What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-02-27 compared with 2023-03-01 · 299 added, 298 removed, 776 unchanged (43% of the section changed)

2 unchanged sentences

The risks and uncertainties described below are not the only ones we face.

It is not possible to predict or identify all such factors.

Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that affect us.

If any of the following risks occur, our business, financial condition, operating results and prospectus could be materially and adversely affected.

If any of the following risks occur, our business, financial condition, operating results and prospects could be materially and adversely affected.

In that event, the price of our common stock could decline, and you could lose all or part of your investment.

Risk Factor Summary

The following is a summary of risks factors that could materially and adversely affect our business, financial conditions and results of operations.

• we conduct business in a heavily regulated industry, and if we fail to comply with applicable healthcare laws and government regulations, which may change from time to time, we could incur financial penalties, become excluded from participating in government health care programs, and be required to make significant operational changes or experience adverse publicity, which could harm our business;

• our business model could be challenged and, if any challenges are successful, we could incur financial penalties, become excluded from participating in government health care programs, be required to make significant operational changes or experience adverse publicity, which could harm our business;

• our actual or perceived failure to adequately protect the privacy and security of our patients’ information, or a breach of our patient’s information could result in financial penalties, require us to incur significant costs to mitigate such, and result in adverse publicity, which could harm our business;

• our history of net losses, and our ability to achieve or maintain profitability in an environment of increasing expenses;

• evolving government regulations may increase costs or negatively impact our results of operations;

• the COVID-19 pandemic may continue to, or other national or global issues may arise that could, have an adverse impact on our business, operations, and the markets and communities in which we operate;

• the impact on our business of security breaches, loss of data or other disruptions causing the compromise of sensitive information or preventing us from accessing critical information, put our patient data at risk, and result in financial penalties and require us to incur significant costs to mitigate such, and result in adverse publicity, which could harm our business;

• our ability to compete in the healthcare industry;

• our dependence on reimbursements by third-party payers and payments by individuals;

• our reliance on third-party vendors to host and maintain the Privia Technology Solution;

• failure to maintain and renew existing physician practices, Privia Physicians, health system or hospital partners, or commercial payer customers do not continue to renew their contracts with us;

• failure to adequately expand our direct sales force and our business development staff;

• the viability of our growth strategy and our ability to realize expected results;

• the impact on our business of disruptions in our disaster recovery systems or management continuity planning;

• our ability to develop and maintain proper and effective internal control over financial reporting;

• the potential adverse impact of legal proceedings and litigation;

• our ability to maintain and enhance our reputation and brand recognition;

• our ability to properly structure and perform under our value-based care programs;

• our ability to retain senior management team and other key employees given the current labor market, escalating inflation and salary demands;

• overall business results may suffer from an economic downturn.

The following is a summary of risks factors that could materially and adversely affect our business, financial condition and results of operations.

• we conduct business in a heavily regulated industry, which increases our costs and could restrict the conduct of our business, and if we fail to comply with applicable healthcare laws and government regulations, which may change from time to time, we could incur financial penalties, become excluded from participating in government health care programs, be required to make significant operational changes or experience adverse publicity, which may adversely affect our business;

• our business model is unique and could be challenged, and if any challenges were to be successful, we could incur financial penalties, affected Medical Groups could be excluded from participation in federal health care programs, we could be required to make significant operational changes, which could negatively impact our financial performance and threaten existing relationships with Privia Physicians, and we could experience negative publicity, which could slow our growth projections;

• our revenues and profits could be diminished if we fail to retain our Privia Physicians or fail to recruit new Privia Physicians to affiliate with our Medical Groups;

• we are dependent on our relationships with Medical Groups, some of which we do not own, to furnish Privia Providers, to provide professional services to patients on behalf of federal health care programs and commercial payers, and our business could be adversely affected by our Medical Groups failure to maintain relationships with Privia Providers and/or recruit new and replacement Privia Providers;

• as more of our revenue transitions from fee-for-service to value-based reimbursement models such transitions may change the nature of our legal and regulatory risks, increase the costs necessary for our Medical Groups to furnish such care, and place a

greater portion of our current revenue at risk for costs that we may not always have the ability to control, all of which may have a material adverse effect on our financial condition and operations;

• we are dependent on our EMR vendor, athenahealth, Inc., which our Privia Technology Solution is integrated and built upon, and our business could be adversely affected if that relationship were disrupted;

• we have a history of net losses, we anticipate increasing expenses in the future, and we may not be able to maintain profitability;

• security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our patients, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, operations and our reputation;

• the costs of complying with, or our failure to comply with, U.S.

and foreign laws related to privacy, data security and data protection could adversely affect our financial condition, operating results and reputation;

• the healthcare industry is highly competitive;

• thee impact on us of recent healthcare legislation and other changes in the healthcare industry and in healthcare spending is currently unknown, but may adversely affect our business, financial condition and results of operations;

• if reimbursement rates paid by third-party payers are reduced or if such payers otherwise restrain our ability to provide services to their enrollees through narrow network products or otherwise, our business could be harmed;

• the success of our business depends on the execution of our growth strategy, which may not prove viable and we may not realize expected results;

• we rely on third-party vendors for many of our services, including our Patient Technology Solution, and any failure or interruption in the services, or failure to protect the privacy and security of our information during the provision of such services could expose us to litigation, result in a reduction of our management fees or the imposition of financial penalties on our management services organizations, and hurt our reputation and relationships with our Privia Physicians, our Medical Groups, and their patients;

• we may be subject to legal proceedings and litigation, including intellectual property and privacy disputes, which are costly to defend and could materially harm our business and results of operations;

• our overall business results may suffer from an economic downturn, including the ability to attract and retain qualified personnel at competitive rates;

• our use and disclosure of personal information, including health-related information, is subject to the federal Health Insurance Portability and Accountability Act of 1996, as amended from time to time (collectively HIPAA), other federal and state privacy and security regulations, and contractual obligations and our actual or perceived failure to comply with such could result in significant liability or reputation harm and, in turn a material adverse effect on our patient base and operations;

• we may not be able to maintain effective internal control over our financial reporting, accurately report our financial results or report them in a timely manner, which may adversely affect investor confidence in us;

• negative publicity relating to our business, industry, Medical Groups or Privia Providers may have a material adverse effect on our financial results;

• our operating results and stock price may be volatile, and the market price of our common stock may drop below the price you pay.

Risks Related to Government Regulation, Our Business and Our Industry

We conduct business in a heavily regulated industry, and if we fail to comply with applicable healthcare laws and government regulations, we could incur financial penalties, become excluded from participating in government health care programs, be required to make significant operational changes or experience adverse publicity, which may adversely affect our business.

We conduct business in a heavily regulated industry, which increases our costs and could restrict the conduct of our business, and if we fail to comply with applicable healthcare laws and government regulations, which may change from time to time, we could incur financial penalties, become excluded from participating in government health care programs, be required to make significant operational changes or experience adverse publicity, which may adversely affect our business.

healthcare industry is heavily regulated and closely scrutinized by federal, state and local authorities.

Comprehensive statutes and regulations govern the manner in which our Medical Groups provide and bill for services and collect reimbursement from governmental health care programs and commercial payers, our contractual relationships with our Privia Providers, vendors, health network partners and customers, how we contract with commercial payers, our marketing activities and other aspects of our operations.

Comprehensive statutes and regulations, some of which require our reliance on Privia Providers to comply with, govern the manner in which our Medical Groups provide and bill for services and collect reimbursement from federal health care programs and commercial payers, our contractual relationships with our Privia Providers, vendors, health network partners and customers, how we contract with commercial payers, our marketing activities and other aspects of our operations.

Of particular importance are:

• state laws that prohibit general business corporations, such as us, from practicing medicine, controlling Privia Physicians’ medical decisions or engaging in practices such as splitting professional fees with Privia Physicians;

• federal and state laws pertaining to non-physician clinicians, such as nurse practitioners and physician assistants, including requirements for physician supervision of such practitioners and reimbursement-related requirements;

• the federal physician self-referral law, commonly referred to as the Stark Law, which, subject to certain exceptions, prohibits physicians from referring Medicare or Medicaid patients to an entity for the provision of certain “designated health services”, or DHS, such as laboratory and other ancillary health care services if the physician or a member of the physician’s immediate family has a direct or indirect financial relationship (including an ownership interest or a compensation arrangement) with the entity, and prohibits the entity from billing Medicare or Medicaid for such DHS;

• the federal physician self-referral law, commonly referred to as the Stark Law, which, subject to certain exceptions, prohibits physicians from referring Medicare patients to an entity for the provision of certain “designated health services”, or DHS, such as laboratory and other ancillary health care services if the physician or a member of the physician’s immediate family has a direct or indirect financial relationship (including an ownership interest or a compensation arrangement) with the entity, and prohibits the entity from billing Medicare for such DHS;

• the federal Anti-Kickback Statute, or AKS, which, subject to certain exceptions known as “safe harbors,” prohibits the knowing and willful offer, payment, solicitation or receipt of any bribe, kickback, rebate or other remuneration, directly or indirectly, overtly or covertly in cash or in kind, to induce, or in return for, either the referral of an individual, or the lease, purchase, order or recommendation of, items or services covered, in whole or in part, by government healthcare programs such as Medicare and Medicaid.

2 unchanged sentences

Failure to meet the requirements of a safe harbor, however, does not render an arrangement illegal, although such arrangements may be subject to greater scrutiny by government authorities.

Further, a person or entity can be found guilty of violating the statute without actual knowledge of the statute or specific intent to violate it;

Further, a person or entity can be found guilty of violating the AKS without actual knowledge of the statute or specific intent to violate it;

• federal and state civil and criminal false claims laws, including the False Claims Act, or FCA, which prohibit, among other things, individuals or entities from knowingly presenting, or causing to be presented, false or fraudulent claims for payment to, or approval by Medicare, Medicaid, or other federal health care programs, knowingly making, using or causing to be made or used a false record or statement material to a false or fraudulent claim or an obligation to pay or transmit money to the federal government, or knowingly concealing or knowingly and improperly avoiding or decreasing an obligation to pay money to the federal government.

4 unchanged sentences

The FCA also permits a private individual acting as a “whistleblower” to bring actions on behalf of the federal government alleging violations of the FCA and to share in any monetary recovery;

• the criminal healthcare fraud provisions of the federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, and their implementing regulations, or collectively, HIPAA, and related rules that prohibit knowingly and willfully executing, or attempting to execute, a scheme or artifice to defraud any healthcare benefit program or obtain, by means of false or fraudulent pretenses, representations, or promises, any of the money or property owned by, or under the custody or control of, any healthcare benefit program, regardless of the payer (e.g., public or private), and knowingly and willfully falsifying, concealing or

covering up by any trick or device a material fact or making any material false, fictitious or fraudulent statement in connection with the delivery of or payment for health care benefits, items or services.

• the criminal healthcare fraud provisions of HIPAA, and related rules that prohibit knowingly and willfully executing, or attempting to execute, a scheme or artifice to defraud any healthcare benefit program or obtain, by means of false or fraudulent pretenses, representations, or promises, any of the money or property owned by, or under the custody or control of, any healthcare benefit program, regardless of the payer (e.g., public or private), and knowingly and willfully falsifying, concealing or covering up by any trick or device a material fact or making any material false, fictitious or fraudulent statement in connection with the delivery of or payment for health care benefits, items or services.

Similar to the federal Anti-Kickback Statute, a person or entity can be found guilty of violating the statute without actual knowledge of the statute or specific intent to violate it;

9 unchanged sentences

• state laws related to the advertising and marketing of services by healthcare providers, including Medical Group and Privia Physicians;

• federal laws that impose civil administrative sanctions for, among other violations, inappropriate billing of services to government health care programs or employing or contracting with individuals who are excluded from participation in government health care programs;

• federal laws that impose civil administrative sanctions for, among other violations, inappropriate billing of services to federal health care programs or employing or contracting with individuals who are excluded from participation in federal health care programs;

• laws and regulations limiting the use of funds in health savings accounts for individuals with high deductible health plans;

• federal and state laws regarding such telemedicine services, including necessary technological standards to deliver such services, coverage restrictions associated with such services, and the amount of reimbursement for such services;

• federal and state laws regarding the provision of telemedicine services, including necessary technological standards to deliver such services, coverage restrictions associated with such services, and the amount of reimbursement for such services;

• state laws pertaining to anti-kickback, fee splitting, self-referral and false claims, some of which are not consistent with comparable federal laws and regulations, including, for example, not being limited in scope to relationships involving government health care programs;

• federal and state laws pertaining to the collection, use, retention, protection, security, disclosure, transfer and processing of personal data;

• federal and state laws pertaining to the collection, use, retention, protection, security, disclosure, transfer and processing of personal information or health information, including but not limited to HIPAA, HITECH, and the American Recovery and Reinvestment Act of 2009, as well as similar or more stringent state law;

• state insurance laws governing what healthcare entities may bear financial risk and the allowable types of financial risks, including direct primary care programs, provider-sponsored organizations, ACOs, independent practice associations, and provider capitation;

• interoperability and prohibitive provisions against information blocking of the 21st Century Cures Act.

To enforce compliance with the federal laws, the U.S.

10 unchanged sentences

The risk of our being found in violation of these laws and regulations is increased by the fact that many of them have not been fully interpreted by regulatory authorities or the courts, and their provisions are sometimes complex and open to a variety of interpretations.

It is unknown, whether, when or how the laws, or the interpretation thereof, will change in the future and impact our business, financial condition, cash flows, and results of operations.

In addition, some of the governmental and regulatory bodies that regulate us may consider enhanced or new regulatory requirements or may seek to exercise their supervisory or enforcement authority in new or more robust ways.

Any of these possibilities, if they occur, could adversely affect us.

Our operating model seeks to structure each Medical Group as a “group practice” for purposes of the Stark Law.

The Stark Law’s “group practice” definition is subject to a multi-factor analysis under the current regulatory scheme with many of the factors having multiple options for compliance.

Many of the individual factors have not been subject to meaningful judicial interpretation or regulatory agency guidance, and such regulatory agency guidance is subject to change periodically.

Many of the individual factors have not been subject to meaningful judicial interpretation or regulatory agency guidance, and when regulatory agency guidance is available, it is subject to change periodically.

Furthermore, the test is not static, and our Medical Groups and their relationships with Privia Physicians must be periodically reviewed to ensure that they continue to meet the definition and that the safeguards built into the various agreements are being implemented and administered as required.

5 unchanged sentences

Our business could be adversely affected by legal challenges to our Medical Groups’ ability to provide services via telehealth in certain jurisdictions.

The ability to conduct telehealth services in a particular state is directly dependent upon the applicable laws governing remote healthcare, the practice of medicine and healthcare delivery in general in such jurisdiction, which are subject to new laws and regulations, and changing interpretations of existing laws and regulations.

The ability to conduct telehealth services in a particular state is directly dependent upon the applicable laws governing remote healthcare, the practice of medicine and healthcare delivery in general in such jurisdiction, which may be subject to new laws and regulations, and changing interpretations of existing laws and regulations.

In the past, state medical boards have implemented new rules or interpreted existing rules in a manner that has limited or restricted the ability of our Medical Groups to provide telehealth services, such as laws that require a provider to be licensed and/or physically located in the same state where the patient is located.

Federal and state laws regarding such services, necessary technological standards to deliver such services, coverage restrictions associated with such services, and the amount of reimbursement for such services are subject to changing political, regulatory and other influences.

For example, of the jurisdictions in which we currently operate, Virginia, Texas, Florida and the District of Columbia are not members of the Interstate Medical Licensure Compact, which streamlines the process by which physicians licensed in one state are able to practice in other participating states.

