on acceptable terms, or at all, we may not be able to, among other things: • develop and enhance our patient services; • continue to expand our organization; • hire, train and retain employees; • respond to competitive pressures or unanticipated working capital requirements; or • pursue acquisition opportunities. In addition, if we issue additional equity to raise capital, your interest in us will be diluted. Risks Related to Our Common Stock The Lead Sponsors have significant influence on us, and their interests may conflict with ours or yours in the future. As of February 23, 2023, investment entities affiliated with Goldman Sachs (collectively, “Goldman Sachs”) and Pamplona Capital Management LLP (“Pamplona” and, together with Goldman Sachs, the “Lead Sponsors”) beneficially own or control approximately 21.6% and 15.4%, respectively, of our common stock. Based on their combined percentage voting power, the Lead Sponsors have significant influence over the vote of all matters submitted to a vote of our shareholders. For so long as the Lead Sponsors continue to own a significant percentage of our stock, the Lead Sponsors will still be able to significantly influence the composition of our Board and the approval of actions requiring shareholder approval. Accordingly, for such period, the Lead Sponsors will have significant influence with respect to our management, business plans and policies, including the appointment and removal of our officers, decisions on whether to raise future capital and amending our amended and restated charter and amended and restated bylaws, which govern the rights attached to our common stock. In particular, for so long as the Lead Sponsors continue to own a significant percentage of our stock, the Lead Sponsors will be able to cause or prevent a change of control of us or a change in the composition of our Board and could preclude any unsolicited acquisition of us. The concentration of ownership could deprive you of an opportunity to receive a premium for your shares of common stock as part of a sale of us and ultimately might affect the market price of our common stock. In addition, in connection with our initial public offering, we entered into a Shareholder Rights Agreement (defined herein) that provides each Lead Sponsor the right to designate: (i) three of the nominees for election to our Board for so long as each beneficially owns at least 15% of our common stock then outstanding; (ii) two of the nominees for election to our Board for so long as each beneficially owns less than 15% but at least 10% of our common stock then outstanding; and (iii) one of the nominees for election to our Board for so long as each beneficially owns less than 10% but at least 5% of our common stock then outstanding. The Lead Sponsors may also assign such rights to their affiliates. The Shareholder Rights Agreement also prohibits us from increasing or decreasing the size of our Board without the prior written consent of the Lead Sponsors. In addition, for so long as either Lead Sponsor owns at least 15% of the common stock, its consent will be required for certain corporate actions, including a change of 59 Table of Contents control; acquisitions or dispositions of assets in an amount exceeding 15% of our total assets; the issuance of equity by us or any of our subsidiaries (other than under equity incentive plans that have received the prior approval of our board of directors) in an amount exceeding $50 million; the incurrence of indebtedness by us or any of our subsidiaries in an amount exceeding $50 million; amendments to our amended and restated certificate of incorporation or amended and restated bylaws; changes to our strategic direction or scope of its business; any change in the size of our board of directors; the hiring or termination of the Chief Executive Officer, Chief Financial Officer and Chief Operational Officer; and approval of our annual budget. The Lead Sponsors and their affiliates engage in a broad spectrum of activities, including investments in the healthcare industry generally. In the ordinary course of their business activities, the Lead Sponsors and their affiliates may engage in activities where their interests conflict with our interests or those of our other shareholders, such as investing in or advising businesses that directly or indirectly compete with certain portions of our business or are suppliers or customers of ours. Our amended and restated certificate of incorporation provides that none of the Lead Sponsors, any of their affiliates or any director who is not employed by us (including any non-employee director who serves as one of our officers in both his director and officer capacities) or its affiliates will have any duty to refrain from engaging, directly or indirectly, in the same business activities or similar business activities or lines of business in which we operate. The Lead Sponsors also may pursue acquisition opportunities that may be complementary to our business, and, as a result, those acquisition opportunities may not be available to us. In addition, the Lead Sponsors may have an interest in pursuing acquisitions, divestitures and other transactions that, in its judgment, could enhance its investment, even though such transactions might involve risks to you. Risks related to the Pamplona Entities, a Lead Sponsor. Pamplona Capital Management LLC and related