Failure to comply with these laws could result in denials of reimbursement for our

Privia Providers’ services (to the extent such services are billed), recoupments of prior payments, professional discipline for our Privia Providers and/or civil or criminal penalties against our Medical Groups.

During the COVID-19 pandemic, many states enacted waivers and adopted other temporary measures that lifted certain restrictions on out-of-state providers and waived certain license requirements to allow greater access to telehealth services during the public health emergency period.

The CMS, the federal agency responsible for administering the Medicare program, also made several changes in the manner in which Medicare pays for telehealth visits, many of which relaxed previous requirements, including originating site requirements for both the providers and patients, telehealth modality requirements and others.

Many of these measures are effective only for the duration of the COVID-19 public health emergency, which is scheduled to end on May 11, 2023.

The Consolidated Appropriations Act of 2023 extended many of the COVID-19 public health emergency provisions related to telehealth until December 31, 2024.

It is unclear which, if any, of these changes related to telehealth will remain in place permanently and which will be rolled-back after December 31, 2024.

Similarly, any state law and enforcement changes that arose as part of the public health emergency declaration may cease or be rolled back after May 11, 2023.

Although we are still gauging the overall impact of such changes to our business, the expiration of the public health emergency will result in certain costs that have been borne by the government being passed on to patients and will reduce funding to state Medicaid agencies, which will result in less patients covered by Medicaid thereby increasing both the cost of collections and potential bad debt to health care providers.

For example, of the jurisdictions in which we currently operate, Virginia, Texas, Florida, North Carolina and the District of Columbia are not members of the Interstate Medical Licensure Compact, which streamlines the process by which physicians licensed in one state are able to practice in other participating states.

Failure to comply with these laws could result in denials of reimbursement for our Privia Providers’ services (to the extent such services are billed), recoupments of prior payments, professional discipline for our Privia Providers and/or civil or criminal penalties against our Medical Groups.

Although many of the telehealth waivers enacted as part of the public health emergency were extended by the Consolidated Appropriations Act of 2023 until December 31, 2024, in its 2024 physician fee schedule final rule, CMS made further changes to its policies regarding, and the reimbursement of, telehealth service by Medicare, including the expansion of reimbursement for certain behavioral telehealth services and an increase in reimbursement for certain telehealth related services.

Although we are still gauging the overall impact of such changes to our business, CMS appears to be committed to permanently increasing the utilization of telehealth services by Medicare beneficiaries.

The expiration of the public health emergency and state budget woes could result in certain costs that have been borne by the government being passed on to patients, which will result in less patients covered by federal

health care programs and thereby increasing both the cost of collections and potential bad debt to health care providers.

All of these changes could adversely affect our financial conditions and results of operations.

Our revenues and profits could be diminished if we fail to retain our Privia Physicians or fail to recruit new Privia Physicians to affiliate with our Medical Groups.

Our revenues and profits could be diminished if we fail to retain our health system partners or our Privia Physicians or if we fail to recruit new Privia Physicians to affiliate with our Medical Groups.

Our operating model relies significantly on aggregating a sufficient number of Privia Physicians in each of our Medical Groups.

3 unchanged sentences

Further, the loss of any Privia Physician may result in such Privia Physician’s patient population transferring to a non-Privia Provider, which could reduce our overall revenues and profits.

Moreover, we may not be able to attract new Privia Physicians to replace the services of departing Privia Physicians or to service our obligations under a government health care program, such as the MSSP or Medicare Advantage plans, or a VBC arrangement with a commercial payer.

Moreover, we may not be able to attract new Privia Physicians to replace the services of departing Privia Physicians or to service our obligations under third-party payer programs, such as the MSSP, Medicare Advantage plans, or VBC arrangements with a commercial payer.

We operate in certain markets in which the Non-Owned Medical Group is majority owned by one of our health system partners.

In the event our partnership or affiliation with the health system partner is terminated, we may not be able to identify an alternative partner or structure in a way to retain a sufficient number of Privia Physicians in the market.

Even if we are able to identify an alternative partner or structure, we may also be subject to contractual prohibitions that could delay or limit our ability to retain Privia Physicians in such alternative structure.

Our standard agreements between our Medical Groups and our Privia Physicians do not generally prohibit Privia Physicians from competing with us after the term of the agreements.

Further, in our deals with certain Medical Groups where we have post-termination non-compete obligations and other restrictive covenants that prohibit our Privia Providers from working with a competitor of ours, there can be no assurance that such non-compete agreements when asserted against a departing Privia Provider will be found enforceable if challenged in certain states.

Further, in our deals with certain Medical Groups where we have post-termination non-compete obligations and other restrictive covenants that prohibit our Privia Providers from working with a competitor of ours, there can be no assurance that such non-compete agreements, when asserted against a departing Privia Provider will be found enforceable if challenged.

This risk that the courts would not enforce non-compete restrictions that are beneficial to our operations is exacerbated by the FTC’s proposed rule that would ban noncompete clauses in employment contracts.

In such event, we could be unable to prevent such departing Privia Provider and other providers formerly affiliated with us from competing with us and/or our Medical Groups, potentially resulting in the loss of some of our patients, which could negatively affect our overall revenues and profits.

4 unchanged sentences

§ 1320a-7(f), and commercial payers, and our business could be adversely affected by legal challenges to our business model.

Our operating model includes Owned Medical Groups, Non-Owned Medical Groups, MSOs that furnish management services on behalf of our Medical Groups and ACOs, a technology-enabled platform that overlays our Privia Providers’ EMR, and, in most markets, a separate legal entity that serves as an ACO under the MSSP as established by the Patient Protection and Affordable Care Act and a provider network vehicle for VBC on behalf of our Medical Groups as well as, in certain markets, independent, non-Privia Providers.

Our ability to conduct business in each state is dependent upon that specific state’s treatment of each component of the Privia operating model under such state’s laws, regulations and policies governing the practice of medicine, physician fee splitting prohibitions, state restrictions on the use and disclosure of patient health information and other confidential information among the various components of our operating model, restrictions on the types of provider entities that can take financial risk or the types of

financial risks that can be assumed by providers before triggering the state’s insurance laws requiring licensure from the state’s insurance department or agency.

Our operating model includes Owned Medical Groups, Non-Owned Medical Groups, MSOs that furnish management services on behalf of our Medical Groups and ACOs, a technology-enabled platform that overlays our Privia Providers’ EMR, and, in most markets, a separate legal entity that serves as an ACO under the MSSP as established by the Patient Protection and Affordable Care Act and a provider network vehicle for VBC, such as an independent physician association, or IPA, on behalf of our Medical Groups as well as, in certain markets, independent, non-Privia Providers.

The laws of many states, including states in which we currently operate, prohibit us from exercising control over the medical judgments or decisions of our Privia Physicians and from engaging in certain financial arrangements, such as splitting professional fees with Privia Providers or incentivizing certain types of utilization.

1 unchanged sentence

We have relationships with Medical Groups in each of our markets which our Privia Providers join to furnish healthcare services as an integrated, single-TIN legal entity.

When permitted under state law, these are structured as Owned Medical Groups and we own a majority interest in all of our Owned Medical Groups but, even in such markets, we and our MSOs are still prohibited from controlling any aspect of the practice of medicine, including, without limitation, decisions regarding professional medical judgment, diagnosis and treatment of patients and supervisory responsibility for all licensed non-physician clinicians, unlicensed individuals to whom the physician delegates nondiscretionary duties and any other individual providing any service that could constitute the practice of medicine.

When permitted

under state law, these may be structured as Owned Medical Groups and we own a majority interest in all of our Owned Medical Groups but, even in such markets, we and our MSOs are still prohibited from controlling any aspect of the practice of medicine, including, without limitation, decisions regarding professional medical judgment, diagnosis and treatment of patients and supervisory responsibility for all licensed non-physician clinicians, unlicensed individuals to whom the physician delegates nondiscretionary duties and any other individual providing any service that could constitute the practice of medicine.

Our financial statements are consolidated in accordance with applicable accounting standards and include the accounts of our majority-owned subsidiaries.

Such consolidation for accounting and/or tax purposes does not, is not intended to, and should not be deemed to, imply or provide us any control over the medical or clinical affairs of such practices.

In other states, such as California, Texas and Tennessee, we are prohibited from having any ownership interest or governance control in our Medical Groups and these are structured as Non-Owned Medical Groups.

In other states, such as California, Texas, North Carolina and Tennessee, we are prohibited from having any ownership interest or governance control in our Medical Groups and these are structured as Non-Owned Medical Groups.

In such instances, (i) we generally appoint a Privia Physician licensed in the market to the governing board of such Non-Owned Medical Groups but we have little in the way of governance control of the Non-Owned Medical Groups other than through our MSAs;

or (ii) alternatively, in certain markets, we have begun to have certain licensed physicians with Privia leadership positions form professional entities to own the majority interest in Friendly Medical Groups.

If a jurisdiction’s prohibition on the corporate practice of medicine is interpreted in a manner that is inconsistent with our practices, we could be required to restructure or terminate our arrangements with our Non-Owned Medical Groups and Friendly Medical Groups and could result in additional penalties, damages and fines.

or (ii) alternatively, in certain markets, we have certain licensed physicians with Privia leadership positions form professional entities to own the majority interest in Friendly Medical Groups.

If a jurisdiction’s prohibition on the corporate practice of medicine is interpreted in a manner that is inconsistent with our structure or operations, we could be required to restructure or terminate our arrangements with our Non-Owned Medical Groups and Friendly Medical Groups and could result in additional penalties, damages and fines.

We enter into agreements with our Medical Groups in our various markets and through which our Privia Providers furnish healthcare services on behalf of our Medical Groups.

7 unchanged sentences

The transition from fee-for-service to value-based reimbursement models may have a material adverse effect on our operations.

Healthcare reform is causing some payers to transition from fee-for-service to value-based reimbursement models, which can include risk-sharing, bundled payment and other innovative approaches.

While these models may provide us and our Medical Groups with opportunities to provide new or additional services and to participate in incentive-based payment arrangements, there can be no assurance that such new models and approaches will be profitable to us or our Medical Groups.

The healthcare industry’s transition from fee-for-service to value-based reimbursement models, which can include risk-sharing, bundled payment and other innovative approaches provide us and our Medical Groups with opportunities to provide new or additional services and to participate in incentive-based payment arrangements.

There can be no assurance that such new models and approaches will be profitable to us or our Medical Groups, or that past performance under such VBC models will reflect future performance as the healthcare costs for these populations are not always under our control, depend upon the health acuity of such populations and subject to local practices and population demographics.

Further, new models and approaches may require investment by us to develop technology or expertise to offer necessary and appropriate solutions or support to our Medical Groups, and we do not fully know the amount and timing for return of such investment at this time.

In addition, some of these new models are being offered as pilot programs and there is no assurance that they will continue or be renewed.

Many states in which these new value-based structures are being developed also lack regulatory guidance or a well-developed body of law for these new models and approaches, or may not have updated their laws or enacted legislation yet to reflect the new healthcare reform models.

As a result, new and existing laws, regulations or guidance could have a material adverse effect on our operations and could subject us to the risk of restructuring or terminating our arrangements with our Medical Groups, as well as the risk of regulatory enforcement, penalties and sanctions, if state and federal enforcement agencies disagree with our interpretation of these laws.

3 unchanged sentences

However, the majority of states do not explicitly address the issue, and in such states, regulators may nonetheless interpret statutes and regulations to regulate such activity.

If downstream risk-

sharing arrangements are not regulated directly in a particular state, the state regulatory agency may nonetheless require oversight by the licensed payer as the party to such a downstream risk-sharing arrangement.

If downstream risk-sharing arrangements are not regulated directly in a particular state, the state regulatory agency may nonetheless require oversight by the licensed payer as the party to such a downstream risk-sharing arrangement.

Such oversight is accomplished via contract and may include the imposition of reserve requirements, as well as reporting obligations.

Further, state regulatory stances regarding downstream risk-sharing arrangements can change rapidly and codified provisions may not keep pace with evolving risk-sharing mechanisms and other new value-based reimbursement models.

Certain of the states where we currently operate or may choose to operate in the future regulate the operations and financial condition of risk bearing entities.

These regulations can include capital requirements, licensing or certification, governance controls and other similar matters.

While these regulations have not had a material impact on our business to date, as we continue to expand, these rules may require additional resources and capitalization and add complexity to its business.

The ACA also required CMS to establish a Medicare shared savings program that promotes accountability and coordination of care through the creation of Accountable Care Organizations, or ACOs.

The Medicare shared savings program allows for providers, physicians and other designated health care professionals and suppliers to form ACOs and voluntarily work together to invest in infrastructure and redesign delivery processes to give coordinated high quality care to their Medicare patients, avoid unnecessary duplication of services and prevent medical errors.

Certain of the states where we currently operate, or may choose to operate in the future, and the Medicare Advantage program, regulate the operations and financial condition of risk bearing entities.

These regulations can include capital requirements, stop loss insurance, licensing or certification, governance controls and other similar matters.

While these regulations have not had a material impact on our business to date, as we continue to expand, these rules may require additional resources and capitalization, and add complexity to our operations.

The ACA also required CMS to establish the MSSP that promotes accountability and coordination of care through the creation of Accountable Care Organizations, or ACOs.

The MSSP allows for providers, physicians and other designated health care professionals and suppliers to form, and/or participate in, ACOs and voluntarily work together to invest in infrastructure and redesign delivery processes to give coordinated high quality care to their Medicare patients, avoid unnecessary duplication of services and prevent medical errors.

ACOs that achieve quality performance standards established by CMS are eligible to share in a portion of the Medicare program’s cost savings.

Our ACOs include physicians and advanced practitioners in Florida, Georgia, Maryland, Tennessee, Texas, Virginia and Washington, DC in 2022.

Our ACOs included physicians and advanced practitioners in California, Connecticut, Delaware, Florida, Georgia, Maryland, Montana, North Carolina, Tennessee, Texas, Virginia, and Washington, DC in 2023.

These ACOs participate in the MSSP, and are subject to ACO program methodologies and participation requirements that are updated by CMS for each performance year.

We and our Medical Groups as ACO participants are expected to comply with such program requirements and are required to report to CMS on performance after the close of the year.

We and our Medical Groups as ACO participants are expected to comply with such program requirements and are required to report to CMS on performance after the close of each year.

Failure to comply with such program requirements could subject us and our Medical Groups to significant penalties and, in some cases, termination from participating in MSSP.

Additionally, the Center for Medicare and Medicaid Innovation continues to test an array of value-based alternative payment models, including the recent replacement of the Global and Professional Direct Contracting, or GPDC, Model with the ACO Reach program as of January 1, 2023, through which providers can negotiate directly with the government to manage traditional Medicare beneficiaries and share in the savings and risks generated from managing such beneficiaries.

Additionally, the Center for Medicare and Medicaid Innovation (or more recently the CMS Innovation Center) continues to test an array of value-based alternative payment models, including the recent replacement of the Global and Professional Direct Contracting, or GPDC, Model with the ACO Reach program as of January 1, 2023, through which providers can negotiate directly with the government to manage traditional Medicare beneficiaries and share in the savings and risks generated from managing such beneficiaries.

Although we currently do not participate in all of these payment models, we may choose to do so in the future.

4 unchanged sentences

That is, from federal and state antitrust law perspectives, each Medical Group is structured to be a single entity, with a single-TIN, fully capable of establishing the prices for which it sells its products and services.

Our new Privia Care Partners model, which is less integrated than our historical Medical Groups, creates additional legal concerns especially under state and federal antitrust laws.

We have structured these arrangements, often with the knowledge and support of payers, to either have significant clinical integration or share significant financial risk so as to allow for single signature contracting authority with payers.

Similarly, our operational ACOs, which all participate in the MSSP, have been structured so that all participants in the ACO, including our Medical Groups, are substantially clinically integrated in accordance with guidance from the Federal Trade Commission to allow our ACOs to negotiate payer contracts, including pricing terms, on behalf of our participating providers, including our Medical Groups.

We have not, however, requested a formal advisory opinion from the Federal Trade Commission or a business review from the Department of Justice Antitrust Division for either our Medical Groups or our ACO model.

With respect to our ACOs, such entities typically participate in both the MSSP and commercial VBC arrangements.

Given our MSSP participation, under the FTC and DOJ’s Statement of Antitrust Enforcement Policy Regarding Accountable Care Organizations Participating in the Medicare Shared Savings Program (the “Policy Statement”), our ACOs would be subject to a rule of reason analysis.

Although we have not conducted a full calculation of our ACOs’ share of primary specialty services in each ACO participant’s Primary Service Area (“PSA”), our preliminary analysis is that each of our ACOs would fall outside of the Policy Statement’s safety zone (i.e., no more than 30% share of services in each PSA) and therefore, the FTC or DOJ could challenge our ACO as anticompetitive.

We have, however, adopted policies and practices to ensure our compliance with the antitrust laws including limiting the anti-competitive effect of our higher share of physician services within our geographic markets.

Our Privia Care Partners model, which offers a more flexible provider affiliation model than our historical Medical Groups, creates additional legal concerns especially under state and federal antitrust laws.

We believe we have structured these arrangements, often with the knowledge and support of payers, to either have significant clinical integration or share significant financial risk so as to allow for single signature contracting authority with payers.

Similarly, our operational ACOs, which all participate in the MSSP, have been structured in a manner that we believe that all participants in the ACO, including our Medical Groups, are substantially clinically integrated in accordance with the then current guidance from the Federal Trade Commission to allow our ACOs to negotiate payer contracts, including pricing terms, on behalf of our participating providers, including our Medical Groups.

Our ACOs and other network intermediaries, such entities typically participate in both the MSSP and commercial VBC arrangements.

The Biden Administration appears committed to increasing antitrust enforcement and the scope of current antitrust laws as evidenced by Executive Order 14036 “Promoting Competition in the American Economy,” which, among other things, expresses concern about excessive market concentration in health care markets, including the insurance, hospital and prescription drug markets.

Agency action to implement the Executive Order could limit, or increase the cost associated with, our growth plans, including limiting our ability to acquire competitors and grow at rates similar to our historic growth rates.

Further, on February 3, 2023, the Department of Justice announced that it was withdrawing from its joint statements with the FTC, including the Policy Statement, and will determine the

anticompetitive nature of such relationships on a case by case basis.

It is anticipated that the FTC will take a similar position in the coming weeks.

Although the effect of such withdrawal on enforcement priorities and standards is unclear at this time, we do expect more antitrust scrutiny of health care industry generally and targeted scrutiny of companies such as ours that aggregate providers.

Given the current state of health care industry antitrust enforcement and the FTC and DOJ’s withdrawal of past joint policy statements, including the FTC and DOJ’s Statement of Antitrust Enforcement Policy Regarding Accountable Care Organizations.

Participating in the Medicare Shared Savings Program, the FTC or DOJ could challenge our ACO or other network activities as anticompetitive.

We have, however, adopted policies and practices intended to comply with the antitrust laws, including limiting the anti-competitive effect of our higher share of physician services within certain geographic markets.

A successful challenge of any of these components of our operating model could result in our restructuring our relationships with our Medical Groups and ACOs, and where such relationships cannot be successfully restructured could result in our inability to furnish services in certain markets.

Further, depending on the enforcement agency an antitrust violation can result in enforcement actions against us, our Medical Groups and/or ACOs ranging from a cease and desist demand, to criminal enforcement with the potential for treble damages.

Any such outcome could damage our reputation, jeopardize our existing business arrangements, and could have a material adverse effect on our business, financial condition and the results of operations.

Even a successful defense of an antitrust claim can be very expensive, may distract key management, and can damage our reputation and impair our ability to recruit new physicians.

We are dependent on our EMR vendor, athenahealth, Inc., which the Privia Technology Solution is integrated and built upon, and which we require all of our Owned Medical Groups to utilize and which is utilized by most of the Non-Owned Medical Groups, and our business could be adversely affected if that relationship were disrupted.

Although we own all aspects of our athenaNet services, the Privia Technology Solution is not currently usable with other EMRs, and to move our Privia Providers to another EMR provider we would have to duplicate our services on that platform, which could require considerable effort, time and expense.

Even a successful defense of an antitrust claim can be very expensive, may distract key management and impair our ability to recruit new physicians.

Any such action or outcome could damage our reputation, jeopardize our existing business arrangements, and could have a material adverse effect on our business, financial condition and the results of operations.

We are dependent on our EMR vendor, athenahealth, Inc., which the Privia Technology Solution is integrated and built upon, and which is utilized by most of our Owned and Non-Owned Medical Groups, and our business could be adversely affected if that relationship were disrupted.

The Privia Technology Solution is not currently usable with other EMRs, and to move our Privia Providers to another EMR provider we would have to duplicate our services on that platform, which could require considerable effort, time and expense.

While we have a positive working relationship with athenahealth, Inc., and while being one of their larger enterprise clients gives us priority access in resolving issues with the EMR and preferred pricing relative to going market rates, there is no assurance we will be able to maintain the relationship on positive terms.

In addition, our dependency on athenahealth, Inc.

creates significant risks related to service disruptions, potential cyberattacks experienced by athenaNet, cessation of operations of athenahealth, Inc., or price leveraging by athenahealth, Inc.

creates significant risks related to service disruptions, potential cybersecurity incidents experienced by athenahealth, cessation of operations of athenahealth, Inc., or price leveraging by athenahealth, Inc.

A material change in our relationship with athenahealth, Inc., whether resulting from a dispute, a change in government regulation, or the loss of this relationship, could impair our ability to provide the same level of services to our Privia Providers for some period of time and could have a material adverse effect our business, financial condition and results of operations.

We have a history of net losses, we anticipate increasing expenses in the future, and we may not be able to maintain profitability.

We reported net (loss) income of $(8.6) million, $(188.2) million, and $31.2 million for the years ended December 31, 2022, 2021 and 2020, respectively.

We reported net income (loss) of $23.1 million, $(8.6) million, and $(188.2) million for the years ended December 31, 2023, 2022 and 2021, respectively.

Our accumulated deficit is $(193.6) million and $(216.7) million as of December 31, 2023 and 2022, respectively.

11 unchanged sentences

Our failure to achieve or maintain profitability could negatively impact the value of our common stock.

Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our patients, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, operations and our reputation.

In the ordinary course of our business, we collect, store, use and disclose sensitive data, including PHI and other types of personal data or personal information, relating to our employees, our Privia Providers’ patients and others.

We and certain of our third-party vendors have experienced cyberattacks in the past and could experience security breaches, loss of data and other disruptions in the future which could compromise sensitive information related to our business or our patients, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, operations and our reputation.

In the ordinary course of our business, we collect, store, use and disclose sensitive information, which includes PHI, personal information, payment information, financial information, and other data that is subject to laws and regulations, including without limitation HIPAA, Payment Card Industry Data Security State (PCI DSS), and Sarbanes-Oxley Act (SOX), and other types of personal information, relating to our employees, our Privia Providers’ patients and others.

We also process and store, and use third-party service providers to process and store, sensitive information, including intellectual property, trade secrets, confidential information and other proprietary business information.

We manage and maintain such sensitive data and information utilizing a combination of managed data center systems and cloud-based computing center systems.

We manage and maintain such sensitive data and information utilizing a combination of third-party managed data centers, public cloud-based computing systems, and software-as-a-service (SaaS) providers.

We are highly dependent on information technology networks and systems, including the internet, to securely process, transmit and store this sensitive data and information.

Our information technology systems and those of our third-party service providers, strategic partners and other contractors or consultants are vulnerable to attack and damage or interruption from physical or electronic break-ins, computer viruses, and malware (e.g., ransomware), malicious code, natural disasters, terrorism, war, telecommunication, attacks by hackers, and employee or contractor error, negligence or malfeasance, denial or degradation of service attacks, sophisticated nation-state and nation-state-supported actors or unauthorized access or use by persons inside our organization, or persons with access to systems inside our organization.

Our information technology systems and those of our third-parties, strategic partners and other contractors or consultants are vulnerable to attack and damage or interruption from physical or electronic break-ins, computer viruses, and malware (e.g., ransomware), malicious code, natural disasters, terrorism, war, telecommunication, attacks by hackers, and employee or contractor error, negligence or malfeasance, denial or degradation of service attacks, sophisticated nation-state and nation-state-supported actors or unauthorized access or use by persons inside or outside our organization.

We utilize third-party service providers for important aspects of the collection, storage, processing and transmission of employee and patient information, and other confidential and sensitive information, and therefore rely on third parties to manage functions that have material cybersecurity risks.

Because of the sensitivity of the PHI, other personal information and other sensitive information we, our Medical Groups and their legacy practices collect, store, transmit, and otherwise process, the security of our technology-enabled platform and other aspects of our services, including those provided or facilitated by our third-party service providers, are critical to our operations and business strategy.

We take certain administrative, physical and technological safeguards to address these risks, such as evaluating such service providers before granting access to PHI or other personal information, and by requiring contractors and other third-party service providers who handle this PHI, other personal information and other sensitive information for us to enter into agreements that contractually obligate them to use reasonable efforts to safeguard such PHI, other personal information, and other sensitive information.

Measures taken to protect our systems, those of our contractors or third-party service providers, or the PHI, other personal information, or other sensitive information we or contractors or third-party service providers process or maintain, may not adequately protect us from the risks associated with the collection, storage, processing and transmission of such sensitive data and information.

Because of the sensitivity of the PHI, other personal and/or sensitive information we, our Medical Groups and their legacy practices collect, store, transmit, and otherwise process, the security of our technology-enabled platform and other aspects of our services, including those provided or facilitated by third-party service providers, are critical to our operations and business strategy.

providers who handle this PHI, other personal and/or sensitive information for us to enter into agreements that contractually obligate them to use reasonable efforts to safeguard such PHI, other personal and/or sensitive information.

Measures taken to protect our systems, those of our contractors or third-party service providers, or the PHI, other personal and/or sensitive information we or contractors or third-party service providers process or maintain, may not adequately protect us from the risks associated with the collection, storage, processing and transmission of such information.

We may be required to expend significant capital and other resources to protect against security breaches or to alleviate problems caused by security breaches.

Despite our implementation of security measures, cyber-attacks are becoming more sophisticated and frequent.

We experience cyber-attacks and other security incidents of varying degrees from time to time, though none which individually or in the aggregate has led to costs or consequences which have materially impacted our operations or business.

On October 28, 2020, the Department of Health and Human Services (“HHS”) and the Federal Bureau of Investigation alerted health care providers that ransomware activity is currently targeting the healthcare and public health sectors.

Despite our implementation of security measures, cyberattacks are becoming more sophisticated and frequent across industries.

We experience cyberattacks and other security incidents of varying degrees from time to time, though none which individually or in the aggregate has led to costs or consequences which have materially impacted our operations or business.

It is reasonable to expect that ransomware activity will continue to target the healthcare and public health sectors, as it has in the past.

Ransomware attacks, including those from organized criminal threat actors, nation-states, and nation-state supported actors, are becoming increasingly prevalent and severe, and can lead to significant interruptions in our operations, loss of data and income, reputational loss, diversion of funds, and may result in fines, litigation and unwanted media attention.

Given the current situation in Ukraine, more state-sponsored attacks on infrastructure directed towards United States infrastructure and targets, including health care organizations, may increase.

Further, widely spread vulnerabilities, such as the Apache Log4j 2 vulnerability reported in December 2021, could affect our or our vendors’ systems.

Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting payments.

Because of ongoing geopolitical dynamics around the world, more state-sponsored attacks on infrastructure directed towards United States infrastructure and targets, including health care organizations, may increase.

The significant increase in the number of 0-day vulnerabilities identified and exploited by threat actors prior to security patches being available could affect our or our vendors’ systems.

Moreover, hardware, software or applications we use may have inherent vulnerabilities or defects of design, manufacture or operations or could be inadvertently or intentionally implemented or used in a manner that could compromise information security.

1 unchanged sentence

Further, consumer confidence in the integrity and security of personal information and critical operations data in the health care industry generally could be shaken to the extent there are successful cyberattacks at other health care services companies, which could have a material adverse effect on our business, financial position or results of operations.

We or our third-party service providers may be unable to anticipate these techniques or to implement adequate protective measures, especially as more workforce members and our vendors’ workforce continue to work remotely because of the COVID-19 pandemic.

We or our third-party service providers may be unable to anticipate these techniques or to implement adequate protective measures, especially as workforce members and vendors’ workforce continue to work remotely.

We may also experience security breaches that may remain undetected for an extended period.

Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence.

Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers use of tools and techniques designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence.

A security breach or privacy violation that leads to disclosure or unauthorized use or modification of, or that prevents access to or otherwise impacts the confidentiality, security, or integrity of, any personal information, patient information, including PHI subject to HIPAA or any other sensitive information we or our contractors or third-party service providers maintain or otherwise process, could harm our reputation, compel us to comply with breach notification laws, cause us to incur significant costs for remediation, fines, penalties, notification to individuals and for measures intended to repair or replace systems or technology and to prevent future occurrences, potential increases in insurance premiums, and require us to verify the accuracy of database contents, resulting in increased costs or loss of revenue.

1 unchanged sentence

In addition, security breaches and other inappropriate access to, or acquisition or processing of, information can be difficult to detect, and any delay in identifying such incidents or in providing any notification of such incidents may lead to increased organizational harm.

Our service providers from time to time are subject to cyberattacks and security incidents.

While we do not believe that we have experienced any significant system failure, accident or security breach to date, if such an event were to occur, it could compromise our

networks or data security processes and sensitive information could be made inaccessible or could be accessed by unauthorized parties, publicly disclosed, lost or stolen.

Our service providers from time to time have experienced in the past and may experience in the future cyberattacks and security incidents.

While we do not believe that we have experienced any significant system failure, accident or security breach to date, if such an event were to occur, it could compromise our networks or data security processes and sensitive information could be made inaccessible or could be accessed by unauthorized parties, publicly disclosed, lost or stolen.

Any such interruption in access, improper access, disclosure or other loss of information could result in legal claims or proceedings, liability under laws and regulations that protect the privacy of patient information or other personal information, such as HIPAA, and regulatory penalties.

4 unchanged sentences

Any such breach or interruption of our systems or those of any of our third-party service providers could have a material adverse effect on our business, results of operations, financial condition and cash flows.

Cybersecurity risks and incidents remain a focus for regulators.

The SEC finalized its cybersecurity rules, which went into effect on December 15, 2023 and require publicly listed companies to disclose particular information about material cybersecurity incidents in Form 8-K filings, including the material impact of the incident on a company’s financial condition and its operations.

Such disclosures are costly, require us and our third parties to update internal policies and procedures, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

In the event that the Company (or a third-party upon whom we rely) suffers a cybersecurity breach, or are perceived to have experienced a cybersecurity breach, we may experience adverse consequences, such as government enforcement actions, litigation, indemnification obligations, reputational harm, interruptions in our operations, financial loss;

and other similar harms.

Such mandatory disclosure of cybersecurity incidents may cause existing customers to stop using our services, deter new customers from using our services, and could adversely affect our business, reputation and competitive position.

Cybersecurity will continue to be a focus for the SEC and it is likely to seek opportunities to implement its authority under the cybersecurity rules in ways that may not be predictable given the recency of the rules and novel actions in this space.