entities (the “Pamplona Entities”) beneficially owned approximately 15.4% of our outstanding common stock as of December 31, 2022. Certain shareholders of LetterOne, which is a significant investor in the Pamplona Entities, are on the UK and EU Russian sanctions list, although neither the Pamplona Entities nor LetterOne have been designated and, to the best of our knowledge, are not sanctioned. While we believes that we are in full compliance with all applicable sanctions regulations and intend to remain so, there can be no assurance that the perception of Pamplona’s relationship with Privia will not adversely affect our business or stock price. The requirements of being a public company may strain our resources and distract our management, which could make it difficult to manage our business, particularly after we are no longer an “emerging growth company.” As a public company, we incur legal, accounting and other expenses that we did not previously incur as a privately held company. We are subject to the reporting requirements of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), and certain requirements under the Sarbanes-Oxley Act, the listing requirements of NASDAQ and other applicable securities rules and regulations. Compliance with these rules and regulations have increased our legal and financial compliance costs, made some activities more difficult, time-consuming or costly and increased demand on our systems and resources. We will continue to experience such increased costs and challenges particularly because we are no longer an “emerging growth company.” The Exchange Act requires that we file annual, quarterly and current reports with respect to our business, financial condition and results of operations. The Sarbanes-Oxley Act requires, among other things, that we establish and maintain effective internal controls and procedures for financial reporting. Furthermore, the need to establish the corporate infrastructure demanded of a public company may divert our management’s attention from implementing our growth strategy, which could prevent us from improving our business, financial condition and results of operations. We have made, and will continue to make, changes to our internal controls and procedures for financial reporting and accounting systems to meet our reporting obligations as a public company. However, the measures we take may not be sufficient to satisfy our obligations as a public company. These additional obligations could have a material adverse effect on our business, financial condition and results of operations. In addition, changing laws, regulations and standards relating to corporate governance and public disclosure are creating uncertainty for public companies, increasing legal and financial compliance costs and making some activities more time consuming. These laws, regulations and standards are subject to varying interpretations, in many cases due to their lack of specificity, and, as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies. This could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices. We intend to invest resources to comply with evolving laws, regulations and standards, and this investment may result in increased general and administrative expenses and a diversion of our management’s time and attention from revenue-generating activities to compliance activities. If our efforts to comply with new laws, regulations and standards differ from the activities intended by regulatory or governing bodies due to ambiguities related to their application and practice, regulatory authorities may initiate legal proceedings against us and there could be a material adverse effect on our business, financial condition and results of operations. Provisions of our corporate governance documents could make an acquisition of us more difficult and may prevent attempts by our shareholders to replace or remove our current management, even if beneficial to our shareholders. Our amended and restated certificate of incorporation and amended and restated bylaws and the Delaware General Corporation Law (the “DGCL”) contain provisions that could make it more difficult for a third party to acquire us, even if doing so might be beneficial to our shareholders. Among other things, these provisions: 60 Table of Contents • allow us to authorize the issuance of undesignated preferred stock, the terms of which may be established and the shares of which may be issued without shareholder approval, and which may include supermajority voting, special approval, dividend, or other rights or preferences superior to the rights of shareholders; • provide for a classified board of directors with staggered three-year terms, from and after the date on which the Lead Sponsors beneficially own, in the aggregate, less than 25% of our common stock then outstanding; • prohibit shareholder action by written consent and shareholder special meetings as well as permit removal of directors only for cause from and after the date on which the Lead Sponsors beneficially own, in the aggregate, less than 25% of our common stock then outstanding; • provide that any amendment, alteration, rescission or repeal of our amended and restated bylaws by our shareholders will require the affirmative vote of the holders of at least 66.6% in voting power of all the then-outstanding shares of our stock entitled to vote thereon, voting together as a single class, from and after the date on which the Lead Sponsors beneficially own, in the aggregate, less than 25% of our common stock then outstanding; and • establish advance notice requirements for nominations for elections to our Board or for proposing matters that can be acted upon by shareholders at shareholder meetings, provided, however, that at any time when a Lead Sponsor beneficially owns, in the aggregate, at least 25% of our common stock then outstanding, such advance notice procedure will not apply to that Lead Sponsor. Our amended and restated certificate of incorporation contains a provision that provides us, from and after the date on which the Lead Sponsors beneficially own, in the aggregate, less than 25% of our common stock then outstanding, with protections similar to Section 203 of the DGCL, and will prevent us from engaging in a business combination with a person (excluding the Lead Sponsors and any of their direct or indirect transferees and any group as to which such persons are a party), unless board or shareholder approval is obtained prior to the acquisition. These provisions could discourage, delay or prevent a transaction involving a change in control of our company. These provisions could also discourage proxy contests and make it more difficult for you and other shareholders to elect directors of your choosing and cause us to take other corporate actions you desire, including actions that you may deem advantageous, or negatively affect the trading price of our common stock. In addition, because our Board is responsible for appointing the members of our management team, these provisions could in turn affect any attempt by our shareholders to replace current members of our management team. These and other provisions in our amended and restated certificate of incorporation, amended and restated bylaws and Delaware law could make it more difficult for shareholders or potential acquirers to obtain control of our Board or initiate actions that are opposed by our then-current Board, including delay or impede a merger, tender offer or proxy contest involving our company. The existence of these provisions could negatively affect the price of our common stock and limit opportunities for you to realize value in a corporate transaction. Our amended and restated certificate of incorporation designates the Court of Chancery of the State of Delaware as the exclusive forum for certain litigation that may be initiated by our shareholders, which may limit our shareholders’ ability to obtain a favorable judicial forum for disputes with us. Pursuant to our amended and restated certificate of incorporation, unless we consent in writing to the selection of an alternative forum, the Court of Chancery of the State of Delaware is the sole and exclusive forum for (1) any derivative action or proceeding brought on our behalf, (2) any action asserting a claim of breach of a fiduciary duty owed by any of our directors, officers or other employees to us or our shareholders, (3) any action asserting a claim against us arising pursuant to any provision of the DGCL, our amended and restated certificate of incorporation or our amended and restated bylaws or (4) any other action asserting a claim against us that is governed by the internal affairs doctrine; provided that for the avoidance of doubt, the forum selection provision that identifies the Court of Chancery of the State of Delaware as the exclusive forum for certain litigation, including any “derivative action”, will not apply to suits to enforce a duty or liability created by the Securities Act, the Exchange Act or any other claim for which the federal courts have exclusive jurisdiction. Our amended and restated certificate of incorporation further provides that any person or entity purchasing or otherwise acquiring any interest in shares of our capital stock is deemed to have notice of and consented to the provisions of our amended and restated certificate of incorporation described above. The forum selection clause in our amended and restated certificate of incorporation may have the effect of discouraging lawsuits against us or our directors and officers and may limit our shareholders’ ability to obtain a favorable judicial forum for disputes with us. Our operating results and stock price may be volatile, and the market price of our common stock may drop below the price you pay. Our quarterly operating results are likely to fluctuate in the future. In addition, securities markets worldwide have experienced, and are likely to continue to experience, significant price and volume fluctuations. This market volatility, as well as general economic, market 61 Table of Contents or political conditions, could subject the market price of our shares to wide price fluctuations regardless of our operating performance. Our operating results and the trading price of our shares may fluctuate in response to various factors, including: • market conditions in our industry or the broader stock market; • actual or anticipated fluctuations in our quarterly financial and operating results; • introduction of new solutions or services by us or our competitors; • issuance of new or changed securities analysts’ reports or recommendations; • sales, or anticipated sales, of large blocks of our stock; • additions or departures of key personnel; • regulatory or political