Achieving success in VBC arrangements requires sharing sensitive personal information and PHI with multiple third-parties, covered entities, and different health care providers to allow care coordination and to reduce the total cost of care and improve patient outcomes.

Increased data sharing increases cybersecurity risk.

This dependency on digital technologies and the extensive data exchange inherent in VBC arrangements heighten our exposure to cybersecurity risks.

The nature of our VBC operations necessitates the handling of large volumes of sensitive personal and health information.

The healthcare industry, by virtue of its focus on VBC models, faces unique challenges that arise from the need to manage rising healthcare costs and improve outcomes through data-driven strategies.

In light of our strategy to transition more of our FFS revenue to VBC operations, the risk of cybersecurity breaches increases because of the number of covered entities, health care providers, and third parties that require data sharing to achieve successful outcomes in VBC arrangements.

A breach of any one of those parties could lead to unauthorized access, misuse, loss, or destruction of sensitive data, potentially impacting patient care, trust, and satisfaction.

It could also have legal, financial, and reputational consequences adversely affecting our financial condition and operating results.

The costs of complying with, or our failure to comply with, U.S.

and foreign laws related to privacy, data security and data protection could adversely affect our financial condition, operating results and reputation.

Due to the nature of our business, we are or may become subject to a variety of laws and regulations regarding privacy, data protection and data security.

For discussion of the various laws and regulations affecting our business, see “Item 1 – Business – Government Regulations” in Item 1 of this Annual Report on Form 10-K.

The scope and interpretation of these laws and additional laws that are or may be applicable to us are continuously evolving, often uncertain and may be conflicting.

All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time and may restrict the way services involving data are offered, all of which may adversely affect our results of operations and competitiveness.

Complying with these and similar laws and regulations may require us to make significant changes to our operations, which rely on the commitment of significant financial and managerial resources and effective planning and management processes.

We may be unable to implement required operational changes effectively, efficiently or in a timely manner, which could result in cost overruns, additional expenses, reputational harm, legal and regulatory actions and other adverse consequences.

Unauthorized disclosure or transfer of personal or otherwise sensitive data, whether through systems failure, employee negligence, fraud, misappropriation or other means, by us, our third-party vendors with whom we do business could subject us to significant litigation, monetary damages, regulatory enforcement actions, fines, criminal prosecution and other adverse consequences in one or more jurisdictions.

Such events could result in negative publicity and damage to our reputation, which could have a material adverse effect on our results of operations.

The healthcare industry is highly competitive.

5 unchanged sentences

We compete with different companies across certain lines of business, including companies with:

dedicated brick-and-mortar locations which often target patients covered by Medicare Advantage plans (such as Oak Street Health), dedicated direct primary care locations which often target a commercial or employer-based patient population (such as One Medical), the ability to organize providers into accountable care organizations, allowing physicians to participate in VBC arrangements (such as Aledade) and the ability to partner with physicians groups to enable better care delivery primarily for seniors (such as Agilon Health or VillageMD).

Our indirect competitors also include episodic point solutions, such as telemedicine offerings, as well as urgent care providers.

dedicated brick-and-mortar locations which often target patients covered by Medicare Advantage plans, dedicated direct primary care locations which often target a commercial or employer-based patient population, the ability to organize providers into accountable care organizations and other contractual intermediary entities allowing physicians to participate in VBC arrangements, and the ability to partner with physicians groups to enable better care delivery primarily for seniors.

Our indirect competitors also include episodic point solutions, such as telemedicine offerings, as well as urgent care providers and other providers.

We expect to face increasing competition, both from current competitors, who may be well established and enjoy greater resources or other strategic advantages to compete for some or all key stakeholders in our markets, as well as new entrants into our market.

Our ability to compete successfully varies from location to location and depends on a number of factors, including the number of competing medical practices in the local market and the types of services available at those facilities, our local reputation for quality care of patients, the commitment and expertise of our Privia Physicians, our ability to obtain competitive reimbursement rates with commercial payers, our local service offerings and the success of physician sales efforts, the cost of care in each locality, and the physical appearance, location, age and condition of the various locations at which our Privia Physicians furnish patient care services.

care of patients, the commitment and expertise of our Privia Physicians, our ability to obtain competitive reimbursement rates with commercial payers, our local service offerings and the success of physician sales efforts, the cost of care in each locality, and the physical appearance, location, age and condition of the various locations at which our Privia Physicians furnish patient care services.

If we are unable to attract patients to our Medical Groups, our revenue and profitability will be adversely affected.

Some of our competitors may have greater recognition and be more established in their respective communities than we are, and may have greater financial and other resources than we have.

Competing medical practices may also offer larger facilities or different programs or services than we do, which, combined with the foregoing factors, may result in our competitors being more attractive to our current patients, potential patients and referral sources.

Competing medical practices may also offer larger facilities or different programs or services than we do including through complementary services, which, combined with the foregoing factors, may result in our competitors being more attractive to our current patients, potential patients and referral sources.

Furthermore, while we budget for routine capital expenditures to stay competitive in our respective markets, to the extent that competitive forces cause those expenditures to increase in the future, our financial condition may be negatively affected.

2 unchanged sentences

Our Privia Providers, Non-Owned Medical Groups and companies in other healthcare industry segments, including those with which we have contracts, and some of which have greater financial, marketing and staffing resources, may become competitors in providing healthcare services, and this competition may have a material adverse effect on our business operations and financial position.

Each of our revenue streams ultimately depends on reimbursements by third-party payers, as well as payments by individuals, which could lead to delays and uncertainties in the reimbursement process.

Each of our revenue streams ultimately depends on reimbursements by third-party payers, as well as payments by individuals, which could lead to delays and uncertainties in the reimbursement process, and periodic changes to our reimbursement rates.

The reimbursement process is complex and can involve lengthy delays.

Although we recognize FFS revenue for our Owned Medical Groups when their associated Privia Providers approve the claims for providing services to patients, we may from time to time experience delays in receiving the associated reimbursement and, with respect to VBC arrangements, ultimate payment of any shared savings, bonuses, withholds and similar payments is received only after the close of the relevant measure period, which may be a calendar year, and then only after the payer has reconciled cost of care, FFS reimbursement paid, if any, reported quality data, and patient attribution resulting in significant delays between the provision of services and ultimate payment.

In addition, third-party payers may disallow, in whole or in part, requests for reimbursement based on determinations that the patient is not eligible for coverage, certain amounts are not reimbursable under plan coverage or were for services provided that were not medically necessary,

not adequately documented or after submitting additional supporting documentation requested by the payer.

Retroactive adjustments may change amounts realized and recognized as revenue from third-party payers.

10 unchanged sentences

Although we can mitigate some of this risk on a case-by case basis with stop loss coverage, we generally have little ability to increase our charges during the terms of our VBC arrangements and we may have minimal ability to control our Medical Groups’ patients’ decisions that may increase the total cost of care.

The impact on us of recent healthcare legislation and other changes in the healthcare industry and in healthcare spending is currently unknown, but may adversely affect our business, financial condition and results of operations.

The impact on us of healthcare reform legislation and other changes in the healthcare industry and in healthcare spending is currently unknown, but may adversely affect our business, financial condition and results of operations.

If we are unable to effectively adapt to changes in the healthcare industry, including changes to laws and regulations regarding or affecting the U.S.

healthcare industry, our business, financial condition and results of operations may be adversely affected.

The impact on us of any new healthcare legislation and other changes in the healthcare industry and in healthcare spending is currently unknown, but may adversely affect our business, financial condition and results of operations.

Our revenue is dependent on the healthcare industry and could be affected by changes in healthcare spending, reimbursement and policy.

The healthcare industry is subject to changing political, regulatory and other influences.

By way of example, the ACA, which was enacted in 2010, made major changes in how healthcare is delivered and reimbursed, and it increased access to health insurance benefits to the uninsured and underinsured populations of the United States.

The healthcare industry is subject to ongoing changing political, regulatory and other influences.

By way of example, the ACA, which was enacted in 2010, made major changes in how healthcare is delivered and reimbursed, and it increased access to health insurance benefits to the

uninsured and underinsured populations of the United States.

We embrace many of the goals of the ACA, including our current ACOs actively participating in the MSSP, which have resulted in shared savings under the MSSP in excess of $510 million since we started participating in the program in 2014.

Since its enactment, there have been judicial, executive and Congressional challenges to certain aspects of the ACA.

On June 17, 2021, the U.S.

Supreme Court dismissed the most recent judicial challenge to the ACA brought by several states without specifically ruling on the constitutionality of the ACA.

Prior to the Supreme Court’s decision, President Biden issued an executive order initiating a special enrollment period from February 15, 2021 through August 15, 2021 for purposes of obtaining health insurance coverage through the ACA marketplace.

The executive order also instructed certain governmental agencies to review and reconsider their existing policies and rules that limit access to healthcare.

A number of legislative changes have been proposed and adopted since the ACA was enacted, including automatic, aggregate reductions to Medicare payments to providers.

Although advocacy groups were successful in limiting the impact of these reductions in 2021 from 8.5% physician reimbursement reduction to a 2.5% physician reimbursement reduction, Congress continues to cut reimbursement annually and has thus far been unwilling to make any long-term legislative changes to how it reimburses for physician services.

Congress, however, has passed legislation to increase the number of enrollees in exchange market plans.

For example, the American Rescue Plan Act of 2021, signed into law March 11, 2021, included a number of provisions intended to shore up the ACA, including lower premiums for insurance purchased through the exchange marketplace, premium tax credits for insurance purchased by individuals on the exchange marketplace and providing significant subsidies for states that have not yet expanded their Medicaid programs under the ACA.

This trend continued into 2022 with CMS adopting a final rule that went into effect January 1, 2023, which among other things, accelerates Medicare coverage for new enrollees and allows for special enrollment period in certain circumstances to reduce any gaps in Medicare coverage/ These changes as well as other administrative changes such as extending enrollment periods and increasing navigator funding may ultimately decrease our Medical Groups’ uninsured patient populations but at the same time, such changes may move patient populations from higher reimbursed commercial insurance to lower reimbursed exchange marketplace coverage.

Although it is too early to determine the likely cumulative effect of these changes, such changes could negatively impact both our revenue and the revenue of our Medical Groups.

Since its enactment, there have been judicial, executive, Congressional and political challenges to certain aspects of the ACA and there are indications that such challenges may continue.

Although the Biden administration has undertaken a number of initiatives in support of the ACA, including expanding enrollment, the current political climate ensures that the ACA will continue to be a political focal point and, as such, volatility could negatively impact our financial performance as well as the financial performance of our Medical Groups.

Our operating model, the Privia Technology Solution and our revenue are dependent on the healthcare industry’s continued movement towards providers assuming more risk from payers for the cost of patient care.

Any legislative, regulatory or industry changes that

slows or limits that movement or otherwise reduces the non-facility-based healthcare spending could most likely be detrimental to our business, revenue, financial projections and growth.

Any legislative, regulatory or industry changes that slows or limits that movement or otherwise reduces the non-facility-based healthcare spending could most likely be detrimental to our business, revenue, financial projections and growth.

VBC arrangements typically require providers to achieve certain quality indicators either as a gating prerequisite to realizing value-based revenue enhancements or as a positive or negative multiplier related to such payments, including, for example, the MSSP.

5 unchanged sentences

The Advanced APM track makes incentive payments available for participation in specific innovative payment models approved by CMS.

Providers may earn a 5% Medicare incentive payment through 2024 and will be exempt from the reporting requirements and payment adjustments imposed under MIPS if the provider has sufficient participation (based on percentage of payments or patients) in an Advanced APM.

Alternatively, providers may participate in the MIPS track.

Currently, providers electing this option may receive payment incentives or be subject to payment reductions based on their performance with respect to clinical quality, resource use, clinical improvement activities specified by CMS, and meeting the “Promoting Interoperability” standards related to the meaningful use of EHRs.

Performance data collected in 2022 may result in upward or downward payment adjustments of up to 9% in 2024.

CMS makes available an exception that permits clinicians to request reweighing of any or all performance categories if they encounter an extreme and uncontrollable circumstance or public health emergency, such as COVID-19, that is outside of their control.

As in 2020 and 2021, CMS continues to allow certain flexibility in its QPP for 2022 reporting under its extreme and uncontrollable circumstances policies, including, among other things, applying for a reweighting of MIPS performance categories due to the COVID-19 public health emergency and to allow individuals and groups that meet the activity criteria to receive credit for the COVID-19 clinical data reporting with or without clinical trial improvement activity through the MIPS 2022 performance period.

Providers may earn up to 3.5% Medicare incentive payment through 2025.

The Medicare Physician Fee Schedule final rule for calendar year 2004 included a number of changes impacting physicians such as retention of the 75% MIPS performance threshold, changes in reporting for Alternative Payment Models (APMs) and ACOs, and expansion of MIPS Value Pathways (MVPs).

Payments from such federal health care programs are subject to periodic statutory changes, annual regulatory changes, administrative rulings, interpretations and determinations, requirements for utilization review and federal and state funding restrictions, each of which could increase or decrease program payments, as well as affect the cost of providing service to patients and the timing of payments to our Medical Groups, and our ACOs.

We are unable to predict the effect of recent and future policy changes on our operations.

In addition, the uncertainty and fiscal pressures placed upon federal health care programs as a result of, among other things, deterioration in general economic conditions, reduced tax revenue and the funding requirements from the federal healthcare reform legislation, may affect the availability of taxpayer funds for such federal health care program.

In addition, the uncertainty and fiscal pressures placed upon federal health care programs as a result of, among other things, deterioration in general economic conditions, reduced tax revenue and the funding requirements, may affect the availability of taxpayer funds for such federal health care programs.

Current and prior healthcare reform proposals have included the concept of creating a single payer or public option for health insurance.

2 unchanged sentences

Changes in federal health care programs may reduce the reimbursement we receive and could adversely impact our business and results of operations.

As federal healthcare expenditures continue to increase, and state governments continue to face budgetary shortfalls, federal and state governments have made, and continue to make, significant changes in the Medicare and Medicaid programs.

These changes include reductions in reimbursement levels and new or modified demonstration projects authorized pursuant to Medicaid waivers.

As healthcare costs continue to increase, and federal and state governments continue to face budgetary shortfalls, federal and state governments have made, and may continue to make, significant changes in the Medicare and Medicaid programs.

These changes could include reductions in reimbursement levels and new or modified demonstration projects authorized pursuant to Medicaid waivers.

Some of these changes have decreased, or could decrease, the amount of money our Medical Groups receive for furnishing patient care services relating to these programs.

2 unchanged sentences

We expect that additional state and federal healthcare reform measures will be adopted in the future, any of which could limit the amounts that federal and state governments and commercial payers will pay for healthcare services, which could harm our business, financial condition and results of operations.

If reimbursement rates paid by commercial payers are reduced or if commercial payers otherwise restrain our ability to provide services to their enrollees through narrow network products or otherwise, our business could be harmed.

If reimbursement rates paid by third-party payers are reduced or if commercial payers otherwise restrain our ability to provide services to their enrollees through narrow network products or otherwise, our business could be harmed.

Our typical agreements with commercial payers only secure agreed reimbursement rates for a relatively short period of time, generally for a period of one to three years.

2 unchanged sentences

If such events were to occur, not only is revenue to our Medical Groups reduced, which in turn reduces our management fees, but if our commercial payer contracts are not competitive in a given market or we are unable to obtain a contract with certain commercial payers, we limit our ability to recruit new Privia Physicians and may not be able to achieve our growth expectations.

Additionally, as our payers’ businesses respond to market dynamics and financial pressures, and as our payers make strategic business decisions in respect of the lines of business they pursue and programs in which they participate, certain of our payers have sought in the future payers may, seek to renegotiate their contracts with us.

These negotiations could result in reductions to the economic terms, changes to the scope of services contemplated by our

existing payer contracts, or termination of certain payer contracts.

If a payer does terminate or elects not to renew its relationship with us, our ability to retain patients associated with that payer is limited and consequently could have a material adverse effect on our business, results of operations, financial condition and cash flows.

Commercial payers often use plan structures, such as narrow networks or tiered networks, to encourage or require members to use in-network providers.

In-network providers typically provide services through commercial payers for a negotiated lower rate or other less

favorable terms and achieve their margins by increased volume of services.

In-network providers typically provide services through commercial payers for a negotiated lower rate or other less favorable terms and achieve their margins by increased volume of services.

Commercial payers generally attempt to limit the use of out-of-network providers by requiring members to pay higher copayment and/or deductible amounts for out-of-network care.

3 unchanged sentences

In December 2020, in connection with the enactment of the Consolidated Appropriations Act of 2021, the No Surprises Act introduced national limitations on billing for certain services furnished by providers who are not in-network with the patient’s self-insured health plan, individual or group health plan.

On July 1, 2021, the Departments of Health and Human Services, Labor and Treasury issued an interim final rule implementing certain provisions of the No Surprises Act.

On September 30, 2021, a second interim final rule was issued, subject to a public comment period, which closed on October 18, 2021.

On November 17, 2021 a third interim final rule was issued, subject to a public comment period, which closed on January 24, 2022.

The provisions of these rules, most of which went into effect on January 1, 2022, seek to limit excessive patient out-of-pocket amounts by limiting cost sharing for out-of-network services to in-network levels, requiring cost sharing for out-of-network payments to offset in-network deductibles, setting out-of-pocket maximums, requiring disclosure of patient protections against balance billing, and prohibiting balance billing under certain circumstances.

The Departments of Health and Human Services, Labor and Treasury have issued a number of final rules implementing the No Surprises Act.

The provisions of these rules seek to limit excessive patient out-of-pocket amounts by limiting cost sharing for out-of-network services to in-network levels, requiring cost sharing for out-of-network payments to offset in-network deductibles, setting out-of-pocket maximums, requiring disclosure of patient protections against balance billing, and prohibiting balance billing under certain circumstances.

These rules also establish the independent dispute resolution process that providers, facilities or providers of air ambulance services, and health plans or issuers will use to determine final payment beyond allowable patient cost-sharing for certain out-of-network healthcare services and require that certain providers and facilities provide a good faith estimate of the charges to uninsured (or self-pay) individuals so they can know what costs to expect when seeking healthcare.

In October 2023, the Departments issued proposed rules that proposed new processes and policies for independent dispute resolution process.

The agencies have continued to issue guidance regarding the implementation of the No Surprises Act, and the agencies’ interpretations of law’s requirements have continued to evolve.

It is currently unclear how the No Surprise Act will impact our revenue, bad debt, and the competitive advantages of our Medical Groups being in network status across markets.

Compliance will require additional training and the build-out of new safeguards to comport our Medical Groups’ billing and collection practices with the new requirements of these interim final rules.

Compliance continues to require additional training and the build-out of additional safeguards to comport our Medical Groups’ billing and collection practices with the new requirements of these rules.

The Medicare program restructures its reimbursement rates and policies on an annual basis.

The final Medicare Physician Fee Schedule payment update for calendar year 2024, cut the Medicare conversion factor for physicians by 3.4%.

In December 2023, bipartisan legislation entitled, the Preserving Seniors' Access to Physicians Act of 2023, was introduced to reverse Medicare physician payment cuts but, at this point, it is unclear whether the bill will become law.

Additionally, CMS has made significant changes to the structure of the its Hierarchical Condition Categories (HCC) codes, Version 28 (V28), which will likely result in lower Risk Adjustment Factor (RAF) scores in 2024 for our Medical Groups entering into new Medicare Advantage agreements.

We are unable to predict the effect of recent and future policy changes on our operations.

Reimbursement uncertainty also impacts our VBC revenue.

8 unchanged sentences

Determining applicable primary and secondary coverage for our patients, together with the changes in patient coverage that occur each month, requires complex, resource-intensive processes.

Errors in determining the correct coordination of benefits may result in refunds to payers.

Errors in determining the correct coordination of

benefits may result in refunds to payers.

Revenues associated with Medicare and Medicaid programs are also subject to estimating risk related to the amounts not paid by the primary government payer that will ultimately be collectible from other government programs paying secondary coverage, the patient’s commercial health plan secondary coverage or the patient.

Collections, refunds and payor retractions typically continue to occur for up to three years and longer after our Medical Groups’ services are provided.

Collections, refunds and payer retractions typically continue to occur for up to three years and longer after our Medical Groups’ services are provided.

If our estimates of revenues are materially inaccurate, it could impact the timing and the amount of our revenues recognition and have a material adverse effect on our business, results of operations, financial condition and cash flows.

1 unchanged sentence

The amounts our Medical Groups receive for patient care services furnished to patients are determined by a number of factors, including the payer mix of our Privia Physicians’ patients and the reimbursement methodologies and rates utilized by our patients’ health insurance company.

Reimbursement rates are generally higher for VBC than they are under traditional FFS arrangements, and

VBC provides us with an opportunity to capture any additional surplus we create by investing in population health services to better manage a particular patient’s care, which, in turn, should reduce the total cost of care.

Reimbursement rates are generally higher for VBC than they are under traditional FFS arrangements, and VBC provides us with an opportunity to capture any additional surplus we create by investing in population health services to better manage a particular patient’s care, which, in turn, should reduce the total cost of care.

Under certain VBC arrangements, either our management service organizations or our ACOs may receive specific care management fees, administrative fees or other fees to cover such population health and care management services, which may be structured as a fixed fee per member per month, or PMPM, for such services.

47 unchanged sentences

Such Privia Physicians may not renew their contracts, seek to terminate their relationship with us or renew on less favorable terms.

Moreover, negative publicity related to our Privia Physician relationships, regardless of its accuracy, may further damage our business by affecting our reputation or ability to compete for new Privia Physicians in the market.

Moreover, negative publicity related to our Privia Physician relationships, regardless of its accuracy, may further damage our business

by affecting our reputation or ability to compete for new Privia Physicians in the market.

If any of these were to occur, our revenue may decline and our business, financial condition and results of operations could be adversely affected.

If we do not continue to innovate and evolve our service offerings in a way that is useful to our Medical Groups, Privia Physicians and their patients, and our health system or hospital partners, we may not remain competitive, fail to meet our growth expectations, and our revenue and results of operations could suffer.

The market for healthcare in the United States is in the early stages of structural change and is rapidly evolving toward a more VBC model with an increased emphasis on technological solutions and a customer centered focus.

If we do not continue to innovate and evolve our service offerings in a way that is useful to our Medical Groups, Privia Physicians and their patients, our health system or hospital partners, and third-party payers, we may not remain competitive, fail to meet our growth expectations, and our revenue and results of operations could suffer.

The market for healthcare in the United States is in the midst of structural change and is evolving toward a more VBC model with an increased emphasis on technological solutions and a customer centered focus.

Our success depends on our ability to keep pace with technological developments, satisfy increasingly sophisticated physician, payer and patient requirements, and sustain market acceptance.

20 unchanged sentences

From time to time, we may renegotiate or attempt to renegotiate contracts in the ordinary course of business prior to their applicable termination or expiration with certain of our counterparties, including as part of rate negotiations with payer customers.

If our Medical Groups, Privia Physicians, health system or hospital partners, ACO participants and payer customers fail to renew their contracts, renew their contracts upon less favorable terms or at lower fee levels or fail to utilize additional products and services obtained from us, or if we fail to renegotiate contracts with our counterparties on favorable terms or at all, our revenue may decline or our future revenue growth may be constrained.

our future revenue growth may be constrained.

Should any of our physician practices terminate their relationship with us after implementation has begun, we would not only lose our time, effort and resources invested in that implementation, but we would also have lost the opportunity to leverage those resources to build a relationship with other Privia Physicians over that same period of time.

16 unchanged sentences

Such changes to our pricing model or our inability to efficiently price our services could harm our business, results of operations, and financial condition and impact our ability to predict our future performance.

Our growth strategy may not prove viable and we may not realize expected results.

Our business strategy is to grow rapidly by expanding our Privia Physicians in existing markets and building new Medical Group in new geographical markets.

The success of our business depends on the execution of our growth strategy, which may not prove viable and we may not realize expected results.

Our business strategy is to grow rapidly by expanding our Privia Physicians in existing markets and building new Medical Groups in new geographical markets.

New market growth is significantly dependent on partnering with anchor medical practices or health systems or hospitals in such new geographic markets.

15 unchanged sentences

We have experienced, and may continue to experience, rapid growth and organizational change, which has placed, and may continue to place, significant demands on our management and our operational and financial resources.

We may also seek growth opportunities through strategic acquisitions and partnerships.

Additionally, our organizational structure may become more complex as we improve our operational, financial and management controls, as well as our reporting systems and procedures.

3 unchanged sentences

If we fail to effectively manage our anticipated growth, the quality of our services may suffer, which could negatively affect our brand and reputation and harm our ability to attract and retain Medical Groups, Privia Providers, patients and employees.

If we fail to evaluate and execute new business opportunities properly, we may not achieve anticipated benefits and may incur increased costs.

In addition, as we expand our business, it is important that we continue to maintain a high level of stakeholder service and satisfaction.

13 unchanged sentences

CMS may also impose penalties upon providers who submit incomplete or inaccurate information or who have affiliations with other providers that CMS has determined pose undue risk of fraud, waste or abuse.

If we fail to comply with these and other requirements to maintain our enrollment, Medicare and Medicaid could deny continued future enrollment or revoke our enrollment and billing privileges.

If we fail to comply with these and other requirements to maintain our enrollment, Medicare and Medicaid could deny continued future enrollment or revoke

our enrollment and billing privileges.

Further, Medicare now subjects new locations at which physicians are furnishing services to Medicare beneficiaries to a location site visit to confirm enrollment information.

The requirements for enrollment, licensure, certification, and accreditation may include notification or approval in the event of a transfer or change of ownership or certain other changes.

Other agencies or commercial payers with which we have contracts may

have similar requirements, and some of these processes may be complex.

Other agencies or commercial payers with which we have contracts may have similar requirements, and some of these processes may be complex.

Failure to provide required notifications or obtain necessary approvals may result in the delay or inability to complete an acquisition or transfer, loss of licensure, lapses in reimbursement, or other penalties.

21 unchanged sentences

Further, such an incident could result in liability to the patient under state law and could damage our reputation among Privia Physicians and their patients all of which could adversely affect our business.

For additional risks related to our technology-enabled platform, see “ Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our patients, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, operations and our reputation.”

We rely on third-party vendors to host and maintain our technology-enabled platform.

Our ability to offer our solutions and services and operate our business is dependent on maintaining our relationships with third-party vendors and entering into new relationships to meet the changing needs of our business.

Our ability to offer our solutions and services and operate our business is dependent on maintaining our relationships with third-party vendors and entering into new relationships to

meet the changing needs of our business.

Any deterioration in our relationships with such vendors or our failure to enter into agreements with vendors in the future could harm our business and our ability to pursue our growth strategy.

Because of the large amount of data that we collect and manage, it is possible that, despite precautions taken at our vendors’ facilities, the occurrence of a natural disaster, cyber incident, decision to close the facilities without adequate notice or other unanticipated problems could result in our non-compliance with privacy laws and regulations, loss of proprietary or personal information and in lengthy interruptions in our service.

These service interruptions could also cause our platform to be unavailable to our Medical Groups, Privia Providers, patients and network members, and impair our ability to deliver solutions and services and to manage our relationships with new and existing

Medical Groups, Privia Providers, patients and network members.

We do, however, maintain redundancy with respect to the critical components of our platform.

We take steps to monitor the performance of third-party vendors, including in our agreements with such parties, but our oversight controls could prove inadequate.

Since we do not fully control the actions of vendors and other third parties, including our Medical Groups and Privia Providers, we are subject to the risk that their decisions or operations adversely impact us and replacing such third-party vendors could create significant delay and expense.

If these third-party vendors fail to satisfy their obligations to us or if they fail to comply with legal or regulatory requirements in a high-quality and timely manner, our operations and reputation could be compromised, we may not realize the anticipated economic and other benefits from these arrangements, and we could suffer adverse legal, regulatory and financial consequences.

In addition, these third parties face their own technology, operating, business and economic risks, and any significant failures by them, including the improper use or disclosure of confidential Company information or failure to comply with applicable law, could cause harm to our reputation or otherwise expose us to liability.

If our third-party vendors are unable or unwilling to provide the services necessary to support our business, or if our agreements with such vendors are terminated, our operations could be significantly disrupted.

13 unchanged sentences

While we have disaster recovery systems and business continuity plans in place, any disruptions in our disaster recovery systems or the failure of these systems to operate as expected could, depending on the magnitude of the problem, adversely affect our operating results by limiting our capacity to effectively monitor and control our operations.

Despite our implementation of a variety of security measures, our information technology systems could be subject to physical or electronic break-ins, and similar disruptions from unauthorized tampering or any weather-related disruptions where our headquarters is located.

Despite our implementation of a variety of security measures, our information technology systems could be subject to physical or electronic break-ins, and similar disruptions from unauthorized tampering, any weather-related disruptions or fires where our headquarters is located.

In addition, in the event that a significant number of our management personnel were unavailable in the event of a disaster, our ability to effectively conduct business could be adversely affected.

We may be subject to legal proceedings and litigation, including intellectual property and privacy disputes, which are costly to defend and could materially harm our business and results of operations.

We may be party to lawsuits and legal proceedings in the normal course of business.

We have been in the past and may be party to lawsuits and legal proceedings in the future in normal course of business.

These matters are often expensive and disruptive to normal business operations.

1 unchanged sentence

We may also face allegations or litigation related to our acquisitions, securities issuances or business practices, including public disclosures about our business.

Litigation and regulatory proceedings may be protracted and expensive, and the results are difficult to predict.

Litigation and regulatory proceedings may be protracted and expensive, and the results are difficult to

Certain of these matters may include speculative claims for substantial or indeterminate amounts of damages and may include claims for injunctive relief.

7 unchanged sentences

These lawsuits, which may be initiated by government authorities as well as private party relators, which are often disgruntled employees or physicians, can involve significant monetary damages, fines, attorney fees and the award of bounties to private plaintiffs who successfully bring these suits, as well as to the federal health care programs.

In recent years, government

oversight and law enforcement have become increasingly active and aggressive in investigating and taking legal action against potential fraud and abuse especially in the health care industry.

In recent years, government oversight and law enforcement have become increasingly active and aggressive in investigating and taking legal action against potential fraud and abuse especially in the health care industry.

Furthermore, our business exposes our Medical Groups and Privia Providers to potential medical malpractice, professional negligence or other related actions or claims that are inherent in the provision of healthcare services.

7 unchanged sentences

If our costs of insurance and claims increase, then our earnings could decline.

Our business depends on our ability to effectively invest in, implement improvements to and properly maintain the uninterrupted operation and data integrity of our information technology and other business systems.

Our business depends on our ability to effectively invest in, implement improvements to and properly maintain the uninterrupted operation, data integrity and security of our information technology and other business systems.

Our business is highly dependent on maintaining effective information systems as well as the integrity and timeliness of the data we use to serve our Privia Providers’ patients, support our Privia Providers and care teams, monitor and manage our ACOs, monitor and manage, including reporting on behalf of, our management services organizations, and to otherwise operate our business.

5 unchanged sentences

Increasing regulatory and legislative changes will place additional demands on our information technology infrastructure that could have a direct impact on resources available for other projects tied to our strategic initiatives.