developments; • litigation and governmental investigations; • changing economic conditions; • investors’ perception of us; • events beyond our control such as weather and war; and • any default on our indebtedness. These and other factors, many of which are beyond our control, may cause our operating results and the market price and demand for our shares to fluctuate substantially. Fluctuations in our quarterly operating results could limit or prevent investors from readily selling their shares and may otherwise negatively affect the market price and liquidity of our shares. In addition, the trading market for our shares may be subject to increased volatility. In addition, in the past, when the market price of a stock has been volatile, holders of that stock have sometimes instituted securities class action litigation against the company that issued the stock. If any of our shareholders brought a lawsuit against us, we could incur substantial costs defending the lawsuit. Such a lawsuit could also divert the time and attention of our management from our business, which could significantly harm our profitability and reputation. Future sales and issuances of our outstanding shares could cause the market price of our common stock to drop significantly, even if our business is doing well. Sales of a substantial number of shares of our common stock in the public market could occur at any time. These sales, or the perception in the market that the holders of a large number of shares intend to sell shares, could reduce the market price of our common stock. Pursuant to the registration rights agreement with our principal stockholders, we have agreed to file registration statements for the resale of shares of our common stock held by, or issuable to, our principal stockholders, certain other stockholders and certain of our directors, executive officers and employees. All of our common stock sold pursuant to an offering covered by a registration statement will be freely transferable. In addition, shares of our common stock issued or issuable under our equity incentive plans to employees and directors have been registered on a Form S-8 registration statement and may be freely sold in the public market upon issuance, except for shares held by affiliates who have certain restrictions on their ability to sell. The market price of our stock could decline if the holders of our shares of common stock sell them or are perceived by the market as intending to sell them. Because we have no current plans to pay regular cash dividends on our common stock, you may not receive any return on investment unless you sell your common stock for a price greater than that which you paid for it. We do not anticipate paying any regular cash dividends on our common stock. Any decision to declare and pay dividends in the future will be made at the discretion of our Board and will depend on, among other things, our results of operations, financial condition, cash requirements, contractual restrictions and other factors that our Board may deem relevant. In addition, our ability to pay dividends is, and may be, limited by covenants of existing and any future outstanding indebtedness we or our subsidiaries incur. Therefore, any return on investment in our common stock is solely dependent upon the appreciation of the price of our common stock on the open market, which may not occur. See “Dividend Policy” for more detail. If securities or industry analysts do not continue to publish research or reports about our business, if they adversely change their recommendations regarding our shares or if our results of operations do not meet their expectations, our stock price and trading volume could decline. The trading market for our shares will be influenced by the research and reports that industry or securities analysts publish about us or our business. We do not have any control over these analysts. If one or more of these analysts cease coverage of us or fail to publish reports on us regularly, we could lose visibility in the financial markets, which in turn could cause our stock price or trading volume to decline. Moreover, if one or more of the analysts who cover us downgrade our stock, or if our results of operations do not meet their expectations, our stock price could decline. 62 Table of Contents We may issue shares of preferred stock in the future, which could make it difficult for another company to acquire us or could otherwise adversely affect holders of our common stock, which could depress the price of our common stock. Our amended and restated certificate of incorporation authorizes us to issue one or more series of preferred stock. Our Board has the authority to determine the preferences, limitations and relative rights of the shares of preferred stock and to fix the number of shares constituting any series and the designation of such series, without any further vote or action by our shareholders. Our preferred stock could be issued with voting, liquidation, dividend and other rights superior to the rights of our common stock. The potential issuance of preferred stock may delay or prevent a change in control of us, discouraging bids for our common stock at a premium to the market price, and materially adversely affect the market price and the voting and other rights of the holders of our common stock. 63 Table of Contents ITEM 1B. UNRESOLVED STAFF COMMENTS None.