In addition, recent trends toward greater patient engagement in health care require new and enhanced technologies, including more sophisticated applications for mobile devices.

recent trends toward greater patient engagement in health care require new and enhanced technologies, including more sophisticated applications for mobile devices.

Connectivity among technologies is becoming increasingly important.

6 unchanged sentences

We rely on a combination of trademark, trade-secret, and copyright laws and confidentiality procedures and contractual provisions to protect our intellectual property rights in our internally developed technology and content and our brand.

maintain, both in terms of initial preparation and ongoing registration requirements and the costs of defending our rights.

We may, over time, increase our investment in protecting our intellectual property through additional trademark, patent and other intellectual property filings that could be expensive and time-consuming to develop and maintain, both in terms of initial preparation and ongoing registration requirements and the costs of defending our rights.

These measures, however, may not be sufficient to offer us meaningful protection.

9 unchanged sentences

Uncertainty may result from changes to intellectual property legislation and from interpretations of intellectual property laws by applicable courts and agencies.

In addition, advances in AI technology may exacerbate these risks, including the risk that existing intellectual property laws may not adequately protect against advances in AI technology, which may also give rise to a proliferation of infringement which we may not be able to address effectively, and the risk that the use of generative AI tools could result in us inadvertently disclosing trade secrets or other confidential information.

Accordingly, despite our efforts, we may be unable to obtain and maintain the intellectual property rights necessary to provide us with a competitive advantage.

7 unchanged sentences

Additionally, in recent years, individuals and groups have begun acquiring intellectual property assets for the purpose of making claims of infringement and attempting to extract settlements from companies like ours.

We may also face allegations that our employees have misappropriated the intellectual property or proprietary rights of their former employers or other third parties.

We may also face allegations that our employees have

misappropriated the intellectual property or proprietary rights of their former employers or other third parties.

It may be necessary for us to initiate litigation to defend ourselves in order to determine the scope, enforceability and validity of third-party intellectual property or proprietary rights, or to establish or enforce our respective rights.

10 unchanged sentences

Even if resolved in our favor, litigation or other legal proceedings relating to intellectual property claims may cause us to incur significant expenses, and could distract our technical and management personnel from their normal responsibilities.

addition, there could be public announcements of the results of hearings, motions or other interim proceedings or developments, and if securities analysts or investors perceive these results to be negative, it could have a material adverse effect on the price of our common stock.

In addition, there could be public announcements of the results of hearings, motions or other interim proceedings or developments, and if securities analysts or investors perceive these results to be negative, it could have a material adverse effect on the price of our common stock.

Moreover, any uncertainties resulting from the initiation and continuation of any legal proceedings could have a material adverse effect on our ability to raise the funds necessary to continue our operations.

5 unchanged sentences

In addition, courts outside the United States are sometimes less willing to protect trade secrets, know-how and other proprietary information and the laws regarding such protections vary among jurisdictions.

We rely, in part, on non-disclosure, confidentiality and assignment-of-invention agreements with our employees, independent contractors, consultants, customers and other companies with which we conduct business to protect our trade secrets, know-how and other intellectual property and internally developed information.

We rely, in part, on non-disclosure, confidentiality and assignment-of-invention agreements with our employees, independent contractors, and consultants with which we conduct business to protect our trade secrets, know-how and other intellectual property and internally developed information.

However, we may fail to enter into such agreements with all of our employees, independent contractors, consultants, customers and other companies, and these agreements may not be self-executing, or they may be breached and we may not have adequate remedies for such breach.

10 unchanged sentences

In addition, data providers could fail to adhere to our quality control standards in the future, causing us to incur additional expense to appropriately utilize the data.

If a substantial number of data providers were to withdraw or restrict their data, or if they fail to adhere to our quality control standards, and if we are unable to identify and contract with suitable alternative data suppliers and integrate these data sources into our service offerings, our ability to provide appropriate services to our Privia Physicians, Medical Groups, health system or hospital partners, patients, and commercial payer customers could be materially adversely impacted, which could have a material adverse effect on our business, financial condition and results of operations.

If a substantial number of data providers were to withdraw or restrict their data, or if they fail to adhere to our quality control standards, and if we are unable to identify and contract

with suitable alternative data suppliers and integrate these data sources into our service offerings, our ability to provide appropriate services to our Privia Physicians, Medical Groups, health system or hospital partners, patients, and commercial payer customers could be materially adversely impacted, which could have a material adverse effect on our business, financial condition and results of operations.

We also integrate into our internally developed applications and use third-party software to support our technology infrastructure.

19 unchanged sentences

If we inappropriately use or incorporate open source software subject to certain types of open source licenses that challenge the proprietary nature of our technology-enabled platform and service, we may be required to re-engineer our platform, discontinue the commercialization of our platform or take other remedial actions, any of which could adversely impact our business, financial condition and results of operations.

We depend on our senior management team and other key employees, and the loss of one or more of these employees or an inability to attract and retain other highly skilled employees could harm our business.

We may face risks associated with our use of certain artificial intelligence and machine learning models.

Our business utilizes artificial intelligence (AI) and machine learning technologies, to add AI-based applications to our offering and to drive efficiencies in our business.

Further, certain of our third-party vendors utilize AI and machine learning technologies in furnishing services to us.

As with many technological innovations, AI presents risks and challenges that could affect its adoption, and therefore our business.

Our offerings utilize, and we plan to further examine, develop and introduce, machine learning algorithms, predictive analytics, and other AI technologies to offer new applications, upgrade our solutions and enhance our capabilities, among other things, to identify trends, anomalies and correlations, provide alerts and initiate business processes.

If these AI or machine learning models are incorrectly designed, the performance of our products, services, and business, as well as our reputation, could suffer or we could incur liability through the violation of laws or contracts to which we are a party.

Additionally, we may make future investments in adopting AI and machine learning technologies across our business, including introducing generative AI capabilities within our Technology Platform Solution.

AI and machine learning technologies are complex and rapidly evolving, and we face significant competition from other companies in our industry as well as an evolving regulatory

Our efforts in developing AI and machine learning technology may not succeed and our competitors may be able to deploy the technology faster.

We may further be exposed to competitive risks related to the adoption and application of new technologies by established market participants or new entrants, and others.

The speed of technological development may prove disruptive to some of our markets if we are unable to maintain the pace of innovation.

In addition, market acceptance of artificial intelligence and machine learning technologies is uncertain.

These efforts, including the introduction of new products or changes to existing products, may result in new or enhanced governmental or regulatory scrutiny, litigation, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results.

Changes to existing regulations, their interpretation or implementation or new regulations could impede our use of AI and machine learning technology and also may increase our estimated costs in this area.

In addition, market acceptance of AI and machine learning technologies is uncertain, and we may be unsuccessful in our product development efforts.

Any of these factors could adversely affect our business, financial condition, and results of operations.

To compete effectively we must also be responsive to technological change, potential regulatory developments, and public scrutiny.

We depend on our senior management team and other key employees, and the loss of one or more of these employees or an inability to attract, recruit, motivate, develop and retain other highly skilled employees could harm our business.

Our success depends largely upon the continued services of our senior management team and other key employees.

Employee attraction and retention may be difficult due to many factors, including fluctuations in economic and industry conditions;

employee expectations;

the effectiveness of our talent strategies and benefits and wellbeing programs, including compensation;

and fluctuations in the labor market, including rising wages and competition for talent, which has increased due to persistent labor shortages and wage inflation.

In addition, the shift to remote or hybrid work arrangements at many companies, including us, have significantly increased competition for highly-skilled personnel, who are no longer limited to opportunities within a particular geographic area.

A lack of employee engagement, including as a result of working remotely, may reduce efficiency and productivity;

increase turnover, burnout and absenteeism;

and otherwise adversely affect our business and impede the achievement of our strategy.

We rely on our leadership team in the areas of operations, provision of medical services, information technology and security, marketing, and general and administrative functions.

3 unchanged sentences

Changes in our executive management team may also cause disruptions in, and harm to, our business.

Our Medical Groups are concentrated in Virginia, Maryland, the District of Columbia, Texas, Tennessee, Florida, California and Georgia, and we may not be able to successfully establish a presence in new geographic markets.

A substantial portion of our revenue is driven by our medical practices in Virginia, Maryland, the District of Columbia, Texas, Tennessee, Florida, Georgia, and California.

Furthermore, our business and results of operations could be adversely affected if we fail to adequately plan for and successfully carry out the succession of our key executives and senior leaders.

For additional information, see “Human Capital Resources.”

Our Medical Groups are concentrated in Virginia, Maryland, the District of Columbia, Texas, Florida, and Georgia, and we may not be able to successfully establish a presence in new geographic markets.

A substantial portion of our revenue is driven by our medical practices in Virginia, Maryland, the District of Columbia, Texas, Florida, and Georgia.

As a result, our exposure to many of the risks described herein are not mitigated by a diversification of geographic focus.

7 unchanged sentences

Our overall business results may suffer from an economic downturn.

During periods of high unemployment and inflation, such as we are experiencing related to the COVID-19 pandemic, governmental entities often experience budget deficits as a result of increased costs and lower than expected tax collections.

These budget deficits at federal, state and local government entities have decreased, and may continue to decrease, spending for federal health care programs,

including Medicare, Medicaid and similar programs, which represent significant payer sources for our Medical Groups.

During periods of high unemployment and inflation, governmental entities often experience budget deficits as a result of increased costs and lower than expected tax collections.

These budget deficits at federal, state and local government entities have decreased, and may continue to decrease, spending for federal health care programs, including Medicare, Medicaid and similar programs, which represent significant payer sources for our Medical Groups.

Other risks we face during periods of high unemployment include potential declines in the patient base, potential increases in the uninsured and underinsured populations, which could negatively impact our payer mixes, a contracting of discretionary spending by our patient base, which could negatively affect demand for the services of our Privia Physicians, and further difficulties in our collecting patient co-payment and deductible receivables.

We must attract and retain highly qualified personnel, including non-physician clinicians, in order to execute our growth plan.

Competition for highly qualified personnel with healthcare experience is intense and changes in the labor market resulting from COVID-19 have increased such competition while increasing pressure on wage growth to retain our existing personnel.

Competition for highly qualified personnel with healthcare experience is intense and changes in the labor market have increased such competition while increasing pressure on wage growth to retain our existing personnel.

We and our Medical Groups have, from time to time, experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications at acceptable salary ranges.

4 unchanged sentences

Further, such scarcity and demand can significantly drive up labor costs associated with hiring and retaining highly qualified personnel, which could negatively affect our results of operations, financial condition and cash flows.

For additional risks related to attracting and retaining highly qualified personnel, see “ We depend on our senior management team and other key employees, and the loss of one or more of these employees or an inability to attract, recruit, motivate, develop and retain other highly skilled employees could harm our business.”

Our management team has limited experience managing a public company.

1 unchanged sentence

Our management team may not successfully or efficiently manage us as a public company that is subject to significant regulatory oversight and reporting obligations under the federal securities laws and the continuous scrutiny of securities analysts and investors.

These new obligations and constituents require significant attention from our senior management and could divert their attention away from the day-to-day management of our business, which could adversely affect our business, results of operations and financial condition.

These obligations and constituents require significant attention from our senior management and could divert their attention away from the day-to-day management of our business, which could adversely affect our business, results of operations and financial condition.

Our corporate culture has contributed to our success, and if we cannot maintain this culture as we grow, we could lose the innovation, creativity and teamwork fostered by our culture and our business may be harmed.

3 unchanged sentences

Moreover, liquidity available to our employee security holders could lead to disparities of wealth among our employees, which could adversely impact relations among employees and our culture in general.

Our anticipated headcount growth and our transition from a private company to a public company may result in a change to our corporate culture, which could harm our business.

For additional risks related to our corporate culture, see “ We depend on our senior management team and other key employees, and the loss of one or more of these employees or an inability to attract, recruit, motivate, develop and retain other highly skilled employees could harm our business .”

If certain of our vendors do not meet our needs, if there are material price increases on vendor services and products, if we do not price our services correctly, if our Medical Groups are not reimbursed or adequately reimbursed for the costs of any vendor services or products borne by such Medical Groups, or if we are unable to effectively access new or replacement services or products, it could negatively impact our ability to effectively provide the services we offer and could have a material adverse effect on our business, results of operations, financial condition and cash flows.

3 unchanged sentences

If we are not able to access new or replacement services or products on a cost-effective basis or if vendors are not able to fulfill our requirements for such services or products, or unable to scale as fast as our operations grow, we could face Privia Physician attrition and other negative consequences which could have a material adverse effect on our business, results of operations, financial condition and cash flows.

With respect to any Medicare Advantage plans with which our Medical Groups participate, our records and submissions to such plans may contain inaccurate or unsupportable information regarding risk adjustment scores of such plan’s enrollees, which could cause us to overstate or understate the average health care burden of such population, which could result in an incorrect statement of our revenue and could subject us and our Medical Groups to various penalties.

For additional risks related to our third-party vendors, see “We rely on third-party vendors to host and maintain our technology-enabled platform.”

With respect to any Medicare Advantage plans with which our Medical Groups participate, our records and submissions to such plans may contain inaccurate or unsupportable information regarding risk adjustment scores of such plans’ enrollees, which could cause us to overstate or understate the average health care burden of such population, which could result in an incorrect statement of our revenue and could subject us and our Medical Groups to various penalties.

We submit claims and encounter data, on behalf of our participating Medical Groups, to applicable Medicare Advantage plans that are used to establish the annual, average Medicare Risk Adjustment Factor, or RAF, scores attributable to each Medical Group’s Medicare Advantage population.

These RAF scores determine, in part, the revenue to which the health plans and, in turn, our Medical Groups are entitled for the provision of medical care to such population.

CMS has made significant changes to the structure of its Hierarchical Condition Categories (HCC) codes, Version 28 (V28), which will likely result in lower Risk Adjustment Factor (RAF) scores in 2024 for our Medical Groups entering into new Medicare Advantage agreements.

The data submitted to CMS by each health plan is based, in part, on medical charts and diagnosis codes that our Privia Providers prepare and we submit to the health plans.

9 unchanged sentences

CMS has indicated that payment adjustments will not be limited to RAF scores for the specific MA enrollees for which errors are found but may also be extrapolated to the entire MA plan subject to a particular CMS contract.

Based on a recent final rule issued by CMS in January 2023, although 2011 to 2017 plan years are still subject to audit, overpayments to MA plans that are identified as a result of a Risk Adjustment Data Validation, or RADV, audit will only be subject to extrapolation for plan year 2018 and any subsequent plan year.

Based on a final rule issued by CMS in January 2023, although 2011 to 2017 plan years are still subject to audit, overpayments to MA plans that are identified as a result of a Risk Adjustment Data Validation, or RADV, audit will only be subject to extrapolation for plan year 2018 and any subsequent plan year.

In addition, CMS will not apply an adjustment factor, known as Fee-For-Service, or FFS, Adjuster in RADV audits to account for potential differences in diagnostic coding between the Medicare Advantage program and Medicare FFS program.

3 unchanged sentences

The DOJ alleged that such submissions constituted a civil False Claims Act violation.

More recently, in August 2021, Sutter Health agreed to pay $90 million to resolve allegations that it violated the False Claims Act by knowingly submitting inaccurate information about health status of beneficiaries enrolled in Medicare Advantage plans and entered into a five-year Corporate Integrity Agreement with the OIG.

In August 2021, Sutter Health agreed to pay $90 million to resolve allegations that it violated the False Claims Act by knowingly submitting inaccurate information about health status of beneficiaries enrolled in Medicare Advantage plans and entered into a five-year Corporate Integrity Agreement with the OIG.

More recently, in September 2023, the Cigna Group agreed to pay $172 million to settle False Claims Act allegations arising from its chart review program whereby it allegedly added diagnosis codes to its Medicare Advantage enrollees, thereby increasing RAF scores without removing diagnosis codes which were no longer applicable or supported by the chart review.

There can be no assurance that a Medicare Advantage plan in which our Medical Groups participate will not be randomly selected or targeted for review by CMS or that the outcome of such a review will not result in a material adjustment in our revenue and profitability, even if the information we submitted to the plan is accurate and supportable.

7 unchanged sentences

This calculation may not take into account physicians who are not currently available because of an exclusive arrangement with an intermediary entity or because the physician is locked out of moving while awaiting payment pursuant to a VBC arrangement.

In addition to a sufficiently large TAM to allow us to affiliate with a sufficiently large number of physicians to make the market economically viable, each market is evaluated to determine if there is sufficient reimbursement variation in fee schedules paid

by commercial payers to physicians to create sufficient economic opportunity to allow such physicians to embrace our Privia operating model.

In addition to a sufficiently large TAM to allow us to affiliate with a sufficiently large number of physicians to make the

market economically viable, each market is evaluated to determine if there is sufficient reimbursement variation in fee schedules paid by commercial payers to physicians to create sufficient economic opportunity to allow such physicians to embrace our Privia operating model.

Our targeted TAM is also based on the assumption that the strategic approach that our solution enables for potential Privia Physicians will be more attractive to our available physicians than many competing opportunities.

If these assumptions prove inaccurate, our business, financial condition and results of operations could be adversely affected.

Risks Related to the COVID-19 Pandemic

The use of funds made available under the CARES Act by our Medical Groups and Privia Physicians’ Affiliated Practices could adversely affect our business.

Our volumes may still periodically be impacted by COVID-19 infection rates in certain geographical markets as hospitals divert or postpone elective procedures in order to deal with infected individuals.

Further, some of our Privia Physicians and/or their Affiliated Practices may have outstanding loan obligations under the Paycheck Protection Program implemented pursuant to the Coronavirus Aid, Relief, and Economic Security Act, or the CARES Act.

Some of our Privia Physicians and/or their Affiliated Practices may have outstanding loan obligations under the Paycheck Protection Program implemented pursuant to the Coronavirus Aid, Relief, and Economic Security Act, or the CARES Act.

Although we are not liable for such loan amounts, our Privia Physicians’ inability to either have such loan amounts forgiven or pay such loan amounts could negatively impact our business, including due to responding to Privia Physician bankruptcy filings and, potentially, federal seizure of assets, including federal health care program funds, which could include funds owing to us, such as management fees.

14 unchanged sentences

Further, a failure to adequately report and maintain records related to the use of amounts from the Provider Relief Funds could have a materially adverse effect on our business, financial condition and the results of operations.

As the public health emergency for the COVID-19 pandemic continues, access to, and demand for, our services may be limited, which could adversely affect our business.

Adverse market conditions resulting from the COVID-19 pandemic, including new variants, could materially adversely affect our business and the value of our common stock.

If there is an increase in COVID-19 hospitalizations, it is possible that some state and local jurisdictions in our current markets may again impose shutdowns, “shelter-in-place” orders, quarantines, executive orders and similar government orders and restrictions for their residents to control the spread of COVID-19 or variants thereof.

Such orders or restrictions could result in reduced staffing and services at some of our Medical Groups and Privia Physicians’ Affiliated Practices, work stoppages and slowdowns among some of our vendors and suppliers, slowdowns and delays, travel restrictions and cancellation of elective procedures and reduction in our in-person sales activity, thereby significantly and potentially negatively impacting our operations.

Other potential disruptions include restrictions on the ability of our personnel to travel;

inability of our suppliers to manufacture goods and to deliver these to us on a timely basis, or at all;

inventory shortages or obsolescence;

delays in actions of regulatory bodies;

diversion of or limitations on employee resources that would otherwise be focused on the operations of our business, including because of sickness of employees or their families or the desire of employees to avoid contact with groups of people;

business adjustments or disruptions of certain third parties;

and additional government requirements or other incremental mitigation efforts.

The extent to which future waves, of the COVID-19 pandemic or the spread of variants impact our business will depend on future developments, which are highly uncertain and cannot be predicted, including new information which may emerge

concerning the severity and spread of COVID-19 or variants, vaccination rates and the actions to contain the COVID-19 pandemic or treat its impact, among others.

In addition, the COVID-19 virus disproportionately impacts older adults, especially those with chronic illnesses, which includes many of our patients, which could strain the resources of our physician practices.

Even without government restrictions on travel and our operations, patients may again become reluctant to seek necessary care if the COVID-19 pandemic worsens as a result of new variants.

This could have the effect of reducing the revenue of our Medical Groups and our resulting management fees.

Such reluctance may result in deferring necessary healthcare services that may adversely affect the health of such patients which may exacerbate health conditions and increase the cost of care in the future, which may adversely affect our VBC performance or divert patients from our Privia Physicians to more expensive and intense providers of services.

Further, as a result of the COVID-19 pandemic, we may experience slowed growth or a decline in new patient demand.

We also may experience increased internal and third-party medical costs as we provide care for patients suffering from COVID-19.

In addition, we may face increased competition due to changes to our competitors’ products and services, including modifications to their terms, conditions, and pricing that could materially adversely affect our business, results of operations, and overall financial condition in future periods.

Further government restrictions in response to the COVID-19 pandemic and other national and international incidents could also cause our third-party data center hosting facilities and cloud computing platform providers, which are critical to our infrastructure, to shut down their business, experience security incidents that impact our business, delay or disrupt performance or delivery of services, or experience interference with the supply chain of hardware required by their systems and services, any of which could materially adversely affect our business.

In addition, the COVID-19 pandemic has resulted in our employees and those of many of our vendors working from home and conducting work via the internet, and if the network and infrastructure of internet providers becomes overburdened by increased usage or is otherwise unreliable or unavailable, our employees’, and our customers’ and vendors’ employees’, access to the internet to conduct business could be negatively impacted.

Limitations on access or disruptions to services or goods provided by or to some of our suppliers and vendors upon which our technology-enabled platform and business operations relies, could interrupt our ability to provide our technology-enabled platform, decrease the productivity of our workforce, and significantly harm our business operations, financial condition, and results of operations.

Our technology-enabled platform and the other systems or networks used in our business may experience an increase in attempted cyber-attacks, targeted intrusion, ransomware, and phishing campaigns seeking to take advantage of shifts to employees working remotely using their household or personal internet networks and to leverage fears promulgated by the COVID-19 pandemic.

The success of any of these unauthorized attempts could substantially impact our technology-enabled platform, the proprietary and other confidential data contained therein or otherwise stored or processed in our operations, and ultimately our business.

Any actual or perceived security incident also may cause us to incur increased expenses to improve our security controls and to remediate security vulnerabilities.

On January 12, 2023, HHS again extended the public health emergency for an additional ninety days.

On January 30, 2023, the Office of Management and Budget issued a statement of policy that the Biden Administration’s intent is to extend the public health emergency to May 11, 2023, and to end the public health emergency on that date.

The Consolidated Appropriations Act of 2023 extended many of the telehealth flexibilities authorized by the COVID-19 public health emergency through December 31, 2024.

Nonetheless, once the COVID-19 public health emergency and the extended telehealth flexibility cease, it may be necessary to change certain of our operations to satisfy the then existing requirements, which may revert back to pre-public health emergency standards, and may result in a loss of revenue as coverage for our telehealth capabilities may cease or be significantly reduced.

The extent and continued impact of the COVID-19 pandemic on our business will depend on certain developments, including:

the duration and spread of the outbreak;

government responses to the pandemic;

the impact on our customers and our sales cycles;

the impact on customer, industry, or employee events;

and the effect on our partners and supply chains, all of which are uncertain and cannot be predicted.

To the extent the COVID-19 pandemic adversely affects our business and financial results, it may also have the effect of heightening many of the other risks described in this “Risk Factors” section, including but not limited to those relating to cyber-attacks and security vulnerabilities, interruptions or delays due to third parties, or our ability to raise additional capital or generate sufficient cash flows necessary to fulfill our obligations under our existing indebtedness or to expand our operations.

Our use, disclosure, and other processing of personal information, including health-related information, is subject to HIPAA, other federal and state privacy and security regulations, and contractual obligations, and our actual or perceived failure to comply with those regulations or contractual obligations could result in significant liability or reputational harm and, in turn, a material adverse effect on our patient base and revenue.

3 unchanged sentences

HIPAA requires covered entities, like us, our Owned or Non-Owned Medical Groups, and their business associates to develop and maintain policies and procedures with respect to PHI that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information.

Our Medical Groups are all participants in an “Affiliated Covered Entity” under HIPAA, which is a group of legally separate covered entities that considers themselves a single covered entity due to affiliation or some common control or ownership.

Participation in an affiliated covered entity allows us to share certain HIPAA compliance efforts but also provides for joint and several liability for HIPAA violations among all the participants in the Affiliated Covered Entity.

In addition to our status as a covered entity, our management services organizations and ACOs are “business associates” to our Medical Groups and ACO participants.

Our Medical Groups may be all participants in an “Affiliated Covered Entity” or an “Organized Health Care Arrangement” under HIPAA, which groups of legally separate covered entities that consider themselves a single covered entity due to affiliation, some common control or ownership, or through clinical integration and/or care coordination.

Participation in an affiliated covered entity or an organized health care arrangement allows us to share certain HIPAA compliance efforts but also provides for joint and several liability for HIPAA violations among all the participants in the Affiliated Covered Entity.

In addition to our status as a covered entity, our management services organizations and ACOs may also be “business associates” to our Medical Groups and ACO participants.

Entities that are found to be in violation of HIPAA as the result of a breach of unsecured PHI, a complaint about privacy practices or an audit by the U.S.

11 unchanged sentences

We are also subject to a provision of the federal 21st Century Cures Act that is intended to facilitate the appropriate exchange of health information.

In May 2020, the United States Department of Health and Human Services Office of the National Coordinator for Health Information Technology and CMS issued complementary new rules that are intended to clarify provisions of the 21st Century Cures Act regarding interoperability and information blocking and include, among other things, requirements surrounding information blocking, changes to ONC’s health IT certification program and requirements that CMS regulated payors make relevant claims/care data and provider directory information available through standardized patient access and provider directory application programming interfaces, or APIs, that connect to provider electronic health record systems, or EHRs.

In May 2020, the United States Department of Health and Human Services Office of the National Coordinator for Health Information Technology and CMS issued complementary new rules that are intended to clarify provisions of the 21st Century Cures Act regarding interoperability and information blocking and include, among other things, requirements surrounding information blocking, changes to ONC’s health IT certification program and requirements that CMS regulated payers make relevant claims/care data and provider directory information available through standardized patient access and provider directory application programming interfaces, or APIs, that connect to provider electronic health record systems, or EHRs.

The companion rules will transform the way in which healthcare providers, health IT developers, health information exchanges/health information networks, or HIEs/HINs, and health plans share patient information, and create significant new requirements for healthcare industry participants.

4 unchanged sentences

These laws and regulations are often uncertain, contradictory, and subject to changed or differing interpretations, and we expect new laws, rules and regulations regarding privacy, data protection, and information security to be proposed and enacted in the future.

For example, the California Consumer Privacy Act of 2018 (the “CCPA”), which was significantly amended by the California Privacy Rights Act (“CPRA”) effective January 1, 2022, affords consumers expanded privacy protections.

Additionally, Virginia, Connecticut, Utah and Colorado have passed comprehensive privacy legislation in 2021, and several additional privacy bills have been proposed both at the federal and state level that may result in additional legal requirements that impact our business.

California residents also have the right to request that a business delete their personal information unless it is necessary for the business to maintain for certain purposes, to direct a business to correct errors in their personal information, and to restrict the use and disclosure of sensitive information.

They have the right to know if their personal information is being sold or shared and the right to opt out of the sale or disclosure.

Beginning in 2023, under the CPRA’s amendments, as well as comprehensive privacy legislation passed in Virginia, residents of those states will have additional rights with

respect to their personal information, such as a right to opt out of certain processing activities for sensitive data and a right to a portable copy of their personal information.

The CPRA creates a new regulator responsible for enforcement of the CPRA, and enforcement priorities of this new regulatory body have yet to be determined.

The CCPA and CPRA also provide for civil penalties for violations, as well as a private right of action for data breaches that may increase data breach litigation.

For example, the California Consumer Privacy Act of 2018, as amended (the “CCPA”) affords consumers certain privacy protections and rights.

California residents have the right to request that a business delete their personal information unless it is necessary for the business to maintain for certain purposes, to direct a business to correct errors in their personal information, and to limit the use and disclosure of sensitive information.

They have the right to know if their personal information is being sold or shared and the right to opt out of the “sale” or “sharing” of personal information, as those terms are defined under the CCPA.

The California Privacy Rights Act creates a new regulator responsible for enforcement of the CCPA, and the CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that may increase data breach litigation.

Additional states have passed and will continue to pass comprehensive privacy legislation with privacy protections and rights, and several additional privacy bills have been proposed both at the federal and state level that may result in additional legal requirements of their own that impact our business.

Failure to comply with these and any other comprehensive privacy laws passed at the state or federal level may result in regulatory enforcement action and damage to our reputation.

3 unchanged sentences

Some states may afford private rights of action to individuals who believe their personal information has been misused.

This complex, dynamic legal landscape regarding privacy, data protection, and information security creates significant compliance issues for us and potentially restricts our ability to collect, use and disclose data and exposes us to additional expense, adverse publicity and liability.

In the event that we are subject to or affected by the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

This complex, dynamic legal landscape regarding privacy, data protection, and information security

creates significant compliance issues for us and potentially restricts our ability to collect, use and disclose data and exposes us to additional expense, adverse publicity and liability.

In the event that we are subject to or affected by the CCPA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

Furthermore, the Federal Trade Commission, or FTC, and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive.

1 unchanged sentence

The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities.

Further, in July 2023, the FTC and the U.S.

Department of Health and Human Services' Office for Civil Rights (“OCR”) cautioned hospitals and telehealth providers about the privacy and security risks related to the use of online tracking technologies integrated into their websites or mobile apps that may be impermissibly be disclosing consumers’ sensitive personal health data to third parties.

Any actual or perceived security incident also may cause us to incur increased expenses to improve our security controls and to remediate security vulnerabilities.

While we have implemented data privacy and security measures in an effort to comply with applicable laws, regulations, and contractual obligations relating to privacy and data protection, some PHI and other personal information or confidential information is transmitted to us by third parties, who may not implement adequate security and privacy measures.

23 unchanged sentences

As a public company, we are required to document and test our internal control over financial reporting pursuant to Section 404 of the Sarbanes-Oxley Act so that our management can certify as to the effectiveness of our internal control over financial reporting.

Section 404(a) of the Sarbanes-Oxley Act (“Section 404(a)”) requires that beginning with this annual report for the year ended December 31, 2022, management assess and report annually on the effectiveness of our internal control over financial reporting and identify any material weaknesses in our internal control over financial reporting.

Section 404(a) of the Sarbanes-Oxley Act (“Section 404(a)”) requires that management assess and report annually on the effectiveness of our internal control over financial reporting and identify any material weaknesses in our internal control over financial reporting.

Section 404(b) requires our independent registered public accounting firm to issue an annual report that addresses the effectiveness of our internal control over financial reporting.

2 unchanged sentences

If we are unable to assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an unqualified opinion as to the effectiveness of our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports, the market price of our common stock could be adversely affected and we could become subject to litigation or investigations by Nasdaq, the SEC, or other regulatory authorities, which could require additional financial and management resources.

Negative publicity relating to our business, industry, Medical Groups or Privia Providers may have a material adverse effect on our financial results.

We may be negatively affected if another company in our industry, or if one of our Medical Groups or Privia Providers, engages in practices that subject our industry or business to negative publicity.

Negative publicity may result from judicial inquiries, unfavorable outcomes in lawsuits, social media, regulatory or governmental actions with respect to our services.

Negative publicity may cause increased regulation and legislative scrutiny of industry practices as well as increased litigation or enforcement action by civil and criminal authorities.

Additionally, negative publicity may increase our costs of doing business and adversely affect our profitability by impeding our ability to market our services, constraining our ability to price our services appropriately for the risks we are assuming, requiring us to change the services we offer or increasing the regulatory burdens under which we operate.

For additional risks related to negative publicity of our Medical Groups or Privia Providers, see “ If we are not able to maintain and enhance our reputation and brand recognition, including through the maintenance and protection of trademarks, our business and results of operations will be harmed.” and “If we cannot timely implement the Privia Technology Solution for Privia Physicians and new Medical Groups, or resolve Privia Provider and patients concerns, including any technical and billing issues, in a timely manner, we may lose Medical Groups, Privia Providers and their patients, and our reputation may be harmed.”

Increased attention to, and evolving expectations for, environmental, social, and governance (“ESG”) initiatives could increase our costs, harm our reputation, or otherwise adversely impact our business .

8 unchanged sentences

In addition, we expect there will likely be increasing levels of regulation, disclosure-related and otherwise, with respect to ESG matters.

For example, the SEC has published propose rules that would require companies to provide significantly expanded climate-related disclosures in their periodic reporting, which may require us to incur significant additional costs to comply, including the implementation of significant additional internal controls processes and procedures regarding matters that have not been subject to such controls in the past, and impose increased oversight obligations on our management and board of directors.

For example, the SEC has published proposed rules that would require companies to provide significantly expanded climate-related disclosures in their periodic reporting, which may require us to incur significant additional costs to comply, including the implementation of significant additional internal controls processes and procedures regarding matters that have not been subject to such controls in the past, and impose increased oversight obligations on our management and board of directors.

Increasingly, different stakeholder groups have divergent views on sustainability and ESG matters, which increases the risk that any action or lack thereof with respect to sustainability or ESG matters will be perceived negatively by at least some stakeholders and adversely impact our reputation and business.

Anti-ESG sentiment has gained some momentum across the United States, with several states having enacted or proposed “anti-ESG” policies or legislation.

If we do not successfully manage ESG-related expectations across stakeholders, it could erode stakeholder trust, impact our reputation, and adversely affect our business.

These and other changes in stakeholder expectations will likely lead to increased costs as well as scrutiny that could heighten all of the risks identified in this risk factor.

2 unchanged sentences

Our existing indebtedness could adversely affect our business and growth prospects.

As of December 31, 2022, there was no amount outstanding under our Term Loan Facility and $65.0 million of borrowing availability under our Revolving Credit Facility.

As of December 31, 2023, there was no amount outstanding under our Revolving Credit Facility and $125.0 million of borrowing availability under our Revolving Credit Facility.

Our indebtedness, or any additional indebtedness we may incur, could require us to divert funds identified for other purposes for debt service and impair our liquidity position.

7 unchanged sentences

Fluctuations in interest rates can increase borrowing costs.

Increases in interest rates may directly impact the amount of interest we are required to pay and reduce earnings accordingly.

Such increases in interest rates directly impact the amount of interest we are required to pay and reduce earnings accordingly.

In addition, developments in tax policy, such as the disallowance of tax deductions for interest paid on outstanding indebtedness, could have an adverse effect on our liquidity and our business, financial conditions and results of operations.

15 unchanged sentences

There can be no assurance that we will be able to obtain sufficient funds to enable us to repay or refinance our debt obligations on commercially reasonable terms, or at all.

The terms of our Credit Agreement restrict our current and future operations, particularly our ability to respond to changes or to take certain actions.

The Credit Agreement contains a number of restrictive covenants that impose significant operating and financial restrictions on us and may limit our ability to engage in acts that may be in our long-term best interests, including restrictions on our ability to:

The terms of our Revolving Credit Agreement restrict our current and future operations, particularly our ability to respond to changes or to take certain actions.

The Revolving Credit Agreement contains a number of restrictive covenants that impose significant operating and financial restrictions on us and may limit our ability to engage in acts that may be in our long-term best interests, including restrictions on our ability to:

• incur additional indebtedness or other contingent obligations;

5 unchanged sentences

• materially alter the business we conduct.

You should read the discussion under the heading “Description of Certain Indebtedness” for further information about these covenants.

The restrictive covenants in the Credit Agreement require us to satisfy certain financial condition tests.

The restrictive covenants in the Revolving Credit Agreement require us to satisfy certain financial condition tests as described in Item 7 - Management’s Discussion and Analysis.

Our ability to satisfy those tests can be affected by events beyond our control.

A breach of the covenants or restrictions under the Credit Agreement could result in an event of default under such document.

A breach of the covenants or restrictions under the Revolving Credit Agreement could result in an event of default under such document.

Such a default may allow the creditors to accelerate the related debt, which may result in the acceleration of any other debt to which a cross-acceleration or cross-default provision applies.

19 unchanged sentences

Risks Related to Our Common Stock

The Lead Sponsors have significant influence on us, and their interests may conflict with ours or yours in the future.

As of February 23, 2023, investment entities affiliated with Goldman Sachs (collectively, “Goldman Sachs”) and Pamplona Capital Management LLP (“Pamplona” and, together with Goldman Sachs, the “Lead Sponsors”) beneficially own or control approximately 21.6% and 15.4%, respectively, of our common stock.

Based on their combined percentage voting power, the Lead Sponsors have significant influence over the vote of all matters submitted to a vote of our shareholders.

For so long as the Lead Sponsors continue to own a significant percentage of our stock, the Lead Sponsors will still be able to significantly influence the composition of our Board and the approval of actions requiring shareholder approval.

Accordingly, for such period, the Lead Sponsors will have significant influence with respect to our management, business plans and policies, including the appointment and removal of our officers, decisions on whether to raise future capital and amending our amended and restated charter and amended and restated bylaws, which govern the rights attached to our common stock.

In particular, for so long as the Lead Sponsors continue to own a significant percentage of our stock, the Lead Sponsors will be able to cause or prevent a change of control of us or a change in the composition of our Board and could preclude any unsolicited acquisition of us.

The concentration of ownership could deprive you of an opportunity to receive a premium for your shares of common stock as part of a sale of us and ultimately might affect the market price of our common stock.

In addition, in connection with our initial public offering, we entered into a Shareholder Rights Agreement (defined herein) that provides each Lead Sponsor the right to designate:

(i) three of the nominees for election to our Board for so long as each beneficially owns at least 15% of our common stock then outstanding;

(ii) two of the nominees for election to our Board for so long as each beneficially owns less than 15% but at least 10% of our common stock then outstanding;

and (iii) one of the nominees for election to our Board for so long as each beneficially owns less than 10% but at least 5% of our common stock then outstanding.

The Lead Sponsors may also assign such rights to their affiliates.

The Shareholder Rights Agreement also prohibits us from increasing or decreasing the size of our Board without the prior written consent of the Lead Sponsors.

In addition, for so long as either Lead Sponsor owns at least 15% of the common stock, its consent will be required for certain corporate actions, including a change of

acquisitions or dispositions of assets in an amount exceeding 15% of our total assets;

the issuance of equity by us or any of our subsidiaries (other than under equity incentive plans that have received the prior approval of our board of directors) in an amount exceeding $50 million;

the incurrence of indebtedness by us or any of our subsidiaries in an amount exceeding $50 million;

amendments to our amended and restated certificate of incorporation or amended and restated bylaws;

changes to our strategic direction or scope of its business;

any change in the size of our board of directors;

the hiring or termination of the Chief Executive Officer, Chief Financial Officer and Chief Operational Officer;

and approval of our annual budget.

The Lead Sponsors and their affiliates engage in a broad spectrum of activities, including investments in the healthcare industry generally.

In the ordinary course of their business activities, the Lead Sponsors and their affiliates may engage in activities where their interests conflict with our interests or those of our other shareholders, such as investing in or advising businesses that directly or indirectly compete with certain portions of our business or are suppliers or customers of ours.

Our amended and restated certificate of incorporation provides that none of the Lead Sponsors, any of their affiliates or any director who is not employed by us (including any non-employee director who serves as one of our officers in both his director and officer capacities) or its affiliates will have any duty to refrain from engaging, directly or indirectly, in the same business activities or similar business activities or lines of business in which we operate.

The Lead Sponsors also may pursue acquisition opportunities that may be complementary to our business, and, as a result, those acquisition opportunities may not be available to us.

In addition, the Lead Sponsors may have an interest in pursuing acquisitions, divestitures and other transactions that, in its judgment, could enhance its investment, even though such transactions might involve risks to you.

Risks related to the Pamplona Entities, a Lead Sponsor.

Pamplona Capital Management LLC and related entities (the “Pamplona Entities”) beneficially owned approximately 15.4% of our outstanding common stock as of December 31, 2022.

Certain shareholders of LetterOne, which is a significant investor in the Pamplona Entities, are on the UK and EU Russian sanctions list, although neither the Pamplona Entities nor LetterOne have been designated and, to the best of our knowledge, are not sanctioned.

While we believes that we are in full compliance with all applicable sanctions regulations and intend to remain so, there can be no assurance that the perception of Pamplona’s relationship with Privia will not adversely affect our business or stock price.

The requirements of being a public company may strain our resources and distract our management, which could make it difficult to manage our business, particularly after we are no longer an “emerging growth company.”

The requirements of being a public company may strain our resources and distract our management, which could make it difficult to manage our business, particularly since we are no longer an “emerging growth company.”

As a public company, we incur legal, accounting and other expenses that we did not previously incur as a privately held company.

We are subject to the reporting requirements of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), and certain requirements under the Sarbanes-Oxley Act, the listing requirements of NASDAQ and other applicable securities rules and regulations.

Compliance with these rules and regulations have increased our legal and financial compliance costs, made some activities more difficult, time-consuming or costly and increased demand on our systems and resources.

Compliance with these rules and regulations have increased our legal and financial compliance costs, made some

activities more difficult, time-consuming or costly and increased demand on our systems and resources.

We will continue to experience such increased costs and challenges particularly because we are no longer an “emerging growth company.” The Exchange Act requires that we file annual, quarterly and current reports with respect to our business, financial condition and results of operations.

13 unchanged sentences

• allow us to authorize the issuance of undesignated preferred stock, the terms of which may be established and the shares of which may be issued without shareholder approval, and which may include supermajority voting, special approval, dividend, or other rights or preferences superior to the rights of shareholders;

• provide for a classified board of directors with staggered three-year terms, from and after the date on which the Lead Sponsors beneficially own, in the aggregate, less than 25% of our common stock then outstanding;

• prohibit shareholder action by written consent and shareholder special meetings as well as permit removal of directors only for cause from and after the date on which the Lead Sponsors beneficially own, in the aggregate, less than 25% of our common stock then outstanding;

• provide that any amendment, alteration, rescission or repeal of our amended and restated bylaws by our shareholders will require the affirmative vote of the holders of at least 66.6% in voting power of all the then-outstanding shares of our stock entitled to vote thereon, voting together as a single class, from and after the date on which the Lead Sponsors beneficially own, in the aggregate, less than 25% of our common stock then outstanding;

• establish advance notice requirements for nominations for elections to our Board or for proposing matters that can be acted upon by shareholders at shareholder meetings, provided, however, that at any time when a Lead Sponsor beneficially owns, in the aggregate, at least 25% of our common stock then outstanding, such advance notice procedure will not apply to that Lead Sponsor.

Our amended and restated certificate of incorporation contains a provision that provides us, from and after the date on which the Lead Sponsors beneficially own, in the aggregate, less than 25% of our common stock then outstanding, with protections similar to Section 203 of the DGCL, and will prevent us from engaging in a business combination with a person (excluding the Lead Sponsors and any of their direct or indirect transferees and any group as to which such persons are a party), unless board or shareholder approval is obtained prior to the acquisition.

• provide for a classified board of directors with staggered three-year terms;

• prohibit shareholder action by written consent and shareholder special meetings as well as permit removal of directors only for cause;

• establish advance notice requirements for nominations for elections to our Board or for proposing matters that can be acted upon by shareholders at shareholder meetings.

Our amended and restated certificate of incorporation contains a provision that provides us with protections similar to Section 203 of the DGCL, and will prevent us from engaging in a business combination with a person unless board or shareholder approval is obtained prior to the acquisition.

These provisions could discourage, delay or prevent a transaction involving a change in control of our company.

11 unchanged sentences

In addition, securities markets worldwide have experienced, and are likely to continue to experience, significant price and volume fluctuations.

This market volatility, as well as general economic, market

or political conditions, could subject the market price of our shares to wide price fluctuations regardless of our operating performance.

This market volatility, as well as general economic, market or political conditions, could subject the market price of our shares to wide price fluctuations regardless of our operating performance.

Our operating results and the trading price of our shares may fluctuate in response to various factors, including:

2 unchanged sentences

• introduction of new solutions or services by us or our competitors;

• the operating and stock price performance of comparable companies;

• issuance of new or changed securities analysts’ reports or recommendations;

4 unchanged sentences

• changing economic conditions;

• negative publicity relating to us or our competitors;

• investors’ perception of us;

• events beyond our control such as weather and war;

• events beyond our control such as weather and war including the ongoing conflict between Russia and Ukraine and Israel and Palestine and other global conflicts;

• any default on our indebtedness.

6 unchanged sentences

Future sales and issuances of our outstanding shares could cause the market price of our common stock to drop significantly, even if our business is doing well.

Sales of a substantial number of shares of our common stock in the public market could occur at any time.

Sales of a substantial number of shares of our common stock in the public market have occurred and could occur at any time.

These sales, or the perception in the market that the holders of a large number of shares intend to sell shares, could reduce the market price of our common stock.

Pursuant to the registration rights agreement with our principal stockholders, we have agreed to file registration statements for the resale of shares of our common stock held by, or issuable to, our principal stockholders, certain other stockholders and certain of our directors, executive officers and employees.

All of our common stock sold pursuant to an offering covered by a registration statement will be freely transferable.

In addition, shares of our common stock issued or issuable under our equity incentive plans to employees and directors have been registered on a Form S-8 registration statement and may be freely sold in the public market upon issuance, except for shares held by affiliates who have certain restrictions on their ability to sell.

All of our common stock sold pursuant to an offering covered by a registration statement, including common stock sold by stockholders rather than the Company, will be freely transferable.

In addition, shares of our common stock issued or issuable under our equity incentive plans to employees and directors have been registered on a Form S-8 registration statement and may be

freely sold in the public market upon issuance, except for shares held by affiliates who have certain restrictions on their ability to sell.

The market price of our stock could decline if the holders of our shares of common stock sell them or are perceived by the market as intending to sell them.

4 unchanged sentences

Therefore, any return on investment in our common stock is solely dependent upon the appreciation of the price of our common stock on the open market, which may not occur.

See “Dividend Policy” for more detail.

For additional information, see “Dividend Policy.”

If securities or industry analysts do not continue to publish research or reports about our business, if they adversely change their recommendations regarding our shares or if our results of operations do not meet their expectations, our stock price and trading volume could decline.

8 unchanged sentences

The potential issuance of preferred stock may delay or prevent a change in control of us, discouraging bids for our common stock at a premium to the market price, and materially adversely affect the market price and the voting and other rights of the holders of our common stock.

UNRESOLVED STAFF COMMENTS

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors