What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-02-27 compared with 2024-02-27 · 691 added, 819 removed, 256 unchanged (86% of the section changed)

8 unchanged sentences

The following is a summary of risks factors that could materially and adversely affect our business, financial condition and results of operations.

• we conduct business in a heavily regulated industry, which increases our costs and could restrict the conduct of our business, and if we fail to comply with applicable healthcare laws and government regulations, which may change from time to time, we could incur financial penalties, become excluded from participating in government health care programs, be required to make significant operational changes or experience adverse publicity, which may adversely affect our business;

• our business model is unique and could be challenged, and if any challenges were to be successful, we could incur financial penalties, affected Medical Groups could be excluded from participation in federal health care programs, we could be required to make significant operational changes, which could negatively impact our financial performance and threaten existing relationships with Privia Physicians, and we could experience negative publicity, which could slow our growth projections;

• our revenues and profits could be diminished if we fail to retain our Privia Physicians or fail to recruit new Privia Physicians to affiliate with our Medical Groups;

• we are dependent on our relationships with Medical Groups, some of which we do not own, to furnish Privia Providers, to provide professional services to patients on behalf of federal health care programs and commercial payers, and our business could be adversely affected by our Medical Groups failure to maintain relationships with Privia Providers and/or recruit new and replacement Privia Providers;

• as more of our revenue transitions from fee-for-service to value-based reimbursement models such transitions may change the nature of our legal and regulatory risks, increase the costs necessary for our Medical Groups to furnish such care, and place a

greater portion of our current revenue at risk for costs that we may not always have the ability to control, all of which may have a material adverse effect on our financial condition and operations;

• we are dependent on our EMR vendor, athenahealth, Inc., which our Privia Technology Solution is integrated and built upon, and our business could be adversely affected if that relationship were disrupted;

• We conduct business in a heavily regulated industry, which increases our costs and could restrict the conduct of our business, and if the Company or our Medical Groups fail to comply with the extensive applicable healthcare laws and government regulations, which may change from time to time, we could suffer adverse financial impacts, be required to make significant changes to our operations, or experience reputational harm, any or all of which may adversely affect our business.

• Our business model relies on a complex legal framework that governs our relationships with Medical Groups and Privia Providers.

Legal challenges or shifting interpretations of applicable laws could require us to make significant changes to our operations, which could adversely affect our business.

• Our business, financial condition and results of operations may be adversely affected by changes and uncertainty in the healthcare industry, including health reform initiatives and other changes to laws and regulations.

• We, our Medical Groups and Privia Providers, may be subject to legal proceedings, including litigation, governmental investigations and claims, and payer audits.

• Risks associated with VBC arrangements may negatively impact our business, operations, and financial condition.

• If federal or state healthcare programs or commercial payers reduce reimbursement rates we receive or alter payment terms, if we and our Medical Groups are unable to retain and negotiate favorable contracts with private third-party payers, if insured individuals move to health plans with greater coverage exclusions or restrictions or narrower networks, or if our Medical Groups’ volume of uninsured or underinsured patients increases, or if patient responsibility accounts are not able to be collected, our revenues may decline, adversely affecting our financial condition and results of operations.

• The reimbursement process is complex and may involve delays and other uncertainties, which may adversely affect our business, operations, and revenues.

• The information that we or our Medical Groups provide to Medicare Advantage plans could be inaccurate, incomplete or unsupportable, which could impact result in harm to our business, operations and financial condition.

• Third-party payer controls designed to reduce costs and other payer practices to decrease or review utilization, surgical procedure volumes or reimbursement for services rendered may reduce our revenues.

• If the Company and its Medical Groups are unable to effectively compete, including by innovating and evolving our service offerings, our business, financial condition, and results of operations could be adversely impacted.

• Our sales and implementation cycle can be long and unpredictable and requires considerable time and expense, which may cause our results of operations to fluctuate.

• Our performance depends on our ability to efficiently price the Privia Technology Solution and our Privia operating model and to contract with Medical Groups, Privia Providers, health system partners, ACO participants and third-party payers.

• The success of our business depends on the execution of our growth strategy, which may not prove viable and we may not realize expected results, or if the estimates and assumptions we use to determine the size of our total addressable market, or TAM, are inaccurate, our future growth rate may be impacted and our business could be harmed.

• If certain of our vendors do not meet our needs, our business, ability to operate, financial condition, cash flows, results of operations, and relationships with our Medical Groups, Privia Providers and their patients could be negatively impacted.

• If we are not able to maintain and enhance our reputation and brand recognition, including through the maintenance and protection of trademarks, our business and results of operations will be harmed.

• The operations of the Company and its Medical Groups are concentrated in the fourteen states and the District of Columbia, which makes us sensitive to regulatory, economic, public health, environmental, competitive and other conditions and

changes in these jurisdictions, and we may not be able to successfully establish a presence in new geographic markets.

• Changes in treatment methodologies, trends related to the usage of primary care and specialist healthcare services, or the failure to effectively obtain medical supplies and drugs for Medical Groups could cause our results of operations to decline.

• Security threats, cybersecurity incidents or other forms of data breaches, catastrophic events and other disruptions to our, our Medical Groups’, our business partners’ or our vendors’ information technology and related systems could compromise sensitive information related to our business, the Medical Groups or patients, prevent access to critical information, harm patients, require remediation and other corrective action, which can be expensive, and expose us to liability, which could adversely affect our business, operations and reputation.

• If we cannot timely implement the Privia Technology Solution for Privia Physicians and new Medical Groups, or promptly resolve Privia Provider and patient concerns, or if the Privia Technology Solution fails to operate as we expect, our business and results of operations may be adversely impacted, we could be subject to litigation, and our reputation may be harmed.

• If we are unable to obtain, maintain and enforce intellectual property protection for our technology or if the scope of our intellectual property protection is not sufficiently broad, others may be able to develop and commercialize technology substantially similar to ours, and our ability to successfully commercialize our technology may be adversely affected.

• Third parties may allege that we are infringing, misappropriating or otherwise violating their intellectual property rights and in some instances initiate formal legal proceedings, the outcome of which would be uncertain and could have a material adverse effect on our business, financial condition and results of operations.

• If we are unable to protect the confidentiality of our trade secrets, know-how and other proprietary and internally developed information, the value of our technology could be adversely affected.

• Any restrictions on our use of, or ability to license, data, or our failure to license data and integrate third-party technologies, could have a material adverse effect on our business, financial condition and results of operations.

• Our use of “open source” software could adversely affect our ability to offer our services and subject us to possible litigation.

• We face risks associated with healthcare technology initiatives, including those related to sharing patient data and interoperability, as well as our use of certain artificial intelligence and machine learning models.

• Our use, disclosure, and other processing of personal information, including health-related information, is subject to HIPAA, other federal and state privacy and security regulations, and contractual obligations, and our actual or perceived failure to comply with those regulations or contractual obligations could result in significant liability or reputational harm and, in turn, a material adverse effect on our patient base and revenue.

• We depend on our senior management team and other key employees, and the loss of one or more of these employees or an inability to attract, recruit, motivate, develop and retain other highly skilled employees could harm our business.

• The operations and growth strategy of the Company and its Medical Groups depend on our ability to recruit and retain qualified talent, including physicians and non-physician practitioners.

• Our management team has limited experience managing a public company, and our corporate culture has contributed to our success, and if we cannot maintain this culture as we grow, our business may be harmed.

• Our overall business results may suffer from an economic downturn or deterioration of public health conditions associated with a pandemic, epidemic or outbreak of an infectious disease.

• We have a history of net losses, we anticipate increasing expenses in the future, and we may not be able to maintain profitability.

• security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our patients, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, operations and our reputation;

• the costs of complying with, or our failure to comply with, U.S.

and foreign laws related to privacy, data security and data protection could adversely affect our financial condition, operating results and reputation;

• the healthcare industry is highly competitive;

• thee impact on us of recent healthcare legislation and other changes in the healthcare industry and in healthcare spending is currently unknown, but may adversely affect our business, financial condition and results of operations;

• if reimbursement rates paid by third-party payers are reduced or if such payers otherwise restrain our ability to provide services to their enrollees through narrow network products or otherwise, our business could be harmed;

• the success of our business depends on the execution of our growth strategy, which may not prove viable and we may not realize expected results;

• we rely on third-party vendors for many of our services, including our Patient Technology Solution, and any failure or interruption in the services, or failure to protect the privacy and security of our information during the provision of such services could expose us to litigation, result in a reduction of our management fees or the imposition of financial penalties on our management services organizations, and hurt our reputation and relationships with our Privia Physicians, our Medical Groups, and their patients;

• we may be subject to legal proceedings and litigation, including intellectual property and privacy disputes, which are costly to defend and could materially harm our business and results of operations;

• our overall business results may suffer from an economic downturn, including the ability to attract and retain qualified personnel at competitive rates;

• our use and disclosure of personal information, including health-related information, is subject to the federal Health Insurance Portability and Accountability Act of 1996, as amended from time to time (collectively HIPAA), other federal and state privacy and security regulations, and contractual obligations and our actual or perceived failure to comply with such could result in significant liability or reputation harm and, in turn a material adverse effect on our patient base and operations;

• we may not be able to maintain effective internal control over our financial reporting, accurately report our financial results or report them in a timely manner, which may adversely affect investor confidence in us;

• negative publicity relating to our business, industry, Medical Groups or Privia Providers may have a material adverse effect on our financial results;

• our operating results and stock price may be volatile, and the market price of our common stock may drop below the price you pay.

Risks Related to Government Regulation, Our Business and Our Industry

We conduct business in a heavily regulated industry, which increases our costs and could restrict the conduct of our business, and if we fail to comply with applicable healthcare laws and government regulations, which may change from time to time, we could incur financial penalties, become excluded from participating in government health care programs, be required to make significant operational changes or experience adverse publicity, which may adversely affect our business.

healthcare industry is heavily regulated and closely scrutinized by federal, state and local authorities.

Comprehensive statutes and regulations, some of which require our reliance on Privia Providers to comply with, govern the manner in which our Medical Groups provide and bill for services and collect reimbursement from federal health care programs and commercial payers, our contractual relationships with our Privia Providers, vendors, health network partners and customers, how we contract with commercial payers, our marketing activities and other aspects of our operations.

Of particular importance are:

• state laws that prohibit general business corporations, such as us, from practicing medicine, controlling Privia Physicians’ medical decisions or engaging in practices such as splitting professional fees with Privia Physicians;

• federal and state laws pertaining to non-physician clinicians, such as nurse practitioners and physician assistants, including requirements for physician supervision of such clinicians and reimbursement-related requirements;

• the federal physician self-referral law, commonly referred to as the Stark Law, which, subject to certain exceptions, prohibits physicians from referring Medicare patients to an entity for the provision of certain “designated health services”, or DHS, such as laboratory and other ancillary health care services if the physician or a member of the physician’s immediate family has a direct or indirect financial relationship (including an ownership interest or a compensation arrangement) with the entity, and prohibits the entity from billing Medicare for such DHS;

• the federal Anti-Kickback Statute, or AKS, which, subject to certain exceptions known as “safe harbors,” prohibits the knowing and willful offer, payment, solicitation or receipt of any bribe, kickback, rebate or other remuneration, directly or indirectly, overtly or covertly in cash or in kind, to induce, or in return for, either the referral of an individual, or the lease, purchase, order or recommendation of, items or services covered, in whole or in part, by government healthcare programs such as Medicare and Medicaid.

Although there are a number of statutory exceptions and regulatory safe harbors protecting some common activities from prosecution, the exceptions and safe harbors are drawn narrowly.

By way of example, the AKS safe harbor for value-based arrangements requires, among other things, that the arrangement does not induce a person or entity to reduce or limit medically necessary items or services furnished to any patient.

Failure to meet the requirements of a safe harbor, however, does not render an arrangement illegal, although such arrangements may be subject to greater scrutiny by government authorities.

Further, a person or entity can be found guilty of violating the AKS without actual knowledge of the statute or specific intent to violate it;

• federal and state civil and criminal false claims laws, including the False Claims Act, or FCA, which prohibit, among other things, individuals or entities from knowingly presenting, or causing to be presented, false or fraudulent claims for payment to, or approval by Medicare, Medicaid, or other federal health care programs, knowingly making, using or causing to be made or used a false record or statement material to a false or fraudulent claim or an obligation to pay or transmit money to the federal government, or knowingly concealing or knowingly and improperly avoiding or decreasing an obligation to pay money to the federal government.

There are many potential bases for liability under the FCA.

The government has used the FCA to prosecute Medicare and other government healthcare program fraud such as coding errors, billing for services not provided, and providing care that is not medically necessary or that is substandard in quality.

In addition, we could be held liable under the FCA if we are deemed to “cause” the submission of false or fraudulent claims by, for example, providing inaccurate billing, coding or risk adjustment information to our Medical Groups and Privia Providers.

The government may also assert that a claim including items or services resulting from a violation of the AKS or Stark Law constitutes a false or fraudulent claim for purposes of the FCA.

The FCA also permits a private individual acting as a “whistleblower” to bring actions on behalf of the federal government alleging violations of the FCA and to share in any monetary recovery;

• the criminal healthcare fraud provisions of HIPAA, and related rules that prohibit knowingly and willfully executing, or attempting to execute, a scheme or artifice to defraud any healthcare benefit program or obtain, by means of false or fraudulent pretenses, representations, or promises, any of the money or property owned by, or under the custody or control of, any healthcare benefit program, regardless of the payer (e.g., public or private), and knowingly and willfully falsifying, concealing or covering up by any trick or device a material fact or making any material false, fictitious or fraudulent statement in connection with the delivery of or payment for health care benefits, items or services.

Similar to the federal Anti-Kickback Statute, a person or entity can be found guilty of violating the statute without actual knowledge of the statute or specific intent to violate it;

• civil monetary penalties laws, which impose civil fines for, among other things, the offering or transferring of remuneration to a Medicare or state healthcare program beneficiary if the person knows or should know it is likely to influence the beneficiary’s selection of a particular provider, practitioner, or supplier of services reimbursable by Medicare or a state healthcare program, unless an exception applies;

• federal and state laws that prohibit our Medical Groups from billing and receiving payment from Medicare and Medicaid for services unless the services furnished by our Privia Providers are medically necessary, adequately and accurately documented, timely submitted and billed using codes that accurately reflect the type and level of services rendered;

• Medicare and Medicaid regulations, manual provisions, local coverage determinations, national coverage determinations and agency guidance that impose complex and extensive requirements upon healthcare providers, including our Medical Groups and Privia Providers;

• state laws that prohibit physicians from splitting professional fees with non-physicians, whether individuals or entities, or place restrictions on how such professional fees may be split with non-physicians, including, for instance, prohibitions on percentage-based management fees;

• federal and state laws that regulate healthcare-related debt collection practices, pricing transparency and protecting patients from surprise billings;

• a provision of the Social Security Act that imposes criminal penalties on healthcare providers who fail to disclose, or refund known overpayments;

• federal and state antitrust laws that prohibit or limit exclusive contracting relationships with healthcare providers, prohibit or limit the sharing of cost and pricing data, prohibit competitors from taking collective action to set commercial payer reimbursement rates, and determine when a joint venture or health care network is sufficiently integrated, by either sharing substantial financial risk or substantial clinical integration, to jointly contract with commercial payers;

• federal and state laws and policies related to healthcare providers’ licensure, certification, accreditation, Medicare and Medicaid program enrollment and reassignment of benefits;

• federal and state laws and policies related to the prescribing, administrating and dispensing of pharmaceuticals and controlled substances;

• state laws related to the advertising and marketing of services by healthcare providers, including Medical Group and Privia Physicians;

• federal laws that impose civil administrative sanctions for, among other violations, inappropriate billing of services to federal health care programs or employing or contracting with individuals who are excluded from participation in federal health care programs;

• laws and regulations limiting the use of funds in health savings accounts for individuals with high deductible health plans;

• federal and state laws regarding the provision of telemedicine services, including necessary technological standards to deliver such services, coverage restrictions associated with such services, and the amount of reimbursement for such services;

• state laws pertaining to anti-kickback, fee splitting, self-referral and false claims, some of which are not consistent with comparable federal laws and regulations, including, for example, not being limited in scope to relationships involving government health care programs;

• federal and state laws pertaining to the collection, use, retention, protection, security, disclosure, transfer and processing of personal information or health information, including but not limited to HIPAA, HITECH, and the American Recovery and Reinvestment Act of 2009, as well as similar or more stringent state law;

• state insurance laws governing what healthcare entities may bear financial risk and the allowable types of financial risks, including direct primary care programs, provider-sponsored organizations, ACOs, independent practice associations, and provider capitation;

• interoperability and prohibitive provisions against information blocking of the 21st Century Cures Act.

To enforce compliance with the federal laws, the U.S.

Department of Justice and the U.S.

Department of Health and Human Services Office of Inspector General, or OIG, regularly scrutinize healthcare providers, which has led to a number of investigations, prosecutions, convictions and settlements in the healthcare industry.

Responding to and managing government investigations can be time and resource-consuming, divert management’s attention from the business and generate adverse publicity.

Any such investigation or settlement could increase our costs or otherwise have a negative impact on our business, even if we are ultimately found to be in compliance with the relevant laws.

Moreover, if one of our physician or health system partners, or another third-party fails to comply with applicable laws and becomes the target of a government investigation, government authorities could require our cooperation in the investigation, which could cause us to incur additional legal expenses, divert management’s attention from the business and result in adverse publicity.

In addition, because of the potential for large monetary exposure under the federal False Claims Act, which provides for treble damages and significant penalties, healthcare providers often settle allegations without admissions of liability for significant amounts to avoid the potential of penalties and treble damages that may be awarded in litigation proceedings.

Such settlements often contain additional compliance and reporting requirements as part of a consent decree, settlement agreement or corporate integrity agreement, which may result in significant costs for several years after resolution of the original allegations and may slow our overall growth.

Given the significant size of actual and potential settlements, it is expected that the government will continue to devote substantial resources to investigating healthcare providers’ compliance with the myriad of healthcare reimbursement rules and fraud and abuse laws.

Because of the breadth of these laws and the narrowness of the statutory exceptions and safe harbors available, it is possible that some of our business activities could, despite our efforts to comply, be subject to challenge under one or more of such laws.

Achieving and sustaining compliance with these laws may prove costly.

The risk of our being found in violation of these laws and regulations is increased by the fact that many of them have not been fully interpreted by regulatory authorities or the courts, and their provisions are sometimes complex and open to a variety of interpretations.

It is unknown, whether, when or how the laws, or the interpretation thereof, will change in the future and impact our business, financial condition, cash flows, and results of operations.

In addition, some of the governmental and regulatory bodies that regulate us may consider enhanced or new regulatory requirements or may seek to exercise their supervisory or enforcement authority in new or more robust ways.

Any of these possibilities, if they occur, could adversely affect us.

Our operating model seeks to structure each Medical Group as a “group practice” for purposes of the Stark Law.

The Stark Law’s “group practice” definition is subject to a multi-factor analysis under the current regulatory scheme with many of the factors having multiple options for compliance.

Many of the individual factors have not been subject to meaningful judicial interpretation or regulatory agency guidance, and when regulatory agency guidance is available, it is subject to change periodically.

Furthermore, the test is not static, and our Medical Groups and their relationships with Privia Physicians must be periodically reviewed to ensure that they continue to meet the definition and that the safeguards built into the various agreements are being implemented and administered as required.

It is possible that governmental and enforcement authorities will conclude that our business practices may not comply with the Stark Law, current or future statutes, regulations or case law interpreting applicable fraud and abuse or other healthcare laws and regulations.

Depending on the circumstances, failure to meet applicable regulatory requirements can result in civil, administrative, and criminal penalties such as criminal prosecution, fines, damages, disgorgement, individual imprisonment, recoupments of overpayments, imprisonment, loss of enrollment status, exclusion from participation in federal and state funded health care programs, contractual damages, reputational harm and the curtailment or restricting of our operations, as well as additional reporting obligations and oversight if we become subject to a corporate integrity agreement or other agreement to resolve allegations of non-compliance with these laws.

In addition, in order to achieve compliance with current and future regulatory requirements, we may need to discontinue an aspect of our current business or expend significant costs altering our business structure, operations, or relationship with certain third-parties, including Privia Providers and health system partners, payers, and vendors.

• Our ability to use our net operating losses to offset future taxable income may be subject to certain limitations.

• Our indebtedness, Revolving Credit Agreement terms, or any failure to raise additional capital or generate cash flow to expand our operations could adversely affect our business and growth prospects or restrict our current and future operations.

• We may fail to maintain effective internal control over financial reporting, which may adversely affect investor confidence.

• Negative publicity relating to our business, industry, Medical Groups or Privia Providers and evolving expectations related to ESG initiatives may have a material adverse effect on our business or financial results.

• Provisions of our corporate governance documents could make an acquisition of us more difficult, may prevent attempts by our shareholders to replace or remove our current management, or may limit our shareholders’ ability to obtain a favorable judicial forum for disputes with us.

• Our operating results and stock price may be volatile, the market price of our common stock could drop significantly and you may not receive any return on your investment in our stock.

Legal and Regulatory Risks

We conduct business in a heavily regulated industry, which increases our costs and could restrict the conduct of our business, and if the Company or our Medical Groups fail to comply with the extensive applicable healthcare laws and government regulations, which may change from time to time, we could suffer adverse financial impacts, be required to make significant changes to our operations, or experience reputational harm, any or all of which may adversely affect our business.

Participants in the healthcare industry are subject to extensive and complex laws and regulations at the federal, state, and local levels relating to, among other issues:

• billing and coding for, and documentation of, services and properly handling overpayments;

• relationships with physicians and other referral sources and referral recipients, including, for example, state or attorney general notice or approval requirements for certain relationships;

• restrictions related to multi-specialty practices;

• appropriateness and adequacy of medical care;

• quality of medical equipment and services;

• patient, workforce, and public safety;

• qualifications and supervision of, and reimbursement for services provided by, medical and support personnel;

• the provision of services via telehealth, including technological standards and coverage restrictions or other limitations on reimbursement;

• the confidentiality, maintenance, interoperability, exchange, and security of medical records and other health-related and personal information, including data breach, ransomware and identity theft issues;

• the development and use of artificial intelligence and other predictive algorithms, including those used in clinical decision support tools;

• restrictions on the provision of medical care, including reproductive care;

• permitting, facility and personnel licensure, certification and accreditation requirements;

• enrollment standards and requirements for participation in government healthcare programs;

• corporate practice of medicine and fee-splitting;

• consumer disclosures and price transparency;

• the distribution, maintenance and dispensing of pharmaceuticals and controlled substances;

• relationships between healthcare providers and drug and medical device companies;

• debt collection, balance billing and billing for out of network services;

• communications with patients and consumers;

• advertising and marketing;

• operating policies and procedures;

• activities regarding competitors;

• insurance and the assumption of financial risk by healthcare entities, including allowable types of financial risk;

• addition of facilities and services;

• environmental protections.

Among these laws are the Stark Law, the federal Anti-Kickback Statute, the FCA, the federal Civil Monetary Penalties Law, the Eliminating Kickbacks in Recovery Act, HIPAA, Health Information Technology for Economic and Clinical Health Act (“HITECH”), the Clinical Laboratory Improvement Amendments of 1988 (“CLIA”) and similar state laws.

The Company, the Medical Groups and Privia Providers each have their own compliance obligations with respect to many of these laws and regulations, such as licensure and certification requirements to provide services and operate facilities and those related to billing and coding compliance.

Although we provide general oversight and managerial support, to the extent permitted by applicable laws, and generally require compliance with laws under relevant contracts with the Medical Groups, we do not exercise control over the clinical decisions of practitioners and supervision of medical practice staff, and therefore we cannot provide assurance of their ongoing compliance.

Some healthcare laws apply to the financial relationships we have or our Medical Groups have with physicians and others who either refer or influence the referral of patients to our Medical Groups and Privia Physicians or who are the recipients of referrals.

The federal Anti-Kickback Statute, for example, is a criminal law that prohibits, among other things, the solicitation, receipt, offering or payment of any remuneration with the intent of generating referrals or orders for services or items that may be paid for by a federal healthcare program.

The OIG has enacted safe harbor regulations that outline practices deemed protected from prosecution under the federal Anti-Kickback Statute.

While we and our Medical Groups endeavor to comply with applicable safe harbors, certain current arrangements, including joint ventures and financial relationships with physicians and other referral sources and persons and entities to which our Medical Groups refer patients, may not qualify for safe harbor protection.

Failure to qualify for a safe harbor does not mean the arrangement necessarily violates the federal Anti-Kickback Statute, but may subject the arrangement to greater scrutiny.

We cannot offer assurance that practices outside of a safe harbor will not be found to violate the federal Anti-Kickback Statute.

Allegations of violations of the federal Anti-Kickback Statute may also be brought under the federal Civil Monetary Penalty Law, which requires a lower burden of proof than other fraud and abuse laws.

The Stark Law is a strict liability civil law that prohibits physicians from making referrals for “designated health services” payable by Medicare or Medicaid to entities with which the physician or an immediate family member of the physician has a financial relationship, unless an exception applies.

The Stark Law further prohibits entities that have received such referrals from filing claims with Medicare (or billing another individual, entity or third party payor) for those referred services.

The financial relationships of our Medical Groups with referring physicians and their immediate family members must comply with the Stark Law.

We and our Medical Groups attempt to structure those relationships to meet an exception to or otherwise comply with the Stark Law, but the regulations implementing the Stark Law, including the requirements to meet exceptions, are detailed and complex.

We do not always have the benefit of significant regulatory or judicial interpretation of the Stark Law and its implementing regulations.

Thus, we cannot provide assurance that every relationship complies fully with the Stark Law.

Unlike the federal Anti-Kickback Statute, failure to meet an exception under or otherwise comply with the Stark Law results in a violation of the Stark Law, even if such violation is technical in nature.

Additionally, violations of the federal Anti-Kickback Statute or Stark Law, improper billing for services to federal healthcare programs, or improper retention of overpayments from federal healthcare programs may be the basis for finding an FCA violation, either under a suit brought by the government or by a private person under a qui tam, or “whistleblower,” suit.

The data protection landscape is rapidly evolving, and the Company, its Medical Groups and ACO participants, are and may become subject to numerous state and federal laws, requirements and regulations governing the collection, use, disclosure, retention and security of health-related and other personal information.

For example, the HIPAA privacy and security regulations extensively regulate the use and disclosure of PHI and require covered entities, including healthcare providers and health plans, and vendors (known as “business associates”) that perform certain services that involve creating, receiving, maintaining or transmitting PHI on behalf of covered entities or other business associates, to implement administrative, physical and technical safeguards to protect the privacy and security of PHI.

These laws are complex and subject to change and interpretation, and our approach to compliance with such laws may include reliance on safe harbors or other regulatory rules, including those related to organized healthcare arrangements, which are themselves complex, require resources and investment to manage ongoing compliance, and are subject to change and interpretation, particularly in the current regulatory environment.

In addition to HIPAA, there are numerous other laws, regulations, and legislative and regulatory initiatives at the federal and state levels governing the confidentiality, privacy, availability, integrity and security of health-related information and other types of personal information.

In many cases, the state laws are more restrictive or impose more obligations than, and may not be preempted by, the HIPAA privacy and security regulations.

State laws vary in scope, may apply to employees and business contacts in addition to patients, and may be subject to new and varying interpretations by courts and government agencies, creating complex compliance issues and potentially resulting in exposure to additional expense, adverse publicity and liability.

The potential effects of these laws are far-reaching and may require the Company, its Medical Groups, and their third-party service and technology vendors to modify data use, storage, transmission and processing practices and policies, or our approach to compliance with other similar laws, and to incur substantial costs and expenses in order to comply.

Failure to comply with these and any other comprehensive privacy laws passed at the state or federal level may result in regulatory enforcement action and reputational harm.

We expect that new or modified laws, regulations, regulatory guidance and industry standards concerning privacy, data protection and information security, including those related to specific types of personal data, will continue to be proposed and enacted in various jurisdictions, which could impact our operations and cause us to incur substantial costs.

Additionally, the Telephone Consumer Protection Act (the “TCPA”) imposes specific requirements, including consent requirements and other restrictions, on communications with patients and consumers, including text messages or other communications that we or our Medical Groups may use to communicate with and perform outreach to our patients.

TCPA violations can result in significant financial penalties, including penalties or criminal fines imposed by the Federal Communications Commission or through private litigation or by state authorities.

The Company and its Medical Groups are also subject to various federal and state antitrust laws that, for example, restrict exclusive contracting relationships with healthcare providers, restrict sharing of cost and pricing data, prohibit competitors from taking collective action to set commercial payer reimbursement rates, and establish integration requirements (financial risk or clinical integration) for joint ventures or healthcare networks to jointly contract with payers.

If we or our Medical Groups fail to comply with these or other applicable laws and regulations, which are subject to change, any such failure could result in liabilities, including civil penalties, money damages, lapses in reimbursement, loss of facility licenses, accreditations, or certifications, revocation of billing privileges, exclusion of one or more entities and/or facilities from participation in the Medicare, Medicaid and other federal and state health care programs, termination of various relationships or contracts, lawsuits and criminal penalties.

Medicare and Medicaid payments may be suspended pending even an investigation of what the government determines to be a credible allegation of fraud.

We could also be required to make changes to our business model and/or practices, which could increase operating expenses, negatively affect our business relationships, and decrease access to new business opportunities.

In addition, different interpretations or enforcement of, or amendments to, these and other laws and regulations in the future could subject current or past practices to allegations of impropriety or illegality or could require us to make changes in our operations, facilities, equipment, personnel, services, capital expenditures and operating expenses.

The costs of compliance with, and the other burdens imposed by, these and other laws or regulatory actions may increase operational costs, result in interruptions or delays in the availability of systems and/or result in a decline in patient volume or Privia Provider or Medical Group attrition.

Our failure to accurately anticipate the application of these laws and regulations to our business or any other failure to comply with current or future regulatory requirements could create liability for us and negatively affect our business.

Any action against us for violation of these laws or regulations, even if we successfully defend against it, could cause us to incur significant legal expenses, divert our management’s attention from the operation of our business and result in adverse publicity.

Our business could be adversely affected by legal challenges to our Medical Groups’ ability to provide services via telehealth in certain jurisdictions.

The ability to conduct telehealth services in a particular state is directly dependent upon the applicable laws governing remote healthcare, the practice of medicine and healthcare delivery in general in such jurisdiction, which may be subject to new laws and regulations, and changing interpretations of existing laws and regulations.

In the past, state medical boards have implemented new rules or interpreted existing rules in a manner that has limited or restricted the ability of our Medical Groups to provide telehealth services, such as laws that require a provider to be licensed and/or physically located in the same state where the patient is located.

Federal and state laws regarding such services, necessary technological standards to deliver such services, coverage restrictions associated with such services, and the amount of reimbursement for such services are subject to changing political, regulatory and other influences.

For example, of the jurisdictions in which we currently operate, Virginia, Texas, Florida, North Carolina and the District of Columbia are not members of the Interstate Medical Licensure Compact, which streamlines the process by which physicians licensed in one state are able to practice in other participating states.

Failure to comply with these laws could result in denials of reimbursement for our Privia Providers’ services (to the extent such services are billed), recoupments of prior payments, professional discipline for our Privia Providers and/or civil or criminal penalties against our Medical Groups.

Although many of the telehealth waivers enacted as part of the public health emergency were extended by the Consolidated Appropriations Act of 2023 until December 31, 2024, in its 2024 physician fee schedule final rule, CMS made further changes to its policies regarding, and the reimbursement of, telehealth service by Medicare, including the expansion of reimbursement for certain behavioral telehealth services and an increase in reimbursement for certain telehealth related services.

Although we are still gauging the overall impact of such changes to our business, CMS appears to be committed to permanently increasing the utilization of telehealth services by Medicare beneficiaries.

The expiration of the public health emergency and state budget woes could result in certain costs that have been borne by the government being passed on to patients, which will result in less patients covered by federal

health care programs and thereby increasing both the cost of collections and potential bad debt to health care providers.

All of these changes could adversely affect our financial conditions and results of operations.

Our revenues and profits could be diminished if we fail to retain our health system partners or our Privia Physicians or if we fail to recruit new Privia Physicians to affiliate with our Medical Groups.

Our operating model relies significantly on aggregating a sufficient number of Privia Physicians in each of our Medical Groups.

The number of Privia Physicians in a particular market impacts our ability to negotiate competitive reimbursement rates with commercial payers, impacts our attributed lives for VBC purposes, impacts our unit cost in furnishing our services across geographic markets, and, our revenue from the provision of management services through the MSA we enter into with the Non-Owned Medical Groups.

We still experience provider attrition within our Medical Groups resulting from retirement, disability, death and Privia Physicians pursuing other opportunities including hospital or health system employment, concierge medicine practices, and the sale of their Affiliated Practices.

The departure of large number of Privia Providers, or the departure of key Privia Physicians’ Affiliated Practices with large patient populations, could negatively impact our revenue in the short term, and may adversely affect our ability to perform under our VBC arrangements, including our financial performance and our ability to timely and accurately meet reporting requirements.

Further, the loss of any Privia Physician may result in such Privia Physician’s patient population transferring to a non-Privia Provider, which could reduce our overall revenues and profits.

Moreover, we may not be able to attract new Privia Physicians to replace the services of departing Privia Physicians or to service our obligations under third-party payer programs, such as the MSSP, Medicare Advantage plans, or VBC arrangements with a commercial payer.

We operate in certain markets in which the Non-Owned Medical Group is majority owned by one of our health system partners.

In the event our partnership or affiliation with the health system partner is terminated, we may not be able to identify an alternative partner or structure in a way to retain a sufficient number of Privia Physicians in the market.

Even if we are able to identify an alternative partner or structure, we may also be subject to contractual prohibitions that could delay or limit our ability to retain Privia Physicians in such alternative structure.

Our standard agreements between our Medical Groups and our Privia Physicians do not generally prohibit Privia Physicians from competing with us after the term of the agreements.

Further, in our deals with certain Medical Groups where we have post-termination non-compete obligations and other restrictive covenants that prohibit our Privia Providers from working with a competitor of ours, there can be no assurance that such non-compete agreements, when asserted against a departing Privia Provider will be found enforceable if challenged.

This risk that the courts would not enforce non-compete restrictions that are beneficial to our operations is exacerbated by the FTC’s proposed rule that would ban noncompete clauses in employment contracts.

In such event, we could be unable to prevent such departing Privia Provider and other providers formerly affiliated with us from competing with us and/or our Medical Groups, potentially resulting in the loss of some of our patients, which could negatively affect our overall revenues and profits.

Further, as we move into new markets, our success in each market is dependent on our ability to recruit a sufficient number of Privia Providers to allow us to fully implement our operating model.

Our failure to do so may ultimately result in our inability to compete effectively in such market.

In addition, as we incur significant upfront time and costs in operating in a new market, including management time and attention, our failure to compete effectively in a new market could negatively affect our profits as well as our reputation within the larger physician community.

We are dependent on our relationships with Medical Groups, some of which we do not own, to furnish Privia Providers, to provide professional services to patients on behalf of federal health care programs as defined in 42 U.S.C.

§ 1320a-7(f), and commercial payers, and our business could be adversely affected by legal challenges to our business model.

Our operating model includes Owned Medical Groups, Non-Owned Medical Groups, MSOs that furnish management services on behalf of our Medical Groups and ACOs, a technology-enabled platform that overlays our Privia Providers’ EMR, and, in most markets, a separate legal entity that serves as an ACO under the MSSP as established by the Patient Protection and Affordable Care Act and a provider network vehicle for VBC, such as an independent physician association, or IPA, on behalf of our Medical Groups as well as, in certain markets, independent, non-Privia Providers.

Our ability to conduct business in each state is dependent upon that specific state’s treatment of each component of the Privia operating model under such state’s laws, regulations and policies governing the practice of medicine, physician fee splitting prohibitions, state restrictions on the use and disclosure of patient health information and other confidential information among the various components of our operating model, restrictions on the types of provider entities that can take financial risk or the types of financial risks that can be assumed by providers before triggering the state’s insurance laws requiring licensure from the state’s insurance department or agency.

The laws of many states, including states in which we currently operate, prohibit us from exercising control over the medical judgments or decisions of our Privia Physicians and from engaging in certain financial arrangements, such as splitting professional fees with Privia Providers or incentivizing certain types of utilization.

These laws and their interpretations vary from state to state, and are enforced by state courts and regulatory authorities, each with broad discretion.

We have relationships with Medical Groups in each of our markets which our Privia Providers join to furnish healthcare services as an integrated, single-TIN legal entity.

When permitted

under state law, these may be structured as Owned Medical Groups and we own a majority interest in all of our Owned Medical Groups but, even in such markets, we and our MSOs are still prohibited from controlling any aspect of the practice of medicine, including, without limitation, decisions regarding professional medical judgment, diagnosis and treatment of patients and supervisory responsibility for all licensed non-physician clinicians, unlicensed individuals to whom the physician delegates nondiscretionary duties and any other individual providing any service that could constitute the practice of medicine.

Our financial statements are consolidated in accordance with applicable accounting standards and include the accounts of our majority-owned subsidiaries.

Such consolidation for accounting and/or tax purposes does not, is not intended to, and should not be deemed to, imply or provide us any control over the medical or clinical affairs of such practices.

In other states, such as California, Texas, North Carolina and Tennessee, we are prohibited from having any ownership interest or governance control in our Medical Groups and these are structured as Non-Owned Medical Groups.

In such instances, (i) we generally appoint a Privia Physician licensed in the market to the governing board of such Non-Owned Medical Groups but we have little in the way of governance control of the Non-Owned Medical Groups other than through our MSAs;

or (ii) alternatively, in certain markets, we have certain licensed physicians with Privia leadership positions form professional entities to own the majority interest in Friendly Medical Groups.

If a jurisdiction’s prohibition on the corporate practice of medicine is interpreted in a manner that is inconsistent with our structure or operations, we could be required to restructure or terminate our arrangements with our Non-Owned Medical Groups and Friendly Medical Groups and could result in additional penalties, damages and fines.

We enter into agreements with our Medical Groups in our various markets and through which our Privia Providers furnish healthcare services on behalf of our Medical Groups.

In addition, we enter into contracts on behalf of our Medical Groups and ACOs with federal health care programs and commercial payers to deliver healthcare services in exchange for fees.

Such fees may be structured as FFS, VBC or both.

We also enter into exclusive MSAs with our Medical Groups pursuant to which the Medical Groups reserve exclusive control and responsibility for all aspects of the practice of medicine and the delivery of medical services.

Our Medical Groups also enter into services arrangements with our Privia Physicians’ Affiliated Practices to provide certain services to support our Privia Physicians at their historic practice locations.

Although we seek to substantially comply in all material respects with applicable state laws, including prohibitions on the corporate practice of medicine and fee splitting, state officials who administer these laws or other third parties may challenge our existing organization and contractual arrangements.

If such a claim were successful, we could be subject to civil and criminal penalties and could be required to restructure or terminate the applicable contractual arrangements.

A determination that these arrangements violate state statutes, or our inability to successfully restructure our relationships with our Medical Groups to comply with these statutes, could jeopardize our performance in federal health care programs and commercial payer arrangements, could result in a decrease in management fees under our MSAs, could slow our growth by making it harder to recruit Privia Physicians to join our Medical Groups, and could result in a renegotiation of our existing agreements with Privia Physicians, all of which could have a material adverse effect on our business, financial condition and the results of operations.

The transition from fee-for-service to value-based reimbursement models may have a material adverse effect on our operations.

The healthcare industry’s transition from fee-for-service to value-based reimbursement models, which can include risk-sharing, bundled payment and other innovative approaches provide us and our Medical Groups with opportunities to provide new or additional services and to participate in incentive-based payment arrangements.

There can be no assurance that such new models and approaches will be profitable to us or our Medical Groups, or that past performance under such VBC models will reflect future performance as the healthcare costs for these populations are not always under our control, depend upon the health acuity of such populations and subject to local practices and population demographics.

Further, new models and approaches may require investment by us to develop technology or expertise to offer necessary and appropriate solutions or support to our Medical Groups, and we do not fully know the amount and timing for return of such investment at this time.

In addition, some of these new models are being offered as pilot programs and there is no assurance that they will continue or be renewed.

Many states in which these new value-based structures are being developed also lack regulatory guidance or a well-developed body of law for these new models and approaches, or may not have updated their laws or enacted legislation yet to reflect such new healthcare models.

As a result, new and existing laws, regulations or guidance could have a material adverse effect on our operations and could subject us to the risk of restructuring or terminating our arrangements with our Medical Groups, as well as the risk of regulatory enforcement, penalties and sanctions, if state and federal enforcement agencies disagree with our interpretation of these laws.

Regulation of downstream risk-sharing arrangements, including, but not limited to, capitation and other value-based arrangements, varies significantly from state to state.

Some states require downstream entities and risk-bearing entities, or RBEs, to obtain an insurance license, a certificate of authority, or an equivalent authorization, in order to participate in downstream risk-sharing arrangements with payers.

In some states, statutes, regulations and/or formal guidance explicitly address whether and in what manner the state regulates the transfer of risk by a payer to a downstream entity.

However, the majority of states do not explicitly address the issue, and in such states, regulators may nonetheless interpret statutes and regulations to regulate such activity.

If downstream risk-sharing arrangements are not regulated directly in a particular state, the state regulatory agency may nonetheless require oversight by the licensed payer as the party to such a downstream risk-sharing arrangement.

Such oversight is accomplished via contract and may include the imposition of reserve requirements, as well as reporting obligations.

Further, state regulatory stances regarding downstream risk-sharing arrangements can change rapidly and codified provisions may not keep pace with evolving risk-sharing mechanisms and other new value-based reimbursement models.

Certain of the states where we currently operate, or may choose to operate in the future, and the Medicare Advantage program, regulate the operations and financial condition of risk bearing entities.

These regulations can include capital requirements, stop loss insurance, licensing or certification, governance controls and other similar matters.

While these regulations have not had a material impact on our business to date, as we continue to expand, these rules may require additional resources and capitalization, and add complexity to our operations.

The ACA also required CMS to establish the MSSP that promotes accountability and coordination of care through the creation of Accountable Care Organizations, or ACOs.

The MSSP allows for providers, physicians and other designated health care professionals and suppliers to form, and/or participate in, ACOs and voluntarily work together to invest in infrastructure and redesign delivery processes to give coordinated high quality care to their Medicare patients, avoid unnecessary duplication of services and prevent medical errors.

ACOs that achieve quality performance standards established by CMS are eligible to share in a portion of the Medicare program’s cost savings.

Our ACOs included physicians and advanced practitioners in California, Connecticut, Delaware, Florida, Georgia, Maryland, Montana, North Carolina, Tennessee, Texas, Virginia, and Washington, DC in 2023.

These ACOs participate in the MSSP, and are subject to ACO program methodologies and participation requirements that are updated by CMS for each performance year.

We and our Medical Groups as ACO participants are expected to comply with such program requirements and are required to report to CMS on performance after the close of each year.

Failure to comply with such program requirements could subject us and our Medical Groups to significant penalties and, in some cases, termination from participating in MSSP.

Additionally, the Center for Medicare and Medicaid Innovation (or more recently the CMS Innovation Center) continues to test an array of value-based alternative payment models, including the recent replacement of the Global and Professional Direct Contracting, or GPDC, Model with the ACO Reach program as of January 1, 2023, through which providers can negotiate directly with the government to manage traditional Medicare beneficiaries and share in the savings and risks generated from managing such beneficiaries.

Although we currently do not participate in all of these payment models, we may choose to do so in the future.

In addition, there likely will continue to be regulatory proposals directed at containing or lowering the cost of healthcare, as government healthcare programs and other third-party payers transition from fee-for-service, or FFS, to value-based reimbursement models, which can include risk-sharing, bundled payment and other innovative approaches.

It is possible that the federal or state governments will implement additional reductions, increases, or changes in reimbursement in the future under government programs that may adversely affect us or increase the cost of providing our services.

The implementation of cost containment measures or other healthcare reforms may prevent us from being able to generate revenue or attain growth, any of which could have a material adverse effect on our business.

Our operating model also seeks to structure each Medical Group with sufficient integration to allow such Medical Group to negotiate on behalf of its Privia Providers with both federal health care programs and commercial payers.

That is, from federal and state antitrust law perspectives, each Medical Group is structured to be a single entity, with a single-TIN, fully capable of establishing the prices for which it sells its products and services.

Our Privia Care Partners model, which offers a more flexible provider affiliation model than our historical Medical Groups, creates additional legal concerns especially under state and federal antitrust laws.

We believe we have structured these arrangements, often with the knowledge and support of payers, to either have significant clinical integration or share significant financial risk so as to allow for single signature contracting authority with payers.

Similarly, our operational ACOs, which all participate in the MSSP, have been structured in a manner that we believe that all participants in the ACO, including our Medical Groups, are substantially clinically integrated in accordance with the then current guidance from the Federal Trade Commission to allow our ACOs to negotiate payer contracts, including pricing terms, on behalf of our participating providers, including our Medical Groups.

Our ACOs and other network intermediaries, such entities typically participate in both the MSSP and commercial VBC arrangements.

We have not, however, requested a formal advisory opinion from the Federal Trade Commission or a business review from the Department of Justice Antitrust Division for either our Medical Groups, ACOs or other network relationships.

The Biden Administration appears committed to increasing antitrust enforcement and the scope of current antitrust laws as evidenced by Executive Order 14036 “Promoting Competition in the American Economy,” which, among other things, expresses concern about excessive market concentration in health care markets, including the insurance, hospital and prescription drug markets.

Given the current state of health care industry antitrust enforcement and the FTC and DOJ’s withdrawal of past joint policy statements, including the FTC and DOJ’s Statement of Antitrust Enforcement Policy Regarding Accountable Care Organizations.

Participating in the Medicare Shared Savings Program, the FTC or DOJ could challenge our ACO or other network activities as anticompetitive.

We have, however, adopted policies and practices intended to comply with the antitrust laws, including limiting the anti-competitive effect of our higher share of physician services within certain geographic markets.

A successful challenge of any of these components of our operating model could result in our restructuring our relationships with our Medical Groups and ACOs, and where such relationships cannot be successfully restructured could result in our inability to furnish services in certain markets.

Further, depending on the enforcement agency an antitrust violation can result in enforcement actions against us, our Medical Groups and/or ACOs ranging from a cease and desist demand, to criminal enforcement with the potential for treble damages.

Even a successful defense of an antitrust claim can be very expensive, may distract key management and impair our ability to recruit new physicians.

Any such action or outcome could damage our reputation, jeopardize our existing business arrangements, and could have a material adverse effect on our business, financial condition and the results of operations.

We are dependent on our EMR vendor, athenahealth, Inc., which the Privia Technology Solution is integrated and built upon, and which is utilized by most of our Owned and Non-Owned Medical Groups, and our business could be adversely affected if that relationship were disrupted.

The Privia Technology Solution is not currently usable with other EMRs, and to move our Privia Providers to another EMR provider we would have to duplicate our services on that platform, which could require considerable effort, time and expense.

While we have a positive working relationship with athenahealth, Inc., and while being one of their larger enterprise clients gives us priority access in resolving issues with the EMR and preferred pricing relative to going market rates, there is no assurance we will be able to maintain the relationship on positive terms.

In addition, our dependency on athenahealth, Inc.

creates significant risks related to service disruptions, potential cybersecurity incidents experienced by athenahealth, cessation of operations of athenahealth, Inc., or price leveraging by athenahealth, Inc.

A material change in our relationship with athenahealth, Inc., whether resulting from a dispute, a change in government regulation, or the loss of this relationship, could impair our ability to provide the same level of services to our Privia Providers for some period of time and could have a material adverse effect our business, financial condition and results of operations.

We have a history of net losses, we anticipate increasing expenses in the future, and we may not be able to maintain profitability.

We reported net income (loss) of $23.1 million, $(8.6) million, and $(188.2) million for the years ended December 31, 2023, 2022 and 2021, respectively.

Our accumulated deficit is $(193.6) million and $(216.7) million as of December 31, 2023 and 2022, respectively.

We expect our aggregate costs will increase substantially in the foreseeable future and we may experience losses as we expect to invest heavily in increasing and expanding our operations, hiring additional employees and operating as a public company.

These efforts may prove more expensive than we currently anticipate, and we may not succeed in increasing our revenue sufficiently to offset these higher expenses.

To date, we have financed our operations principally from revenue earned from our Medical Group’s billing and collection for healthcare services furnished by Privia Providers, revenues earned from VBCs with our ACOs, the incurrence of indebtedness and the sale of our equity.

We may not generate positive cash flow from operations or achieve profitability in any given period, and our limited operating history may make it difficult for you to evaluate our current business and our future prospects.

We have encountered and will continue to encounter risks and difficulties frequently experienced by growing companies in rapidly changing industries, including increasing expenses as we continue to grow our business.

We expect our operating expenses to increase significantly over the next several years as we continue to hire additional personnel, expand our operations and infrastructure, and continue to expand to reach more patients.

In addition to the expected costs to grow our business, we also expect to incur additional legal, accounting and other expenses as a newly public company.

These investments may be more costly than we expect, and if we do not achieve the benefits anticipated from these investments, or if the realization of these benefits is delayed, they may not result in increased revenue or growth in our business.

If our growth rate were to decline significantly or become negative, it could adversely affect our financial condition and results of operations.

If we are not able to achieve or maintain positive cash flow in the long term, we may require additional financing, which may not be available on favorable terms or at all and/or which could be dilutive to our stockholders.

If we are unable to successfully address these risks and challenges as we encounter them, our business, results of operations and financial condition could be adversely affected.

Our failure to achieve or maintain profitability could negatively impact the value of our common stock.

We and certain of our third-party vendors have experienced cyberattacks in the past and could experience security breaches, loss of data and other disruptions in the future which could compromise sensitive information related to our business or our patients, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, operations and our reputation.

In the ordinary course of our business, we collect, store, use and disclose sensitive information, which includes PHI, personal information, payment information, financial information, and other data that is subject to laws and regulations, including without limitation HIPAA, Payment Card Industry Data Security State (PCI DSS), and Sarbanes-Oxley Act (SOX), and other types of personal information, relating to our employees, our Privia Providers’ patients and others.

We also process and store, and use third-party service providers to process and store, sensitive information, including intellectual property, trade secrets, confidential information and other proprietary business information.

We manage and maintain such sensitive data and information utilizing a combination of third-party managed data centers, public cloud-based computing systems, and software-as-a-service (SaaS) providers.

We are highly dependent on information technology networks and systems, including the internet, to securely process, transmit and store this sensitive data and information.

Our information technology systems and those of our third-parties, strategic partners and other contractors or consultants are vulnerable to attack and damage or interruption from physical or electronic break-ins, computer viruses, and malware (e.g., ransomware), malicious code, natural disasters, terrorism, war, telecommunication, attacks by hackers, and employee or contractor error, negligence or malfeasance, denial or degradation of service attacks, sophisticated nation-state and nation-state-supported actors or unauthorized access or use by persons inside or outside our organization.

We utilize third-party service providers for important aspects of the collection, storage, processing and transmission of employee and patient information, and other confidential and sensitive information, and therefore rely on third parties to manage functions that have material cybersecurity risks.

Because of the sensitivity of the PHI, other personal and/or sensitive information we, our Medical Groups and their legacy practices collect, store, transmit, and otherwise process, the security of our technology-enabled platform and other aspects of our services, including those provided or facilitated by third-party service providers, are critical to our operations and business strategy.

We take certain administrative, physical and technological safeguards to address these risks, such as evaluating such service providers before granting access to PHI or other personal information, and by requiring contractors and other third-party service

providers who handle this PHI, other personal and/or sensitive information for us to enter into agreements that contractually obligate them to use reasonable efforts to safeguard such PHI, other personal and/or sensitive information.

Measures taken to protect our systems, those of our contractors or third-party service providers, or the PHI, other personal and/or sensitive information we or contractors or third-party service providers process or maintain, may not adequately protect us from the risks associated with the collection, storage, processing and transmission of such information.

We may be required to expend significant capital and other resources to protect against security breaches or to alleviate problems caused by security breaches.

Despite our implementation of security measures, cyberattacks are becoming more sophisticated and frequent across industries.

We experience cyberattacks and other security incidents of varying degrees from time to time, though none which individually or in the aggregate has led to costs or consequences which have materially impacted our operations or business.

It is reasonable to expect that ransomware activity will continue to target the healthcare and public health sectors, as it has in the past.

Ransomware attacks, including those from organized criminal threat actors, nation-states, and nation-state supported actors, are becoming increasingly prevalent and severe, and can lead to significant interruptions in our operations, loss of data and income, reputational loss, diversion of funds, and may result in fines, litigation and unwanted media attention.

Because of ongoing geopolitical dynamics around the world, more state-sponsored attacks on infrastructure directed towards United States infrastructure and targets, including health care organizations, may increase.

The significant increase in the number of 0-day vulnerabilities identified and exploited by threat actors prior to security patches being available could affect our or our vendors’ systems.

Moreover, hardware, software or applications we use may have inherent vulnerabilities or defects of design, manufacture or operations or could be inadvertently or intentionally implemented or used in a manner that could compromise information security.

There can be no assurance that we or our vendors and other third parties will not be subject to cybersecurity threats and incidents that bypass our or their security measures, impact the integrity, availability or privacy of personal health information or other data subject to privacy laws or disrupt our or their information systems, devices or business, including our ability to provide various health care services.

Further, consumer confidence in the integrity and security of personal information and critical operations data in the health care industry generally could be shaken to the extent there are successful cyberattacks at other health care services companies, which could have a material adverse effect on our business, financial position or results of operations.

We or our third-party service providers may be unable to anticipate these techniques or to implement adequate protective measures, especially as workforce members and vendors’ workforce continue to work remotely.

We may also experience security breaches that may remain undetected for an extended period.

Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers use of tools and techniques designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence.

A security breach or privacy violation that leads to disclosure or unauthorized use or modification of, or that prevents access to or otherwise impacts the confidentiality, security, or integrity of, any personal information, patient information, including PHI subject to HIPAA or any other sensitive information we or our contractors or third-party service providers maintain or otherwise process, could harm our reputation, compel us to comply with breach notification laws, cause us to incur significant costs for remediation, fines, penalties, notification to individuals and for measures intended to repair or replace systems or technology and to prevent future occurrences, potential increases in insurance premiums, and require us to verify the accuracy of database contents, resulting in increased costs or loss of revenue.

If we are unable to prevent or mitigate such security breaches or privacy violations or implement satisfactory remedial measures, or if it is perceived that we have been unable to do so, our operations could be disrupted, we may be unable to provide access to our systems, and we could suffer a loss of Privia Physicians and patients, and we may as a result suffer loss of reputation, adverse impacts on our Privia Providers, patients and investor confidence, financial loss, governmental investigations or other actions, regulatory or contractual penalties, and other claims and liability.

In addition, security breaches and other inappropriate access to, or acquisition or processing of, information can be difficult to detect, and any delay in identifying such incidents or in providing any notification of such incidents may lead to increased organizational harm.

Our service providers from time to time have experienced in the past and may experience in the future cyberattacks and security incidents.

While we do not believe that we have experienced any significant system failure, accident or security breach to date, if such an event were to occur, it could compromise our networks or data security processes and sensitive information could be made inaccessible or could be accessed by unauthorized parties, publicly disclosed, lost or stolen.

Any such interruption in access, improper access, disclosure or other loss of information could result in legal claims or proceedings, liability under laws and regulations that protect the privacy of patient information or other personal information, such as HIPAA, and regulatory penalties.

Unauthorized access, loss or dissemination could also disrupt our operations, including the ability of our Privia Providers to perform healthcare services, access patient health information, collect, process, and prepare company financial information, provide information about our current and future services and engage in other patient and clinician education and outreach efforts.

Any such breach could also result in the compromise of our trade secrets and other proprietary information, which could adversely affect our business and competitive position.

While we maintain insurance covering certain security and privacy damages and claim expenses, we may not carry insurance or maintain coverage sufficient to compensate for all liability and in any event, insurance coverage would not address the reputational damage that could result from a security incident.

Further, we maintain copies of our critical operational information, including our EMR data, in different geographic settings and the cloud, and we may not be able to access such copies in the event of a national emergency or widespread natural disaster.

Any such breach or interruption of our systems or those of any of our third-party service providers could have a material adverse effect on our business, results of operations, financial condition and cash flows.

Cybersecurity risks and incidents remain a focus for regulators.

The SEC finalized its cybersecurity rules, which went into effect on December 15, 2023 and require publicly listed companies to disclose particular information about material cybersecurity incidents in Form 8-K filings, including the material impact of the incident on a company’s financial condition and its operations.

Such disclosures are costly, require us and our third parties to update internal policies and procedures, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

In the event that the Company (or a third-party upon whom we rely) suffers a cybersecurity breach, or are perceived to have experienced a cybersecurity breach, we may experience adverse consequences, such as government enforcement actions, litigation, indemnification obligations, reputational harm, interruptions in our operations, financial loss;

and other similar harms.

Such mandatory disclosure of cybersecurity incidents may cause existing customers to stop using our services, deter new customers from using our services, and could adversely affect our business, reputation and competitive position.

Cybersecurity will continue to be a focus for the SEC and it is likely to seek opportunities to implement its authority under the cybersecurity rules in ways that may not be predictable given the recency of the rules and novel actions in this space.

Achieving success in VBC arrangements requires sharing sensitive personal information and PHI with multiple third-parties, covered entities, and different health care providers to allow care coordination and to reduce the total cost of care and improve patient outcomes.

Increased data sharing increases cybersecurity risk.

This dependency on digital technologies and the extensive data exchange inherent in VBC arrangements heighten our exposure to cybersecurity risks.

The nature of our VBC operations necessitates the handling of large volumes of sensitive personal and health information.

The healthcare industry, by virtue of its focus on VBC models, faces unique challenges that arise from the need to manage rising healthcare costs and improve outcomes through data-driven strategies.

In light of our strategy to transition more of our FFS revenue to VBC operations, the risk of cybersecurity breaches increases because of the number of covered entities, health care providers, and third parties that require data sharing to achieve successful outcomes in VBC arrangements.

A breach of any one of those parties could lead to unauthorized access, misuse, loss, or destruction of sensitive data, potentially impacting patient care, trust, and satisfaction.

It could also have legal, financial, and reputational consequences adversely affecting our financial condition and operating results.

The costs of complying with, or our failure to comply with, U.S.

and foreign laws related to privacy, data security and data protection could adversely affect our financial condition, operating results and reputation.

Due to the nature of our business, we are or may become subject to a variety of laws and regulations regarding privacy, data protection and data security.

For discussion of the various laws and regulations affecting our business, see “Item 1 – Business – Government Regulations” in Item 1 of this Annual Report on Form 10-K.

The scope and interpretation of these laws and additional laws that are or may be applicable to us are continuously evolving, often uncertain and may be conflicting.

All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time and may restrict the way services involving data are offered, all of which may adversely affect our results of operations and competitiveness.

Complying with these and similar laws and regulations may require us to make significant changes to our operations, which rely on the commitment of significant financial and managerial resources and effective planning and management processes.

We may be unable to implement required operational changes effectively, efficiently or in a timely manner, which could result in cost overruns, additional expenses, reputational harm, legal and regulatory actions and other adverse consequences.

Unauthorized disclosure or transfer of personal or otherwise sensitive data, whether through systems failure, employee negligence, fraud, misappropriation or other means, by us, our third-party vendors with whom we do business could subject us to significant litigation, monetary damages, regulatory enforcement actions, fines, criminal prosecution and other adverse consequences in one or more jurisdictions.

Such events could result in negative publicity and damage to our reputation, which could have a material adverse effect on our results of operations.

The healthcare industry is highly competitive.

We compete directly with national, regional and local providers of healthcare services for patients, physicians, non-physician clinicians and skilled employees.

There are many other companies and individuals currently providing healthcare services, including others with technology-enabled, nationally focused business models similar to ours.

Many of these competitors have been in business longer than us and/or have substantially more resources than we do.

Since there are virtually no substantial capital expenditures required for providing healthcare services, there are few financial barriers to entry in the healthcare industry.

Other companies could enter the healthcare industry in the future and divert some or all of our business.

We compete with different companies across certain lines of business, including companies with:

dedicated brick-and-mortar locations which often target patients covered by Medicare Advantage plans, dedicated direct primary care locations which often target a commercial or employer-based patient population, the ability to organize providers into accountable care organizations and other contractual intermediary entities allowing physicians to participate in VBC arrangements, and the ability to partner with physicians groups to enable better care delivery primarily for seniors.

Our indirect competitors also include episodic point solutions, such as telemedicine offerings, as well as urgent care providers and other providers.

We expect to face increasing competition, both from current competitors, who may be well established and enjoy greater resources or other strategic advantages to compete for some or all key stakeholders in our markets, as well as new entrants into our market.

Our ability to compete successfully varies from location to location and depends on a number of factors, including the number of competing medical practices in the local market and the types of services available at those facilities, our local reputation for quality

care of patients, the commitment and expertise of our Privia Physicians, our ability to obtain competitive reimbursement rates with commercial payers, our local service offerings and the success of physician sales efforts, the cost of care in each locality, and the physical appearance, location, age and condition of the various locations at which our Privia Physicians furnish patient care services.

If we are unable to attract patients to our Medical Groups, our revenue and profitability will be adversely affected.

Some of our competitors may have greater recognition and be more established in their respective communities than we are, and may have greater financial and other resources than we have.

Competing medical practices may also offer larger facilities or different programs or services than we do including through complementary services, which, combined with the foregoing factors, may result in our competitors being more attractive to our current patients, potential patients and referral sources.

Furthermore, while we budget for routine capital expenditures to stay competitive in our respective markets, to the extent that competitive forces cause those expenditures to increase in the future, our financial condition may be negatively affected.

In addition, our relationships with federal health care programs and commercial payers are not exclusive, and our competitors have established or could seek to establish relationships with such payers to serve their covered patients.

Additionally, as we expand into new geographical markets, we may encounter competitors with stronger relationships or recognition in the community in such new geography, which could give those competitors an advantage in obtaining physicians and new patients.

Our Privia Providers, Non-Owned Medical Groups and companies in other healthcare industry segments, including those with which we have contracts, and some of which have greater financial, marketing and staffing resources, may become competitors in providing healthcare services, and this competition may have a material adverse effect on our business operations and financial position.

Each of our revenue streams ultimately depends on reimbursements by third-party payers, as well as payments by individuals, which could lead to delays and uncertainties in the reimbursement process, and periodic changes to our reimbursement rates.

The reimbursement process is complex and can involve lengthy delays.

Although we recognize FFS revenue for our Owned Medical Groups when their associated Privia Providers approve the claims for providing services to patients, we may from time to time experience delays in receiving the associated reimbursement and, with respect to VBC arrangements, ultimate payment of any shared savings, bonuses, withholds and similar payments is received only after the close of the relevant measure period, which may be a calendar year, and then only after the payer has reconciled cost of care, FFS reimbursement paid, if any, reported quality data, and patient attribution resulting in significant delays between the provision of services and ultimate payment.

In addition, third-party payers may disallow, in whole or in part, requests for reimbursement based on determinations that the patient is not eligible for coverage, certain amounts are not reimbursable under plan coverage or were for services provided that were not medically necessary, not adequately documented or after submitting additional supporting documentation requested by the payer.

Retroactive adjustments may change amounts realized and recognized as revenue from third-party payers.

We are subject to audits by such payers, including governmental audits of our Medicare claims, and may be required to repay these payers if a finding is made that we were incorrectly reimbursed.

Delays and uncertainties in the reimbursement process may adversely affect accounts receivable, increase the overall costs of collection and cause us to incur additional borrowing costs.

Third-party payers are also increasingly focused on controlling healthcare costs, and such efforts, including any revisions to coverage and reimbursement policies, which may further complicate and delay our reimbursement of claims.

In addition, certain of our patients are covered under health plans that require the patient to cover a portion of their own healthcare expenses through the payment of copayments or deductibles.

We may not be able to collect the full amounts due with respect to these payments that are the patient’s financial responsibility, or in those instances where our Privia Physicians provide services to uninsured individuals or individuals for which the physician is out of network.

To the extent permitted by law, amounts not covered by third-party payers are the obligations of individual patients for which we may not receive whole or partial payment.

Any increase in cost shifting from third-party payers to individual patients, including as a result of high deductible plans for patients, increases our collection costs and reduces overall collections.

As more of our Medical Groups’ revenue derive from VBC, our failure to adequately predict and control our Medical Groups’ costs and expenses, and to make reasonable estimates and maintain adequate accruals for incurred but not reported claims, could have a material adverse effect on our business, results of operations, financial condition and cash flows.

To the extent that our Medical Groups’ patients require more care than anticipated or our medical costs and expenses exceed estimates, reimbursement paid under our VBC arrangements may be insufficient to cover costs.

In any given situation, this may negatively impact both our revenue from Medical Groups and our revenue from the management services furnished to our Non-Owned Groups.

Although we can mitigate some of this risk on a case-by case basis with stop loss coverage, we generally have little ability to increase our charges during the terms of our VBC arrangements and we may have minimal ability to control our Medical Groups’ patients’ decisions that may increase the total cost of care.

If we are unable to effectively adapt to changes in the healthcare industry, including changes to laws and regulations regarding or affecting the U.S.

healthcare industry, our business, financial condition and results of operations may be adversely affected.

The impact on us of any new healthcare legislation and other changes in the healthcare industry and in healthcare spending is currently unknown, but may adversely affect our business, financial condition and results of operations.

Our revenue is dependent on the healthcare industry and could be affected by changes in healthcare spending, reimbursement and policy.

The healthcare industry is subject to ongoing changing political, regulatory and other influences.

By way of example, the ACA, which was enacted in 2010, made major changes in how healthcare is delivered and reimbursed, and it increased access to health insurance benefits to the

uninsured and underinsured populations of the United States.

We embrace many of the goals of the ACA, including our current ACOs actively participating in the MSSP, which have resulted in shared savings under the MSSP in excess of $510 million since we started participating in the program in 2014.

Since its enactment, there have been judicial, executive, Congressional and political challenges to certain aspects of the ACA and there are indications that such challenges may continue.

Although the Biden administration has undertaken a number of initiatives in support of the ACA, including expanding enrollment, the current political climate ensures that the ACA will continue to be a political focal point and, as such, volatility could negatively impact our financial performance as well as the financial performance of our Medical Groups.

Our operating model, the Privia Technology Solution and our revenue are dependent on the healthcare industry’s continued movement towards providers assuming more risk from payers for the cost of patient care.

Any legislative, regulatory or industry changes that slows or limits that movement or otherwise reduces the non-facility-based healthcare spending could most likely be detrimental to our business, revenue, financial projections and growth.

VBC arrangements typically require providers to achieve certain quality indicators either as a gating prerequisite to realizing value-based revenue enhancements or as a positive or negative multiplier related to such payments, including, for example, the MSSP.

Periodic changes to the quality metrics that our Privia Providers are required to report, either as to the included metric, how the metric is measured or the necessary thresholds for satisfying the metric, could adversely impact our revenue relative to such VBC arrangements.

We are also impacted by the Medicare Access and CHIP Reauthorization Act, under which physicians must choose to participate in one of two Quality Payment Program (“QPP”) payment methodologies or “tracks” designed to reward physicians for delivering high-quality patient care:

the Merit-Based Incentive Payment System, or MIPS;

or participation in an Advanced Alternative Payment Model, or Advanced APM.

CMS expects to transition increasing financial risk to providers as the QPP evolves.

The Advanced APM track makes incentive payments available for participation in specific innovative payment models approved by CMS.

Providers may earn up to 3.5% Medicare incentive payment through 2025.

The Medicare Physician Fee Schedule final rule for calendar year 2004 included a number of changes impacting physicians such as retention of the 75% MIPS performance threshold, changes in reporting for Alternative Payment Models (APMs) and ACOs, and expansion of MIPS Value Pathways (MVPs).

Payments from such federal health care programs are subject to periodic statutory changes, annual regulatory changes, administrative rulings, interpretations and determinations, requirements for utilization review and federal and state funding restrictions, each of which could increase or decrease program payments, as well as affect the cost of providing service to patients and the timing of payments to our Medical Groups, and our ACOs.

We are unable to predict the effect of recent and future policy changes on our operations.

In addition, the uncertainty and fiscal pressures placed upon federal health care programs as a result of, among other things, deterioration in general economic conditions, reduced tax revenue and the funding requirements, may affect the availability of taxpayer funds for such federal health care programs.

Current and prior healthcare reform proposals have included the concept of creating a single payer or public option for health insurance.

If enacted, these proposals could have an extensive impact on the healthcare industry, including us.

We are unable to predict whether such reforms may be enacted or their impact on our operations.

Changes in federal health care programs may reduce the reimbursement we receive and could adversely impact our business and results of operations.

As healthcare costs continue to increase, and federal and state governments continue to face budgetary shortfalls, federal and state governments have made, and may continue to make, significant changes in the Medicare and Medicaid programs.

These changes could include reductions in reimbursement levels and new or modified demonstration projects authorized pursuant to Medicaid waivers.

Some of these changes have decreased, or could decrease, the amount of money our Medical Groups receive for furnishing patient care services relating to these programs.

In some cases, private third-party payers rely on all or portions of Medicare payment systems to determine payment rates.

Changes to federal health care programs that reduce payments under these programs may negatively impact the payments our Medical Groups receive from private third-party payers.

We expect that additional state and federal healthcare reform measures will be adopted in the future, any of which could limit the amounts that federal and state governments and commercial payers will pay for healthcare services, which could harm our business, financial condition and results of operations.

If reimbursement rates paid by third-party payers are reduced or if commercial payers otherwise restrain our ability to provide services to their enrollees through narrow network products or otherwise, our business could be harmed.

Our typical agreements with commercial payers only secure agreed reimbursement rates for a relatively short period of time, generally for a period of one to three years.

Likewise, at this time, all of our existing commercial payer contracts are local or regional contracts as opposed to national contracts.

If any commercial payers reduce their reimbursement rates, elect not to cover some or all of our Medical Group’s healthcare services, or restrain our Privia Providers’ ability to furnish services to their patients through the use of tiered pricing or a narrow network offering, our business may be harmed.

If such events were to occur, not only is revenue to our Medical Groups reduced, which in turn reduces our management fees, but if our commercial payer contracts are not competitive in a given market or we are unable to obtain a contract with certain commercial payers, we limit our ability to recruit new Privia Physicians and may not be able to achieve our growth expectations.

Additionally, as our payers’ businesses respond to market dynamics and financial pressures, and as our payers make strategic business decisions in respect of the lines of business they pursue and programs in which they participate, certain of our payers have sought in the future payers may, seek to renegotiate their contracts with us.

These negotiations could result in reductions to the economic terms, changes to the scope of services contemplated by our

existing payer contracts, or termination of certain payer contracts.

If a payer does terminate or elects not to renew its relationship with us, our ability to retain patients associated with that payer is limited and consequently could have a material adverse effect on our business, results of operations, financial condition and cash flows.

Commercial payers often use plan structures, such as narrow networks or tiered networks, to encourage or require members to use in-network providers.

In-network providers typically provide services through commercial payers for a negotiated lower rate or other less favorable terms and achieve their margins by increased volume of services.

Commercial payers generally attempt to limit the use of out-of-network providers by requiring members to pay higher copayment and/or deductible amounts for out-of-network care.

Additionally, commercial payers have become increasingly aggressive in attempting to minimize the use of out-of-network providers by disregarding the assignment of payment from their enrollees to out-of-network providers (i.e., sending payments directly to members instead of to out-of-network providers), capping out-of-network benefits payable to members, waiving out-of-pocket payment amounts and initiating litigation against out-of-network providers for interference with contractual relationships, insurance fraud and violation of state licensing and consumer protection laws.

If we become out-of-network for insurers, our business could be harmed and our patient service revenue could be reduced because members could stop using our services.

Further, many states have laws and regulations that prevent providers from waiving patient out of pocket amounts, including out of network charges, when such providers submit their full charges to commercial payers.

In December 2020, in connection with the enactment of the Consolidated Appropriations Act of 2021, the No Surprises Act introduced national limitations on billing for certain services furnished by providers who are not in-network with the patient’s self-insured health plan, individual or group health plan.

The Departments of Health and Human Services, Labor and Treasury have issued a number of final rules implementing the No Surprises Act.

The provisions of these rules seek to limit excessive patient out-of-pocket amounts by limiting cost sharing for out-of-network services to in-network levels, requiring cost sharing for out-of-network payments to offset in-network deductibles, setting out-of-pocket maximums, requiring disclosure of patient protections against balance billing, and prohibiting balance billing under certain circumstances.

These rules also establish the independent dispute resolution process that providers, facilities or providers of air ambulance services, and health plans or issuers will use to determine final payment beyond allowable patient cost-sharing for certain out-of-network healthcare services and require that certain providers and facilities provide a good faith estimate of the charges to uninsured (or self-pay) individuals so they can know what costs to expect when seeking healthcare.

In October 2023, the Departments issued proposed rules that proposed new processes and policies for independent dispute resolution process.

The agencies have continued to issue guidance regarding the implementation of the No Surprises Act, and the agencies’ interpretations of law’s requirements have continued to evolve.

It is currently unclear how the No Surprise Act will impact our revenue, bad debt, and the competitive advantages of our Medical Groups being in network status across markets.

Compliance continues to require additional training and the build-out of additional safeguards to comport our Medical Groups’ billing and collection practices with the new requirements of these rules.

The Medicare program restructures its reimbursement rates and policies on an annual basis.

The final Medicare Physician Fee Schedule payment update for calendar year 2024, cut the Medicare conversion factor for physicians by 3.4%.

In December 2023, bipartisan legislation entitled, the Preserving Seniors' Access to Physicians Act of 2023, was introduced to reverse Medicare physician payment cuts but, at this point, it is unclear whether the bill will become law.

Additionally, CMS has made significant changes to the structure of the its Hierarchical Condition Categories (HCC) codes, Version 28 (V28), which will likely result in lower Risk Adjustment Factor (RAF) scores in 2024 for our Medical Groups entering into new Medicare Advantage agreements.

We are unable to predict the effect of recent and future policy changes on our operations.

Reimbursement uncertainty also impacts our VBC revenue.

In addition to potential changes to the terms of our existing VBC arrangements by the payers, our VBC revenue is also at risk based upon annual fluctuations in payment rates for certain VBC arrangements such as Medicare Advantage payment rates, changes in patient attribution, and changes in plan design by payers.

Likewise, delay in information from payers may prevent our Medical Groups from being able to make any necessary changes to mitigate any quality concerns, attribution changes or total cost of care.

Additionally, CMS’ risk adjustment payment system for health plans participating in Medicare Advantage can have a significant impact on payments our Medical Groups receive for from our contracted Medicare Advantage payers.

Although we and our payers, have implemented auditing and monitoring processes to collect and provide accurate risk adjustment date to CMS such programs may be not be sufficient to ensure the accuracy of such data.

CMS may also change the way they measure risk and the impact of such changes on our business are uncertain.

There are significant risks associated with estimating the amount of revenues that we recognize under certain of our VBC arrangements with payers, and if our estimates of revenues are materially inaccurate, it could impact the timing and the amount of our revenue recognition or have a material adverse effect on our business, results of operations, financial condition and cash flows.

There are significant risks associated with estimating the amount of revenues that we recognize under our VBC arrangements with payers in a reporting period.

The billing and collection process is complex due to ongoing insurance coverage changes, geographic coverage differences, differing interpretations of contract coverage and other payer issues, such as ensuring appropriate documentation.

Determining applicable primary and secondary coverage for our patients, together with the changes in patient coverage that occur each month, requires complex, resource-intensive processes.

Errors in determining the correct coordination of

benefits may result in refunds to payers.

Revenues associated with Medicare and Medicaid programs are also subject to estimating risk related to the amounts not paid by the primary government payer that will ultimately be collectible from other government programs paying secondary coverage, the patient’s commercial health plan secondary coverage or the patient.

Collections, refunds and payer retractions typically continue to occur for up to three years and longer after our Medical Groups’ services are provided.

If our estimates of revenues are materially inaccurate, it could impact the timing and the amount of our revenues recognition and have a material adverse effect on our business, results of operations, financial condition and cash flows.

Changes in the payer mix of patients and potential decreases in our reimbursement rates as a result of consolidation among commercial payers could adversely affect our revenues and results of operation.

The amounts our Medical Groups receive for patient care services furnished to patients are determined by a number of factors, including the payer mix of our Privia Physicians’ patients and the reimbursement methodologies and rates utilized by our patients’ health insurance company.

Reimbursement rates are generally higher for VBC than they are under traditional FFS arrangements, and VBC provides us with an opportunity to capture any additional surplus we create by investing in population health services to better manage a particular patient’s care, which, in turn, should reduce the total cost of care.

Under certain VBC arrangements, either our management service organizations or our ACOs may receive specific care management fees, administrative fees or other fees to cover such population health and care management services, which may be structured as a fixed fee per member per month, or PMPM, for such services.

Any change in payer mix, which could result from payer restrictions on such narrow network products or economic downturn resulting in more uninsured patients or patients insured by state Medicaid programs, could adversely affect the overall reimbursement our Medical Groups receive from commercial payers.

Further, changes in payer mix, may adversely impact our ability to recruit new physicians to affiliate with our Medical Groups, which could adversely affect our growth strategy and financial projections.

The healthcare industry has also experienced a trend of consolidation across market segments, including the consolidation of commercial payers resulting in larger payers that have significant bargaining power, given their market share.

Payments from commercial payers are the result of negotiated rates.

These rates may decline based on renegotiations with larger payers resulting in higher discounted fee arrangements with healthcare providers.

As a result, payers increasingly are demanding discounted fee structures or the assumption by healthcare providers of all or a portion of the financial risk related to the total cost of care of their enrollees.

Reductions in the quality of services furnished by our Medical Groups or our ACO participants could have a material adverse effect on our business, results of operations, financial condition and cash flows.

We monitor and manage quality metrics, including star rating for Medicare Advantage plans and MSSP quality metrics, and submit quality data on behalf of our Medical Groups, as well as our ACO participants.

A failure to achieve threshold standards for quality metrics could result in the loss of any shared savings or other bonuses, or result in a reduction of such payments under VBC arrangements.

Further, under the Medicare Advantage plans’ star rating system, lower star ratings correspond to lower quality ratings, and ultimately, lower payments to participating providers under the Quality Bonus Program.

Further, with the implementation of MIPS and APMs, lower quality scores ultimately result in upward or downward adjustments to Privia Physicians’ Medicare Part B FFS payments.

Further, lower quality ratings can potentially lead to the termination of an affiliate physician’s ability to participate in a particular commercial payer product or result in our Medical Groups not being able to participate in a particular VBC arrangement, tiered network or narrow network offering.

All of these possible outcomes could have a material adverse effect on our business, results of operations, financial condition and cash flows.

If we are not able to maintain and enhance our reputation and brand recognition, including through the maintenance and protection of trademarks, our business and results of operations will be harmed.

We believe that maintaining and enhancing our reputation and brand recognition is critical to our relationships with Medical Groups, Privia Providers, patients, ACO participants, and commercial payers, and to our ability to attract new Medical Groups, Privia Physicians and patients.

The promotion of our brand may require us to make substantial investments and we anticipate that, as our market becomes increasingly competitive, these marketing initiatives may become increasingly difficult and expensive.

Our marketing activities may not be successful or yield increased revenue, and to the extent that these activities yield increased revenue, the increased revenue may not offset the expenses we incur and our results of operations could be harmed.

In addition, any factor that diminishes our reputation or that of our management, including failing to meet the expectations of our Medical Groups, Privia Physicians, ACO participants, health system or hospital partners, patients, or commercial payer customers, or any adverse publicity or litigation involving or surrounding us, one of our Medical Groups, or our management, could make it substantially more difficult for us to attract new Privia Physicians.

Similarly, because our existing Medical Groups often act as references for us with prospective Privia Physicians or new Medical Groups, any reputational concerns could impair our ability to secure additional new Privia Physicians and Medical Groups.

In addition, negative publicity resulting from any adverse government payer audit could injure our reputation.

If we do not successfully maintain and enhance our reputation and brand recognition, our business may not grow and we could lose our relationships with Privia Physicians, Medical Groups, ACO participants, health system or hospital partners, patients, or commercial payer customers, which could harm our business, results of operations and financial condition.

The registered or unregistered trademarks or trade names that we own or license may be challenged, infringed, circumvented, declared generic, lapsed or determined to be infringing on or dilutive of other marks.

We may not be able to protect our rights in these trademarks and trade names, which we need in order to build name recognition with patients, payers and other partners.

In addition, third parties may in the future file for registration of trademarks similar or identical to our trademarks.

If they succeed in registering or developing common law rights in such trademarks, and if we are not successful in challenging such third-party rights, we may not be able to use these trademarks to commercialize our technologies in certain relevant jurisdictions.

If we are unable to establish name recognition based on our trademarks and trade names, we may not be able to compete effectively and our brand recognition, reputation and results of operations may be adversely affected.

Our business model relies on a complex legal framework that governs our relationships with Medical Groups and Privia Providers.

Legal challenges or shifting interpretations of applicable laws could require us to make significant changes to our operations, which could adversely affect our business.

The structure of our business model is driven by nuanced legal concepts, some of which are subject to varying interpretations.

Although we and our Medical Groups strive to comply with applicable federal and state laws and regulations, governmental authorities that administer these laws or other third parties may challenge our current structure.

At the state level, our ability to conduct business and the structure of our operations depends on each state’s laws, regulations, and policies governing, among other issues, the corporate practice of medicine, fee-splitting, and the assumption of financial risk.

In several states, laws and regulations, guidance from professional licensing boards or state attorneys general and judicial doctrines prohibit corporations and other entities not owned by physicians or other permitted health professionals from practicing medicine and other professions.

These laws and doctrines have been interpreted in some states to prohibit entities not owned by permitted professionals from employing physicians and other professionals and to prohibit such entities from undertaking activities that could be seen as exercising control over healthcare provider professional judgment.

Some states also have adopted restrictions on direct or indirect payments to, or entering into fee-splitting arrangements with, physicians and unlicensed persons or business entities.

These restrictions vary by state and are often vague and subject to interpretation by state medical boards, state attorneys general and other regulatory authorities.

We attempt to structure our arrangements with healthcare providers to comply with applicable state law.

However, we cannot provide assurance that governmental officials responsible for enforcing these laws will not assert that we, or transactions in which we are involved, violate these laws.

These laws may also be interpreted by courts in a manner inconsistent with our interpretations.

Possible sanctions for violations of these restrictions include loss of a physician’s license and civil and criminal penalties.

In addition, agreements between the Company and physicians may be considered void and unenforceable, our MSAs and management fees could be adversely affected, and we may be required to restructure the Company’s relationships with Medical Groups and Privia Physicians, any of which could have a material adverse effect on our business, financial condition and results of operations.

The structure of our business also is impacted by federal law.

In particular, we seek to structure each Medical Group to comply with applicable Stark Law exceptions.

We periodically review our Medical Groups and their relationships with Privia Physicians to ensure continued compliance and that the regulatory safeguards in various agreements are implemented appropriately.

Despite our efforts, it is possible that governmental authorities may conclude that our business practices do not comply with the Stark Law and its implementing regulations, which could result in sanctions such as denial of payment, civil monetary penalties, and exclusion from federal healthcare programs.

Further, we could be subject to significant repayment obligations, as the Stark Law requires entities to refund amounts received for items or services provided pursuant to a prohibited referral.

Failure to timely repay such amounts may constitute a false or fraudulent claim and could result in civil penalties and additional penalties under the FCA.

If we or the Medical Groups are found to be in violation of the Stark Law or any other federal or state law affecting our business model or practices, we could be required to discontinue part of our current business or change our business structure, operations, or relationships with third-parties, such as Privia Providers, health system partners or payers, which may require us to incur significant costs.

Any such changes could also negatively affect our business relationships, new business opportunities, and growth plans.

In addition, our failure to accurately anticipate the application of various federal and state laws to our business or otherwise comply with legal requirements could result in significant legal expenses, divert management’s attention from the operation of our business, and result in adverse publicity, any of which could have a material adverse effect on our business.

Our business, financial condition and results of operations may be adversely affected by changes and uncertainty in the healthcare industry, including health reform initiatives and other changes to laws and regulations.

The healthcare industry is subject to changing political, regulatory and other influences, along with various scientific and technological initiatives and innovations.

Regulatory uncertainty has increased as a result of decisions issued by the U.S.

Supreme Court in June 2024 that affect review of federal agency actions, including Loper Bright Enterprises v.

These decisions increase judicial scrutiny of agency authority, shift greater responsibility for statutory interpretation to courts and expand the timeline in which a plaintiff can sue regulators, all of which could have significant impacts on government agency regulation, particularly within the heavily-regulated healthcare industry, and may have broad implications for our business.

While the effects of these decisions will become apparent over the coming months and years, we anticipate an increase in legal challenges to healthcare regulations and agency guidance and decisions, including but not limited to those issued by HHS and certain of its agencies, such as the CMS, FDA, and OIG.

Federal agencies oversee, regulate and otherwise affect many aspects of our business, including through Medicare and Medicaid payment and coverage policies, policies affecting size of the uninsured population, administration of state Medicaid programs, and enforcement and interpretation of fraud and abuse laws.

In addition to increased uncertainty and potential changes to regulations and agency guidance as a result of legal challenges, the recent U.S.

Supreme Court decisions may result in inconsistent judicial interpretations and delays in and other impacts to the agency rulemaking and legislative processes, among other effects, any of which could require us to make changes to our operations and have a material negative impact on our business.

The healthcare industry has been and continues to be impacted by healthcare reform efforts.

For example, the Affordable Care Act affects how healthcare services are covered, delivered and reimbursed and expanded health insurance coverage through a combination of public program expansion and private sector health insurance reforms.

Changes in the law’s implementation, subsequent legislation and regulations, state initiatives and other factors, including potential changes to or repeal of the Affordable Care Act as a result of changes in the political landscape, have and may continue to affect the number of individuals that elect to obtain public or private health insurance or the scope of such coverage.

Reductions in the number of insured individuals or the scope of insurance coverage may have an adverse effect on our business.

In addition, Medicare and Medicaid policies are subject to change, including as a result of changes in the presidential administration and Congress.

Legislation and administrative actions at the federal level may impact funding for, or the structure of, the Medicaid or Medicare program, and may shape administration of the Medicaid program at the state level and Medicare Advantage Programs.

Other recent health reform initiatives and proposals at the federal and state levels include those focused on price transparency and out-of-network charges as well as pharmacy and pharmacy benefit manager reform efforts, which may impact prices, the relationships between hospitals, patients, payers, and providers, total cost of care and patient outcomes, and lead to further uncertainty in other participants in the healthcare industry, including employers.

Other industry participants, such as private payers and large employer groups and their affiliates, may also introduce financial or delivery system reforms.

In addition, payment policies for different types of providers and for various items and services continue to evolve, and it is difficult to predict the nature and effect of such changes.

VBC arrangements often require providers to satisfy and report certain quality measures as a prerequisite to realizing value-based revenue enhancements or use quality metrics to calculate increases to or reductions in payments.

Developments that slow or limit the healthcare industry’s use of VBC arrangements, or changes in the quality metrics that providers are required to report, required thresholds, or measurement methodologies, could reduce our revenues and adversely affect our business and results of operations.

There is uncertainty regarding whether, when, and what other health reform initiatives will be adopted through governmental avenues and/or the private sector, the timing and implementation of any such efforts, and the impact of those efforts on providers as well as other healthcare industry participants.

It is difficult to predict the nature and/or success of current and future health reform initiatives, any of which may have an adverse effect on our business, financial condition, results of operations, cash flow, capital resources and liquidity.

We, our Medical Groups and Privia Providers, may be subject to legal proceedings, including litigation, governmental investigations and claims, and payer audits.

The Company and its Medical Groups have been and may become subject to various legal and governmental proceedings.

The Company, its Medical Groups and Privia Providers may face allegations and claims related to various topics, including billing and coding for healthcare services and other reimbursement issues, malpractice, data privacy and security, labor and employment, consumer protection, intellectual property infringement, misappropriation and other issues related to our acquisitions, securities issuances or business practices.

These matters may include claims for substantial or indeterminate amounts of damages and claims for injunctive relief.

If an unfavorable outcome occurs in connection with any current or future legal proceedings or other loss contingencies, we and our Medical Groups may be subject to significant settlement costs or judgments, penalties, and/or requirements to modify or limit our operations or services, any of which could negatively impact our business, operations, and growth strategy.

Managing legal proceedings, even if the outcomes are favorable, can be time- and resource-consuming, be disruptive to normal business operations, divert management’s attention from the business and result in adverse publicity and reputational harm.

Healthcare companies, in particular, are subject to various reviews, investigations and audits by governmental authorities to verify compliance with applicable laws, regulations, and Medicare and Medicaid program requirements.

Both federal and state governmental agencies have heightened civil and criminal enforcement efforts in recent years and expanded collaborative program integrity

These efforts have led to a number of investigations, prosecutions, convictions and settlements in our industry in general, including under federal civil and criminal false claims laws.

Further, under the FCA and some similar state laws, private parties may bring whistleblower lawsuits against companies that allegedly submit false claims for payments to, or improperly retain overpayments from, the government.

Government agencies, including the OIG, CMS and their agents, such as Medicare administrative contractors (“MACs”), may conduct audits of our and our Medical Groups’ operations.

CMS and state Medicaid agencies contract with recovery audit contractors (“RACs”) and other contractors to conduct post-payment reviews to detect and correct improper payments in the Medicare program, including Medicare Advantage, and the Medicaid programs.

Other third-party payers may conduct similar audits.

In addition, we and our Medical Groups perform internal audits and monitoring.

Depending on the nature of the conduct found in audits and investigations and whether the underlying conduct could, for example, be considered systemic, knowing or intentional, their resolution could have a material, adverse effect on our operations and financial position.

Further, negative audit findings or determinations that our or our Medical Groups’ operations violate applicable laws and regulations may result in repayment obligations or recoupment of previously paid claims, payment suspension or the revocation of billing or payment privileges, corporate integrity agreements, and civil and criminal penalties, including significant fines and damages and other sanctions, such as exclusion from governmental healthcare programs, any of which could have an adverse effect on our business, operations, and financial condition.

Although the Company, our Medical Groups and/or Privia Providers maintain third-party professional liability insurance coverage, claims against us could exceed the coverage limits of our insurance policies or particular claims could be excluded from coverage.

Professional liability claims in excess of applicable insurance coverage could have a material adverse effect on our business, financial condition and results of operations.

In addition, any professional liability claim brought against us, our Medical Groups or Privia Providers, with or without merit, could result in an increase of professional liability insurance premiums.

Insurance coverage varies in cost and can be difficult to obtain, and we cannot guarantee that we, our Medical Groups or Privia Providers will be able to obtain insurance coverage in the future on terms acceptable to us or at all.

If our costs related to insurance and claims increase, our business and financial condition could be adversely affected.

Risks Related to our Business and Operations

Risks associated with VBC arrangements may negatively impact our business, operations, and financial condition.

A significant portion of our business is derived from VBC arrangements for healthcare services, including MSSP and Medicare Advantage.

Generally, VBC contracts tie incentive payments to specific targets for risk adjusted total cost of care, quality related process and outcome measures, and beneficiary experience of care.

The VBC revenues of the Company and its Medical Groups are subject to risks including managing established targets relative to utilization by patients, unit cost and the mix of healthcare services, annual fluctuations in payment terms for certain VBC arrangements, such as Medicare Advantage payment rates, changes in patient attribution, and changes in plan design and other terms by payers.

CMS has developed several alternative payment models (“APM”s) that use VBC contract structure to incentivize cost-efficient and high-quality care for Medicare beneficiaries, including ACOs and bundled payment models.

There are also state-driven and third-party payer VBC initiatives.

For example, some states have implemented APMs or aligned quality metrics across payers.

Some private third-party payers are also transitioning toward APMs or implementing other VBC strategies.

For example, many large private third-party payers, such as managed care plans, currently require physicians to report quality data.

While participation in such APMs, including ACOs, has historically been voluntary, CMS and certain other payers have indicated that participation in future programs may be required, and any changes to or elimination of VBC arrangements by CMS or other payers (including, for example, to prospective trend targets or the requirements for participation) could have a material adverse effect on our business, results of operations, financial condition and cash flows.

Regulation of risk-sharing arrangements, including certain VBC arrangements, varies significantly by state.

If a state in which we currently operate, or in which we seek to expand, views the participation of the Company or its Medical Groups in risk-sharing arrangements as the assumption of insurance risk, the arrangement may fall within the purview of state insurance or managed care laws and regulations, and we or the Medical Group may be required to obtain a state insurance or managed care license or similar registration.

These laws and regulations may subject the entity involved to oversight by state regulators, including through periodic reporting or audits, and requirements for financial reserves.

Some of these laws may be vague and state regulators may have interpretations that differ from ours.

Even if a state regulatory agency does not directly oversee the transfer of risk by a payer to a downstream entity, the state may require the licensed payer to include certain oversight mechanisms in payer contracts, which could increase our or our Medical Groups’ administrative costs and have an adverse effect on our business, cash flows or results of operations.

If we or our Medical Groups fail to comply with insurance laws and regulations, including licensure and oversight requirements, we may be required to make changes to our operations and could be subject to civil and/or criminal penalties, denial of future licensure applications and termination of payer contracts.

These laws and regulations may affect the operation of, for example, ACOs, direct primary care programs, provider-sponsored organizations, independent practice associations, and provider capitation models.

Success in VBC contracts requires coordination of teams and a combination of data, analytics, software-supported workflow management and automation in addition to direct patient interaction.

We are dependent on Privia Providers and other providers to effectively manage the quality and cost of care, and we cannot guarantee nor control the quality and efficiency of services from such

providers or the attrition of providers, including those with a track record of success in VBC arrangements, or attributed participants.

While we believe we are well-positioned to compete in a value-based reimbursement environment and facilitate the transition from FFS models to VBC arrangements, it is unclear whether VBC arrangements will ultimately achieve their aims and whether they will decrease aggregate reimbursement.

If we or our Medical Groups fail to achieve contract performance standards under any applicable VBC program, perform at a level below the outcomes demonstrated by our competitors, or otherwise fail to effectively provide or coordinate the efficient delivery of quality health care services, our reputation in the industry may be negatively impacted, we may receive reduced reimbursement amounts, including the loss of shared savings or other bonuses, and we may owe repayments to payers, causing our revenues to decline.

In addition, failure to satisfy qualify performance standards may lead to the termination of a physician’s ability to participate in a particular commercial payer product or result in our Medical Groups not being able to participate in a particular VBC arrangement, tiered network or narrow network offering.

Reductions in the quality of services furnished by our Medical Groups, Privia Providers or ACO participants could have a material adverse effect on our business, results of operations, financial condition and cash flows.

Additionally, the Company monitors and manages quality metrics, including star ratings for Medicare Advantage plans, and submits quality data on behalf of its Medical Groups, as well as its ACO participants.

Any delays in information from payers or issues with the quality or integrity of data from third-parties, including as a result of the highly complex process required to summarize, organize and deliver actionable data to Privia Providers, may prevent us, our Medical Groups or ACO participants, from making necessary changes to mitigate potential quality concerns, attribution changes or total cost of care.

As more of our and our Medical Groups’ revenues are derived from VBC arrangements, actuarial modeling and effective strategies to appropriately control costs and expenses are necessary for success, and any failure by us or our Medical Groups to adequately predict and control our and the Medical Groups’ costs and expenses and to make reasonable estimates and maintain adequate accruals for incurred but not reported claims, could have a material adverse effect on our business, results of operations, financial condition and cash flows.

Furthermore, to the extent that our Medical Groups’ patients require more care than anticipated or our medical costs and expenses exceed estimates, reimbursement paid under our VBC arrangements may be insufficient to cover costs.

This may negatively impact both our revenue from Medical Groups and from management services furnished to Non-Owned Medical Groups.

Although we seek to mitigate some of this risk on a case-by-case basis with stop-loss insurance coverage, we generally have little ability to increase our coverage during the terms of our VBC arrangements.

In addition, there are significant difficulties and risks associated with estimating the amount of revenues that we and our Medical Groups recognize under our VBC arrangements with payers.

These estimates affect the timing and the amounts of revenue recognized and, if our estimates are materially inaccurate, could have a material adverse effect on our business, results of operations, financial condition and cash flows.

If federal or state healthcare programs or commercial payers reduce reimbursement rates we receive or alter payment terms, if we and our Medical Groups are unable to retain and negotiate favorable contracts with private third-party payers, if insured individuals move to health plans with greater coverage exclusions or restrictions or narrower networks, or if our Medical Groups’ volume of uninsured or underinsured patients increases, our revenues may decline.

The revenues of the Company and its Medical Groups depend significantly on reimbursement by governmental and private third-party payers.

Federal and state governments have made, and continue to make, significant changes to the Medicare and Medicaid programs, including reductions in reimbursement levels.

For example, CMS makes annual updates to its Medicare Physician Fee Schedule, including modifications to the Quality Payment Program.

Reductions in payments under government healthcare programs may also negatively impact payments from private third-party payers because, in some cases, third-party payers rely on all or portions of Medicare payment systems to determine payment rates.

In addition, the VBC revenues of the Company and our Medical Groups are subject to risks involving annual fluctuations in payment terms for certain VBC arrangements, such as Medicare Advantage payment rates, changes in patient attribution, and changes in plan design and other terms by payers.

For example, CMS regularly updates its Medicare Advantage risk adjustment model, the CMS Hierarchical Condition Categories (“HCC”) model, to account for healthcare utilization and cost data, including by recalibrating the model with newer data, updating condition categories or diagnosis codes, and adjusting to coding pattern differences.

Changes and variations in the HCC model lead to uncertainty and could significantly affect the payments providers receive, which can adversely impact our business and results of operations.

Private third-party payers, including managed care plans, may reimburse healthcare providers at a higher rate than Medicare, Medicaid or other government healthcare programs, depending on a variety of factors.

Reimbursement rates are set forth by contract when providers are in-network.

Our and our Medical Groups’ typical agreements with commercial payers only secure reimbursement rates for, generally, a period of one to three years.

Private third-party payers continue to demand discounted fee structures and assumption by healthcare providers of all or a portion of the financial risk related to the total cost of care of their enrollees.

The ongoing trend toward consolidation among payers tends to increase their bargaining power over fee structures.

Payers may also utilize plan structures such as narrow networks and tiered networks that limit members’ provider choices, impose significantly higher cost sharing obligations when care is obtained from providers in a disfavored tier or otherwise shift greater financial responsibility for care to patients, and such plan structures could be disadvantageous to Privia Providers.

Other cost control strategies include restricting coverage through utilization review, requiring prior authorizations and implementing alternative payment models.

If any commercial payers reduce their reimbursement rates, elect not to cover some or all of the healthcare services our Medical Groups provide, restrict our ability to add new providers or participate in new products or plans, or restrain the ability of Privia Providers to furnish services to patients through plan structures or cost control strategies, our business may be harmed.

Our future success will depend, in part, on our and our Medical Groups’ ability to retain and renew our third-party payer contracts and enter into new contracts on favorable terms.

The contracts we and our Medical Groups have with payers require us to comply with a number of terms related to the provision of services and billing for services.

If we or our Medical Groups are unable to negotiate increased reimbursement rates, maintain existing rates or other favorable contract terms, effectively respond to payer cost controls or comply with the terms of the payer contracts, the payments we and our Medical Groups receive for services may be reduced and we may be involved in payer disputes and experience payment denials, both prospectively and retroactively.

If a payer terminates or elects not to renew its relationship with us or our Medical Groups, our ability to retain patients associated with that payer is limited and consequently could have a material adverse effect on our business, results of operations, financial condition and cash flows.

Payers, including those offering Commercial, Medicare Advantage, Medicaid, TriCare and Affordable Care Act plans have become increasingly aggressive in attempting to minimize the use of out-of-network providers by disregarding the assignment of payment from their enrollees to out-of-network providers (i.e., sending payments directly to members instead of to out-of-network providers), capping out-of-network benefits payable to members, waiving out-of-pocket payment amounts and initiating litigation against out-of-network providers for interference with contractual relationships, insurance fraud and violation of state licensing and consumer protection laws.

Many states have laws and regulations that prevent providers from waiving patient out-of-pocket amounts, including out-of-network charges, when such providers submit their full charges to payers.

To the extent that we, our Medical Groups or Privia Providers are not able to enter into contracts on favorable terms with payers, including with respect to in-network or out-of-network designations, our patient volumes may suffer and our revenues may decline.

Our revenues and the relationships we and our Medical Groups have with payers may also be impacted by price transparency initiatives.

For example, HHS requires health insurers to publish online charges negotiated with providers for healthcare services, which could impact our negotiations with payers.

In addition, the No Surprises Act places limitations on billing for certain services furnished by providers who are not in-network with the patient’s health plan, among other requirements.

Price transparency initiatives may impact the ability of the Company and our Medical Groups to set and negotiate prices and the relationships between healthcare providers, payers and patients, which may reduce our revenues.

Changes in payer mix could adversely affect the overall reimbursement we and our Medical Groups receive from payers.

Such changes could be driven by an economic downturn that results in more uninsured patients or patients insured by state Medicaid programs, among other factors.

If we or our Medical Groups experience changes in payer mix or reductions in reimbursement, have payer contracts that are not competitive in a given market or are unable to obtain or maintain contracts with certain payers, our revenues could decrease.

Our ability to recruit new physicians to affiliate with our Medical Groups may also be adversely impacted, which could adversely affect our growth strategy and financial projections.

An increase in the volume of uninsured patients or deterioration in the collectability of patient responsibility accounts could adversely affect our financial condition and results of operations.

There are collection risks related to our and our Medical Groups’ uninsured patient accounts and patient accounts for which the patient responsibility amounts (e.g., deductibles, copayments, coverage exclusions) remain outstanding.

Any increase in the volume of uninsured patients or deterioration in the collectability of uninsured and self-pay accounts receivable could adversely affect our cash flows and results of operations.

We and our Medical Groups may experience growth in uninsured patients as a result of a number of factors, including conditions impacting the overall economy and unemployment levels.

In addition, federal and state legislatures have in recent years considered or passed various proposals impacting the size of the uninsured or underinsured population.

The number and identity of states that choose to expand or otherwise modify Medicaid programs and the terms of expansion and other program modifications continue to evolve.

Further, under early COVID-19-related legislation, states that maintained continuous Medicaid enrollment were eligible for a temporary increase in federal funds for state Medicaid expenditures.

The resumption of redeterminations for Medicaid enrollees in 2023 resulted in coverage disruptions and dis-enrollments of Medicaid enrollees, and Medicaid enrollment has generally continued to decline through 2024 as states complete their redeterminations for these enrollees.

In addition, some states have imposed individual health insurance mandates and other states have explored or offer public health insurance options.

These variables, among others, make it difficult to predict the size of the uninsured population and what percentage of our total revenue will be comprised of self-pay revenues.

We may also be adversely affected by the growth in patient responsibility accounts as a result of increases in the adoption of health plan structures, including health savings accounts and narrow or tiered networks, that shift greater payment responsibility for care to individuals through greater exclusions and copayment and deductible amounts.

Further, the ability of the Company and its Medical Groups to collect patient responsibility accounts may be limited by statutory, regulatory and investigatory initiatives.

For example, the No Surprises Act requires providers to send uninsured and self-pay patients a good faith estimate of expected charges for items and services and provides a dispute process for bills that exceed the good faith estimate by certain predetermined amounts.

A deterioration of economic conditions in the United States could lead to higher levels of uninsured patients, result in higher levels of patients covered by lower paying government programs, result in fiscal uncertainties for both governmental and commercial payers, or limit the economic ability of patients to make payments for which they are responsible.

If we and our Medical Groups experience

growth in self-pay volume or deterioration in collectability of patient responsibility accounts, our financial condition or results of operations could be adversely affected.

The reimbursement process is complex and may involve delays and other uncertainties, which may adversely affect our business, operations, and revenues.

The Company and its Medical Groups may encounter significant delays and other uncertainties under both FFS and VBC reimbursement models, which could adversely affect our business and financial condition.

The billing and collection process is complex and varies across states and among payers, including as a result of frequent insurance coverage changes, geographic coverage differences, differing interpretations of contract coverage and other payer and provider issues, such as ensuring appropriate documentation.

Third-party payers may disallow, in whole or in part, requests for reimbursement based on determinations that the patient is ineligible for coverage, other coverage exclusions or determinations that services were not medically necessary or not adequately documented.

We and our Medical Groups are subject to commercial and governmental payer audits and may be required to make repayments based on the findings of those audits.

In addition, determining applicable primary and secondary coverage for our patients is a complex, resource-intensive process, and errors in coordination of benefits determinations may result in refunds to payers.

Revenues are subject to estimating risk as a result of the complexity of the billing and collection process, including related to determining amounts not paid by the primary payer that will ultimately be collectible through secondary coverage or from the patient.

Retroactive adjustment by, and refunds to, payers may change amounts realized and recognized as revenue from third-party payers.

Further, there can be lengthy delays between provision of services and ultimate payment.

Under VBC arrangements, payment of any shared savings, bonuses, withholds and similar payments is received only after the close of the relevant measure period (e.g., calendar year), and only after the payer has reconciled cost of care, FFS reimbursement paid, as applicable, reported quality data, and patient attribution.

Delays and uncertainties in the reimbursement process may adversely affect accounts receivable, increase the costs of collection and cause us to incur additional borrowing costs.

Before receiving reimbursement from governmental healthcare programs and commercial payers under either FFS or VBC models, we, our Medical Groups and Privia Providers must be appropriately enrolled and credentialed with the relevant programs and payers.

Enrollment rules, including limitations on retroactive billing, vary by program.

If we or our Medical Groups do not enroll a Privia Provider in a timely manner, the Medical Group may be precluded from billing for any services rendered to a beneficiary prior to the effective date of enrollment.

Failure to timely or accurately submit required information to payers may result in reimbursement delays or denials that could result in adverse financial impacts to Privia Providers’ medical practices (leading to attrition) or adversely affect our operations, cash flows and revenues, and CMS may impose penalties on providers that submit incomplete or inaccurate information.

Further, providers are generally required to periodically revalidate enrollment and credentialing information and provide updates to payers of significant changes.

Failure to comply with these and other requirements could result in revocation of enrollment and billing privileges and denial of future applications.

The information that we or our Medical Groups provide to Medicare Advantage plans could be inaccurate, incomplete or unsupportable, which could impact risk adjustment scores and ultimately result in harm to our business, operations and financial condition.

The Company (on behalf of some Medical Groups) and its Medical Groups submit claims and encounter data to Medicare Advantage plans that are used to establish Risk Adjustment Factor (“RAF”) scores attributable to Medicare Advantage beneficiaries.

The RAF scores impact the revenue that the health plans and, in turn, our Medical Groups are credited with for the provision of medical care to these patients.

The data submitted to CMS by each health plan are based partially on medical charts and diagnosis codes that our Privia Providers prepare and we submit to the health plans.

Each health plan generally relies on us and our Privia Providers to appropriately document and support the RAF-related data in our medical records and to accurately code claims for medical services provided to members.

Although we, our Medical Groups and our payers have implemented auditing and monitoring processes to collect and provide accurate risk adjustment data to CMS, these efforts may not be sufficient to ensure the accuracy of such data.

Erroneous claims, encounter records and submissions to Medicare Advantage plans could result in inaccurate revenue and risk adjustment payments, which are subject to correction or retroactive adjustment in later periods.

This corrected or adjusted information may be reflected in financial statements for periods subsequent to the period in which the revenue was recorded.

We or our Medical Groups may be required to refund a portion of revenues received, which depending the magnitude of the refund, could damage our relationships with the applicable health plan and could have a material adverse effect on our business, results of operations, financial condition and cash flows.

Medicare Advantage plans are subject to audit by government agencies.

CMS audits Medicare Advantage plans for documentation to support RAF-related payments for enrollees through its Risk Adjustment Data Validation (“RADV”) audits, and may seek repayment based on audit findings.

CMS has indicated that payment adjustments will not be limited to RAF scores for the specific Medicare Advantage enrollees for which errors are found, but may also be extrapolated to the entire Medicare Advantage plan subject to a particular CMS contract.

In February 2023, CMS published a final rule updating the RADV audit methodology used by CMS to address overpayments to Medicare Advantage plans based on the submission of unsupported risk-adjusting diagnosis codes.

This rule is the subject of legal challenges.

As finalized, the rule allows CMS to extrapolate RADV audit findings for any CMS and OIG audits beginning with payment year 2018.

Extrapolation is expected to significantly increase the size of overpayment determinations.

OIG conducts audits of Medicare Advantage plans that are similar to RADV audits, addressing diagnoses collected and submitted to CMS for risk adjustment purposes.

In addition, there is increasing scrutiny by the Department of Justice (“DOJ”) with regard to RAF scores, as the agency has intervened in litigation under the FCA related to RAF scores.

Medicare Advantage plans with which we or our Medical Groups contract may be selected for review by CMS, OIG, DOJ or another government agency or its contractor, and the outcome of such actions may result in material adjustments to our revenues.

A Medicare Advantage plan may seek repayment from us, our Medical Groups or our ACOs if CMS, the OIG or another government entity makes any payment adjustments to the Medicare Advantage plan as a result of the audit and assessment of RAF scores that were supported by our data or the data of our Medical Groups.

Moreover, we, our Medical Groups or our ACOs may face civil and criminal liability under healthcare fraud and abuse laws, including the FCA, which can result in significant penalties.

Further, Medicare Advantage plans may seek to hold us liable for any penalties they owe under the FCA or other fraud and abuse laws as a result of inaccurate or unsupportable data provided by us.

The DOJ has asserted FCA claims against, and entered into settlement agreements or corporate integrity agreements including significant civil monetary penalties with, Medicare Advantage plans and providers related to maintaining internal coding policies and provider education that allegedly resulted in the submission of inappropriate diagnosis codes, the inappropriate capture of historical diagnoses that inflated the organization’s RAF scores and resulted in inflated payment rates, submission of inaccurate information about the health status of beneficiaries enrolled in Medicare Advantage plans and failure to remove diagnosis codes that were no longer applicable or supported by the chart review.

There can be no assurance that a Medicare Advantage plan in which our Medical Groups participate will not be randomly selected or targeted for review by CMS or that the outcome of such a review will not result in a material adjustment in our revenue and profitability, even if we believe the information we submitted to the plan is accurate and supportable.

Further, although we have built safeguards into our provider education efforts and unreported diagnoses review, there can be no assurance that CMS, the DOJ, the OIG, or a whistleblower would not allege such action constitutes a civil FCA violation or that we could successfully defend against such allegation.

Even if we are successful, defending against such a claim could cause us to incur significant legal expenses, divert our management’s attention from the operation of our business and result in reputational harm, any of which could adversely affect our business.

Third-party payer controls designed to reduce costs and other payer practices to decrease or review utilization, surgical procedure volumes or reimbursement for services rendered may reduce our revenues.

Controls imposed by Medicare, Medicare Advantage, Medicaid, managed Medicaid and private third-party payers designed to reduce the intensity of services and surgical volumes, in some instances referred to as “utilization review,” have affected and are expected to increasingly affect our Medical Groups and Privia Providers.

Utilization review entails the review of the course of treatment of a patient by third-party payers, and may involve prior authorization requirements.

The Medicare program also issues national or local coverage determinations that restrict the circumstances under which Medicare pays for certain services.

Cost control efforts, including coverage restrictions, have resulted in an increase in reimbursement denials and delays by governmental and commercial payers, which may increase costs and administrative burden for the Company, our Medical Groups and Privia Providers and decrease the reimbursement we and our Medical Groups receive.

Efforts by payers to impose more stringent cost controls are expected to continue and may have a material, adverse effect on our business, financial condition, and results of operations.

If the Company and its Medical Groups are unable to effectively compete, our business, financial condition, and results of operations could be adversely impacted.

The healthcare industry is highly competitive and we expect competition to continue to increase.

We and our Medical Groups compete with healthcare service providers, management services organizations, physician enablement entities, and provider networks, intermediary entities, data consultants, payers, and other companies managing and facilitating FFS and VBC arrangements through tools, talent and technology-enabled, nationally-focused business models.

Some of our competitors may have greater financial, technical, political, and marketing resources, name recognition, broader or more effective service offerings, or a larger number of patients, customers, or payers than we do.

In addition, some of our competitors have been in business longer than we have or and may have more mature or effective tools, strategies and procedures.

Generally, other medical groups and healthcare providers in the markets our Medical Groups serve provide services similar to those our Medical Groups offer, but some competing providers may be more established, have higher caliber facilities and equipment, be located in areas that are easier to access, and offer better access and a broader array of specialties and services.

These competitive advantages may limit the ability of the Company and its Medical Groups to attract and retain skilled talent, patients, and providers in local markets and to expand into new markets.

In addition, we and our Medical Groups may face competition from new entrants into our markets.

Competition for patients and providers may adversely affect contract negotiations and performance as well as patient volumes and other aspects of our business.

Trends toward performance data and price transparency may impact the competitive position and patient volumes of the Company and its Medical Groups.

CMS websites make publicly available certain data on ACOs and on clinicians, medical groups, and various other types of Medicare-enrolled providers, including QPP performance information.

If Privia Providers, our Medical Groups, or ACOs achieve poor results (or results that are lower than competitors’ results) on performance metrics, our competitive position could be negatively affected, and we may attract fewer patients or providers.

In addition, HHS requires health insurers to publish online charges

negotiated with providers for healthcare services, and health insurers must provide online price comparison tools to help individuals get personalized cost estimates for covered items and services.

The No Surprises Act also requires providers to send uninsured or self-pay patients (in advance of the date of the scheduled item or service or upon request) and health plans (prior to the scheduled date of the item or service) of insured patients a good faith estimate of the expected charges and diagnostic codes.

Until additional regulations are issued, HHS is deferring enforcement of certain No Surprises Act requirements related to good faith estimates, including the requirement that estimates provided to uninsured or self-pay patients include expected charges for co-providers or co-facilities.

It is not entirely clear how price transparency requirements will affect consumer behavior, relationships between payers and providers, or the ability of providers to set and negotiate prices, but our competitive position and the competitive position of our Medical Groups could be negatively affected if prices are higher or perceived to be higher than those of our competitors.

Industry consolidation may also negatively impact the competitive position of the Company and its Medical Groups.

Other healthcare industry participants, including payers, are increasingly facilitating VBC arrangements and implementing physician alignment strategies, such as employing physicians, acquiring physician practice groups, participating in ACOs or other clinical integration models.

We and our Medical Groups compete for payer relationships with other physician practices and intermediary entities such as non-Privia ACOs, independent physician associations and physician hospital organizations.

There is increasing consolidation in the third-party payer industry, including the vertical integration of health insurers with providers, and increasing efforts by payers to influence or direct a patient’s choice of provider by the use of narrow networks or other strategies.

Some payers have developed their own managed services tools, which they may offer to large numbers of physicians.

Insurers may have increased negotiating leverage and other competitive advantages, such as greater access to performance and pricing data, as a result of consolidation within the industry.

Consolidation within third-party payer industry may negatively affect the ability of the Company and its Medical Groups to negotiate prices and favorable terms with health insurers, as well as our ability to successfully market our services to providers.

Other healthcare industry participants, such as large employer groups and their affiliates, may intensify competitive pressure and affect market dynamics in ways that are difficult to predict.

If competitors are better able to attract patients or providers, make capital expenditures, maintain or upgrade facilities and equipment, recruit or align with physicians, expand services, innovate, obtain and perform in favorable third-party payer contracts, including VBC arrangements, we and our Medical Groups may experience a decline in patient and provider volumes.

If we are unable to successfully compete, our business, financial condition, and results of operations could be materially adversely affected.

If we do not continue to innovate and evolve our service offerings in a way that is useful to our Medical Groups, Privia Physicians and their patients, our health system or hospital partners, and third-party payers, we may not remain competitive, fail to meet our growth expectations, and our revenue and results of operations could suffer.

We believe that the market for healthcare in the United States is in the midst of structural change, with an increased emphasis on VBC models, technological solutions and a customer-centered focus.

Our success depends on our ability to keep pace with technological developments, satisfy increasingly sophisticated physician, payer and patient requirements, and the market continuing to evolve towards a VBC model.

Our future financial performance will depend in part on growth in the healthcare market and on our ability to adapt to emerging demands of the market, including adapting to the ways our Medical Groups, Privia Physicians and their patients, our health system and hospital partners, and third-party payers interact with our technology-enabled platform, the Privia Technology Solution and our operating model.

Our competitors are constantly developing products and services that may be more efficient or appealing to Medical Groups, Privia Providers and their patients, our health system or hospital partners or third-party payers.

To compete, we must continue to invest significant resources in research and development in order to enhance our existing service offerings and introduce new high-quality services and applications that such customers will want, while offering and operating the Privia Technology Solution at competitive prices.

If we fail to accurately predict customer preferences related to functionality, or industry changes needed to service our customers including providers, beneficiaries, and payers, or if we are unable to modify our service offerings on a timely or cost-effective basis, we may lose Medical Groups, Privia Providers, patients, health system or hospital partners, ACO participants and payer relationships.

Our results of operations could also suffer if our innovations do not produce the desired results including related to contract performance, are not appropriately responsive to the needs of our multiple stakeholders, are not appropriately timed with market opportunity, or are not effectively brought to market, including as the result of delayed releases or releases that are ineffective or have errors or defects.

As technology continues to develop, our competitors may be able to offer results that are, or that are perceived to be, substantially similar to, or better than, those generated by the Privia Technology Solution, or the Privia operating model.

We may be required to compete on additional service attributes and to expend significant resources in order to remain competitive.

If we are unable to successfully compete, our business, financial condition, and results of operations could be materially adversely affected.

Our sales and implementation cycle can be long and unpredictable and requires considerable time and expense, which may cause our results of operations to fluctuate.

The sales cycle for physicians to become affiliated with our Medical Groups from initial contact with a potential lead to contract execution, varies widely and is unpredictable.

Further, once a physician has executed the agreements associated with one of our Medical Groups, there is a long period of implementation where the physician and his or her staff are trained on our EMR, platform and workflows, which may range from two to eight months before the Privia Physician goes live with his or her Medical Group.

Further, once a physician has executed the agreements associated with one of our Medical Groups, there is a long period of implementation where the physician and his or her staff are trained on our EMR, platform and workflows and credentialed or enrolled in payer arrangements, as applicable.

During such implementation period, we are incurring costs associated with the implementation without any corresponding revenue.

Our sales efforts involve educating potential Privia Physicians about our market offerings, the health care industry and the physician practice’s expected return on investment from becoming affiliated with the Medical Group.

Our sales efforts involve educating potential Privia

Providers about our model, market offerings, the health care industry and the physician practice’s expected return on investment from becoming affiliated with the Medical Group.

It is possible that in the future we may experience even longer sales cycles, especially with respect to moving into new geographic markets and as markets become more mature and concentrated, which could result in more upfront sales costs and less predictability in closing our Privia Physician sales.

If our sales cycle lengthens or our substantial upfront sales and implementation investments do not result in sufficient sales to justify our investments, it could have a material adverse effect on our business, financial condition and results of operations.

As we expect to grow rapidly, our physician recruitment costs could outpace our build-up of recurring revenue, and we may be unable to reduce our total operating costs through economies of scale such that we are unable to achieve profitability.

Any increased or unexpected costs or unanticipated delays in taking a Privia Physician live on our technology-enabled platform, including delays caused by factors outside our control, could cause a Privia Physician to terminate his or her relationship prior to going live on our technology-enabled platform causing our operating results and growth targets to suffer.

Further, if a Privia Physician terminates prior to the end of the initial term, we are unlikely to recover our spent acquisition costs associated with such Privia Physician, which could negatively affect our revenue and profits.

If we cannot timely implement the Privia Technology Solution for Privia Physicians and new Medical Groups, or resolve Privia Provider and patients concerns, including any technical and billing issues, in a timely manner, we may lose Medical Groups, Privia Providers and their patients, and our reputation may be harmed.

The seamless onboarding of Privia Physicians, whether done by ourselves or through third-party vendors, onto our technology-enabled platform, including training on conversion to and the use of our EMR, the education of Privia Physicians and their support staff, the credentialing of Privia Physicians and other providers with applicable federal health care programs and commercial payers, training on cash flow processing, website development, and the build out of workflows and customized EMR support, if any, is essential to a timely transition to our technology-enabled platform.

As of December 31, 2023, practices on the Privia Platform were converted from approximately 50 different EMR vendors.

If we face unanticipated implementation difficulties or Privia Physicians and their support staff are unable to smoothly transition to our operating model, we risk delaying the go live date of our new physician practices, which could negatively impact our revenue.

Further, if the Privia Physician and his or her support staff’s implementation process is not executed successfully or if execution is delayed, we could incur significant costs, Privia Physicians could become dissatisfied and decide to neither continue implementation nor go live on our technology-enabled platform.

In such event, we risk litigation from the Privia Physician, especially if he or she loses access to his or her historical commercial payer contracts.

In addition, competitors with less robust operating models with lower implementation costs could jeopardize both our provider and commercial payer relationships.

Privia Providers and their patients depend on our call center support services to resolve their operational concerns including technical issues relating to the Privia Technology Solution and services, and patient billing inquiries, and we may be unable to respond quickly enough to accommodate short-term increases in demand for support services, particularly as we increase the size of our Privia Physicians and patient bases.

We also may be unable to modify the format of our support services to compete with changes in support services provided by competitors.

It is difficult to predict demand for call center support services, and if demand increases significantly, we may be unable to provide satisfactory support services to our Privia Physicians and their patients.

Further, if we are unable to address our Privia Physicians and their patients’ needs in a timely fashion or further develop and enhance our support services, or if a Privia Physician or patient is not satisfied with the quality of work performed by us or with the call center support services rendered, then we could incur additional costs to address the situation or, in certain markets, be required to issue credits or incur penalties related for such untimely or poor performance, and our profitability may be impaired and our Privia Physicians and their patients’ dissatisfaction with our support services could damage our ability to retain Privia Physicians and their patients.

Such Privia Physicians may not renew their contracts, seek to terminate their relationship with us or renew on less favorable terms.

Moreover, negative publicity related to our Privia Physician relationships, regardless of its accuracy, may further damage our business

by affecting our reputation or ability to compete for new Privia Physicians in the market.

If any of these were to occur, our revenue may decline and our business, financial condition and results of operations could be adversely affected.

The market for healthcare in the United States is in the midst of structural change and is evolving toward a more VBC model with an increased emphasis on technological solutions and a customer centered focus.

Our success depends on our ability to keep pace with technological developments, satisfy increasingly sophisticated physician, payer and patient requirements, and sustain market acceptance.

Our future financial performance will depend in part on growth in the healthcare market and on our ability to adapt to emerging demands of the market, including adapting to the ways our Medical Groups, Privia Physicians and their patients, our health system and hospital partners, and our commercial payer customers access and use our technology-enabled platform, the Privia Technology Solution and our operating model.

Our competitors are constantly developing products and services that may become more efficient or appealing to Privia Physicians and their patients, our health system or hospital partners or our commercial payer customers.

As a result, we must continue to invest significant resources in research and development in order to enhance our existing service offerings and introduce new high-quality services and applications that such customers will want, while offering our platform, the Privia Technology Solution and the Privia operating model at competitive prices.

If we are unable to predict customer preferences or industry changes, or if we are unable to modify our service offering on a timely or cost-effective basis, we may lose Medical Groups, Privia Physicians, patients, health system or hospital partners, ACO participants and payer customers.

Our results of operations could also suffer if our innovations are not responsive to the needs of our multiple stakeholders, are not appropriately timed with market opportunity, or are not effectively brought to market, including as the result of delayed releases or releases that are ineffective or have errors or defects.

As technology continues to develop, our competitors may be able to offer results that are, or that are perceived to be, substantially similar to, or better than, those generated by our technology-enabled platform, the Privia Technology Solution, or Privia operating model.

This may force us to compete on additional service attributes and to expend significant resources in order to remain competitive.

If our existing Medical Groups, Privia Providers, health system or hospital partners, ACO participants or payer customers do not continue to renew their contracts with us, renew at lower fee levels or decline to purchase additional applications and services from us, it could have a material adverse effect on our business, financial condition and results of operations.

We expect to derive a significant portion of our revenue from renewal of existing contracts with our Medical Groups, Privia Providers, health system or hospital partners, ACO participants and payer customers.

As part of our growth strategy, for instance, we have recently focused on expanding our revenue enhancement opportunities for Medical Groups such as our development of our virtual visits platform, our scribe program, and the opening of a centralized laboratory in our Mid-Atlantic market.

As a result, achieving high customer retention rates and selling additional applications and services are critical to our future business, revenue growth and results of operations.

Factors that may affect our retention rate and our ability to sell additional solutions and services include, but are not limited to, the following:

• the price, performance and functionality of our technology-enabled platform and technological solutions;

• Privia Physician acceptance and adoption of new services and utilization of new revenue enhancing opportunities;

• the availability, price, performance and functionality of competing solutions;

• our ability to develop, fairly price and sell complementary solutions and services to our Privia Physicians and payer customers;

• the security, performance and stability of our technology-enabled platform, EMR, hosting infrastructure and hosting services;

• changes in applicable health care laws, regulations and trends;

• the business environment of our Medical Groups, Privia Physicians, health system or hospital partners, ACO participants and payer customers.

We typically enter into multiyear contracts with our Medical Groups, Privia Physicians, health system or hospital partners, ACO participants and payer customers, which often have a stated initial term of three years and automatically renew for successive one-year terms.

From time to time, we may renegotiate or attempt to renegotiate contracts in the ordinary course of business prior to their applicable termination or expiration with certain of our counterparties, including as part of rate negotiations with payer customers.

If our Medical Groups, Privia Physicians, health system or hospital partners, ACO participants and payer customers fail to renew their contracts, renew their contracts upon less favorable terms or at lower fee levels or fail to utilize additional products and services obtained from us, or if we fail to renegotiate contracts with our counterparties on favorable terms or at all, our revenue may decline or

our future revenue growth may be constrained.

Should any of our physician practices terminate their relationship with us after implementation has begun, we would not only lose our time, effort and resources invested in that implementation, but we would also have lost the opportunity to leverage those resources to build a relationship with other Privia Physicians over that same period of time.

Failure to adequately expand our direct sales force and our business development staff will impede our growth.

We believe that our future growth will depend on the continued development of our direct sales force and its ability to obtain new Privia Physicians while our implementation team and practice consultants manage existing affiliate physician relationships.

Additionally, we rely upon our business development staff to identify and develop potential relationships with new Medical Groups and health system or hospital partners in new geographical markets.

Identifying and recruiting qualified personnel and training them requires significant time, expense and attention especially given the complexity of our business and the Privia operating model.

It can take six months or longer before a new sales representative is fully trained and productive.

Our business may be adversely affected if our efforts to expand and train our direct sales force and business development staff do not generate a corresponding increase in revenue.

In particular, if we are unable to hire and develop sufficient numbers of productive direct sales and business development personnel or if new personnel are unable to achieve desired productivity levels in a reasonable period of time, our expected growth will be impeded.

Our pricing may change over time and our ability to efficiently price the Privia Technology Solution and our Privia operating model will affect our results of operations and our ability to attract or retain Medical Groups, Privia Physicians, health system or hospital partners, ACO participants and commercial payer customers.

The management and administrative fees we charge our Medical Groups have generally been set as a percentage of the Non-Owned Medical Group’s FFS collections provided such an arrangement is allowed under state fee splitting laws.

Florida, for instance, severely restricts percentage management fees and is structured as a fixed annual amount.

Although subject to negotiation when a Privia Physician already receives care management fees, administrative fees or similar fees, from payers, Privia will typically retain such fees to offset their costs of providing population health services.

In the past, we have allowed Privia Physicians to purchase additional services on an a la carte basis.

While we determined these prices based on prior experience, the costs inputs associated with the services, and feedback from our Medical Groups, Privia Physicians, health system or hospital partners, ACO participants and payer customers, our assessments may not be accurate and we could be underpricing or overpricing the Privia Technology Solution and our operating model, which may require us to continue to adjust our pricing model.

It is essential, however, that our prices remain competitive in the marketplace while providing a reasonable return on investment to allow us to economically provide such services.

Additionally, such fees must generally be fair market value under federal and state fraud and abuse laws such as the Anti-Kickback Statute and the Stark Law.

Furthermore, as our applications and services change, we may need to, or choose to, revise our pricing as our prior experience in those areas will be limited.

Such changes to our pricing model or our inability to efficiently price our services could harm our business, results of operations, and financial condition and impact our ability to predict our future performance.

As we expect to grow rapidly, our clinician recruitment costs could outpace our build-up of recurring revenue, and we may be unable to reduce our total operating costs through economies of scale such that we are unable to achieve profitability.

Any increased or unexpected costs or unanticipated delays in taking a Privia Physician live on our technology-enabled platform, including delays caused by factors outside our control, could negatively impact our reputation and/or our relationships with Privia Providers and cause our operating results and growth targets to suffer and negatively affect our revenue and profits.

Our ability to efficiently price the Privia Technology Solution and our Privia operating model could affect our results of operations and our ability to attract or retain Medical Groups, Privia Physicians, health system or hospital partners, ACO participants and payers.

The management and administrative fees we charge our Medical Groups are generally set as a percentage of the Non-Owned Medical Group’s FFS collections provided such an arrangement is allowed under state fee splitting laws.

Certain states restrict percentage management fees and, therefore, certain markets are structured as a fixed annual amount.

Generally, if Privia offers additional, optional services, Privia Physicians enter into a separate agreement to purchase such services.

We determine these prices based on factors such as prior experience, the costs inputs associated with the services, market competition and feedback from our Medical Groups, Privia Physicians, health system or hospital partners and ACO participants, our assessments may not be accurate and we could be underpricing or overpricing the Privia Technology Solution and our operating model.

Additionally, fees must generally be fair market value under federal and state fraud and abuse laws such as the federal Anti-Kickback Statute and the Stark Law.

From time to time, we may choose to, or be required to, adjust our pricing, particularly as our applications and service offerings evolve.

Changes to our pricing model or our inability to efficiently price our services could harm our business, results of operations, and financial condition and impact our ability to predict our future performance.

Our performance depends on our ability to contract with Medical Groups, Privia Providers, health system partners, ACO participants and third-party payers.

Our business and operating model depend on our relationships with Medical Groups, Privia Providers, health system partners, ACO participants and payers.

We typically enter into multiyear contracts with our Medical Groups, Privia Providers, health system partners, ACO participants and payer customers.

We expect to derive a significant portion of our revenue from renewal of existing contracts, including through the expansion of our service offerings, including existing and new offerings, such as ancillary services, additional medical and medical support services like our virtual visits platform and clinical research program.

Achieving high retention rates and selling additional applications and services are critical to our future business, revenue growth and results of operations.

Factors that may affect our ability to enter into new contracts, execute our sales strategy and achieve our expected retention rates include, but are not limited to, the following:

• the price, performance, functionality and security of the Privia Technology Solution;

• Privia Physician and Medical Group adoption of new services;

• our ability to adapt to emerging demands, including adapting to the ways in which providers, patients, payers and other third parties interact with the Privia Technology Solution and our operating model;

• our ability to innovate, develop complementary solutions and evolve our service offerings in a way that is useful to providers, patients and payers;

• our ability to invest in research and development and obtain reasonable returns on such investments;

• the availability, price and performance of competing solutions;

• industry consolidation.

If contracts are negotiated with lower fee levels or other less favorable terms, if we determine it is necessary to adjust our pricing model, if customers fail to purchase or utilize additional products and services we offer, or if contracts are not renewed, our revenues may decline and future growth may be constrained.

If a Medical Group or Privia Provider terminates their relationship with us after implementation has begun, we would lose the resources invested in that relationship and the opportunity to leverage those resources to build relationships with other Privia Providers over the same period of time.

If a health system partner that is the majority owner of a Non-Owned Medical Group terminates our partnership or affiliation, we may not be able to identify an alternative partner to implement the operating model or restructure in a way to retain a sufficient number of Privia Physicians, which may restrict our ability to continue operations in that market.

Even if we identify an alternative partner or are otherwise able to continue operations, we may be subject to contractual prohibitions that could adversely affect our ability to operate, such as limitations on our ability to retain Privia

Providers in the market.

If we are not able to establish, retain or maintain on favorable terms any of these contractual relationships, our business, operations and financial condition may be adversely impacted.

The success of our business depends on the execution of our growth strategy, which may not prove viable and we may not realize expected results.

Our business strategy is to grow rapidly by expanding our Privia Physicians in existing markets and building new Medical Groups in new geographical markets.

Our business strategy is to grow rapidly by increasing Privia Physicians in existing markets and acquiring new Medical Groups, ACOs Independent Physician Associations and Clinically Integrated Networks in new geographical markets.

New market growth is significantly dependent on partnering with anchor medical practices or health systems or hospitals in such new geographic markets.

Likewise, our growth strategy is dependent on growing same-store sales for our Medical Groups by offering new revenue enhancing services, such as our virtual visit platform, assisting our Medical Groups in recruiting new patients, and partnering or contracting with commercial payers to enter new VBC arrangements on behalf of our Medical Groups.

We seek growth opportunities both organically and through alliances with payers or other healthcare providers.

Our ability to grow organically depends upon a number of factors, including how effectively we can execute our same-store sales growth strategies.

We cannot guarantee that we will be successful in pursuing our growth strategy.

If we fail to evaluate and execute new business opportunities properly, or if we have an adverse effect under one or more of our other “Risk Factors,” we may not achieve anticipated benefits and may incur increased costs.

Likewise, our growth strategy is dependent on growing same-store sales for our Medical Groups by offering new revenue enhancing services, such as our virtual visit platform, assisting our Medical Groups in recruiting new clinicians, and partnering or contracting with commercial payers to enter new VBC arrangements on behalf of our Medical Groups.

We seek growth opportunities both organically and through alliances with other parties in the healthcare industry.

Our growth strategy involves a number of risks and uncertainties, including that:

• we may not be able to successfully enter into contracts with commercial payers on terms favorable to our Medical Groups or at all.

In addition, we compete for payer relationships with other physician practices and intermediary entities such as non-Privia ACOs, independent physician associations (IPAs), physician hospital organizations (PHOs), etc., some of whom may have greater resources than we do.

This competition may intensify due to the ongoing consolidation in the healthcare industry, which may increase our costs to pursue such opportunities;

• we may not be able to recruit or retain a sufficient number of new Medical Groups or Privia Physicians or patients to execute our growth strategy, and we may incur substantial costs to recruit Privia Physicians or new patients and we may be unable to recruit a sufficient number of Privia Physicians and/or new patients to offset those costs;

• we may not be able execute physician services agreements with a sufficient number of Privia Physicians and may fail to integrate new Privia Physicians, their support staff, or our employees into our operating model;

• when expanding our business into new markets, we may be required to comply with laws and regulations that may differ from states in which we currently operate and compliance with such laws may slow our expected growth or limit our potential market of available physicians;

• depending upon the nature of the new geographical market, we may not be able to fully implement our Privia operating model in every geographical market that we enter, which could negatively impact our revenues and financial condition.

There can be no assurance that we will be able to successfully capitalize on growth opportunities, which may negatively impact our business model, revenues, results of operations and financial condition.

• we and our Medical Groups may not be able to contract with payers on terms favorable to us or at all;

• we and our Medical Groups face competition for payer contracts and this competition may intensify, including as a result of ongoing consolidation in the healthcare industry;

• we may not be able to recruit or retain a sufficient number of new Medical Groups, and we and our Medical Groups may not be able to recruit or retain a sufficient number of Privia Physicians or patients, to execute our growth strategy, or to fully implement our operating model in new markets, and we may incur substantial recruiting and marketing costs;

• we may fail to integrate new Privia Providers or their support staff into our operating model;

• when expanding our business into new markets, compliance with additional laws and regulations may slow our expected growth or limit our potential market of available physicians or the services and solutions we may offer;

• we may fail to realize expected synergies, financial, strategic or other benefits from same-store sales or expansion into new markets or face challenges successfully integrating new Medical Groups or Privia Providers into our operating model and the Privia Technology Solution.

There can be no assurance that we will be able to successfully capitalize on growth opportunities and otherwise execute our growth strategy, which may negatively impact our business model, revenues, results of operations and financial condition.

If we fail to manage our growth effectively, we may be unable to execute our business plan, maintain high levels of stakeholder service and patient satisfaction, or adequately address competitive challenges.

3 unchanged sentences

We may require significant capital expenditures and the allocation of valuable management resources to grow and change in these areas.

We must effectively increase our headcount and continue to effectively train and manage our employees.

We must effectively increase our headcount and continue to effectively train, manage and retain our employees.

We will be unable to manage our business effectively if we are unable to alleviate the strain on resources caused by growth in a timely and successful manner.

2 unchanged sentences

In addition, as we expand our business, it is important that we continue to maintain a high level of stakeholder service and satisfaction.

As our Privia Physician base continues to grow, we will need to expand our populations health, patient services and other personnel, either through employment or contractual arrangements to provide personalized stakeholder service.

As our Privia Physician base continues to grow, we will need to expand our population health, patient services and other personnel, either through employment or contractual arrangements to provide personalized stakeholder service.

If our Medical Groups are not able to continue to provide high quality cost effective healthcare services with high levels of patient satisfaction, our reputation, as well as our business, results of operations and financial condition could be adversely affected, including a failure to realize the benefits of any VBC arrangements.

New Medical Groups and Privia Providers must be properly credentialed and enrolled in commercial payer plans and federal health care programs before our Medical Groups can receive reimbursement for their services, and there may be significant delays in the enrollment process.

Each time a new Privia Provider joins one of our Medical Groups or we partner with a new Medical Group, we must credential and enroll the new Privia Provider or Medical Group under our applicable group identification number for the Medicare and Medicaid programs and for certain commercial payer programs before the applicable Medical Group can receive reimbursement for healthcare services furnished by the new Privia Provider to beneficiaries or enrollees of those programs.

The estimated time to receive approval for the enrollment is sometimes difficult to predict.

Failure to timely or accurately complete necessary credentialing information, whether such fault lies with the new Privia Provider or us, results in delayed reimbursement that may adversely affect our cash flows and revenue.

With respect to Medicare, providers can retrospectively bill Medicare for services provided 30 days prior to the effective date of the enrollment so long as the individual Medicare enrollment application and assignment are correctly submitted.

In addition, the enrollment rules provide that the effective date of the enrollment will be the later of the date on which the enrollment application was correctly filed and approved by the Medicare contractor, or the date on which the provider began furnishing healthcare services.

If we are unable to properly enroll Privia Providers in a timely manner (at least 30 days after such provider begins furnishing patient care services), the affected Medical Group may be precluded from billing Medicare for any services which were provided to a Medicare beneficiary more than 30 days prior to the effective date of the enrollment.

With respect to Medicaid, new enrollment rules and whether a state will allow providers to retrospectively bill Medicaid for services provided prior to submitting an enrollment application varies by state.

Failure to timely enroll providers could reduce revenue to our Medical Groups and have a material adverse effect on the business, financial condition or results of our operations.

The ACA, as currently structured, added additional enrollment requirements for Medicare and Medicaid, which have been further enhanced through implementing regulations and increased enforcement scrutiny.

For example, every enrolled provider must revalidate its enrollment at regular intervals and must update the Medicare contractors and many state Medicaid programs with significant changes on a timely basis.

CMS may also impose penalties upon providers who submit incomplete or inaccurate information or who have affiliations with other providers that CMS has determined pose undue risk of fraud, waste or abuse.

If we fail to comply with these and other requirements to maintain our enrollment, Medicare and Medicaid could deny continued future enrollment or revoke

our enrollment and billing privileges.

Further, Medicare now subjects new locations at which physicians are furnishing services to Medicare beneficiaries to a location site visit to confirm enrollment information.

The requirements for enrollment, licensure, certification, and accreditation may include notification or approval in the event of a transfer or change of ownership or certain other changes.

Other agencies or commercial payers with which we have contracts may have similar requirements, and some of these processes may be complex.

Failure to provide required notifications or obtain necessary approvals may result in the delay or inability to complete an acquisition or transfer, loss of licensure, lapses in reimbursement, or other penalties.

While we make reasonable efforts to substantially comply with these requirements, we cannot assure you that the agencies that administer these programs or have awarded us contracts will not find that we have failed to comply in some material respects.

A finding of non-compliance and any resulting payment delays, refund demands or other sanctions could have a material adverse effect on our business, financial condition or results of operations.

We rely on internet infrastructure, bandwidth providers, other third parties and our own systems to provide our technology-enabled platform to our Privia Physicians and their patients, and any failure or interruption in the services provided by these third parties or our own systems could expose us to litigation, result in a reduction of our management fees or the imposition of financial penalties on our management services organizations, and hurt our reputation and relationships with our Privia Physicians, our Medical Groups, and their patients.

Our ability to maintain our technology-enabled platform, including our virtual health services, is dependent on the development and maintenance of the infrastructure of the internet and other telecommunications services furnished by third parties.

This includes maintenance of a reliable network connection with the necessary speed, data capacity and security for providing reliable internet access and services and reliable telephone and facsimile services.

Our platform is designed to operate without perceptible interruption in accordance with our service level commitments.

If the estimates and assumptions we use to determine the size of our total addressable market, or TAM, are inaccurate, our future growth rate may be impacted and our business could be harmed.

Market estimates and growth forecasts are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate.

The estimates and forecasts in this report relating to the size and expected growth of the TAM for available physicians with which our Medical Groups can affiliate may prove to be inaccurate.

Even if the markets in which we compete meet our size estimates and forecasted growth, our business could fail to grow at similar rates, if at all.

The principal assumptions relating to our determination of the TAM includes determining the total number of physicians in the geographic market reduced by hospital employed physicians and other Privia Physicians in the market that are unlikely to change their

existing relationships.

This calculation may not take into account physicians who are not currently available because of an exclusive arrangement with an intermediary entity or because the physician is locked out of moving while awaiting payment pursuant to a VBC arrangement.

We also evaluate the variation in physician reimbursement by commercial payers in each market to determine if there is a sufficiently large TAM to allow us to affiliate with a sufficiently large number of physicians.

We also evaluate the variation in physician reimbursement by commercial payers in each market to determine if there is sufficient economic opportunity to allow physicians to embrace our Privia operating model.

Our TAM is also based on the assumption that the strategic approach that our solution enables for potential Privia Physicians will be more attractive to our available physicians than many competing opportunities.

If these assumptions prove inaccurate, our business, financial condition and results of operations could be adversely affected.

If certain of our vendors do not meet our needs, if there are material price increases or reductions in reimbursement rates on vendor services and products, if they experience service disruptions as a result of factors outside of our control, or if we are unable to effectively access new or replacement services or products, our business, ability to operate, financial condition, cash flows, results of operations, and relationships with our Medical Groups, Privia Providers and their patients could be negatively impacted.

The ability of the Company and its Medical Groups to offer services and solutions and to maintain business operations is dependent on maintaining relationships with third-party vendors and entering into new relationships to meet changing business needs.

Any deterioration in vendor relationships or failure to enter into agreements with vendors in the future could harm our business and our ability to pursue our growth strategy.

If any third-party vendors of the Company or its Medical Groups are unable or unwilling (including as a result of a product recall, shortage or dispute) to provide the services necessary to support our business, if our vendors do not meet our needs for the services or products they supply (including as a result of vendors updating or replacing services and products), if we experience material price increases from vendors or reductions in reimbursement rates that we are unable to mitigate, if we are not able to access new or replacement services on a cost-effective basis or at all, or if vendors are unable to scale as fast as our operations grow or provide services required to meet the changing needs of our business, it could have a material adverse effect on our operations.

We and our Medical Groups may incur substantial costs, delays and disruptions to our business in transitioning such services to internal platforms or other third-party vendors.

Any of the foregoing could materially harm our competitive position, business, results of operations, financial condition and cash flows.

We and our Medical Groups have vendors that may be the sole or primary source of certain services, products or technology critical to the services either we, our Medical Groups or Privia Providers furnish, which augments the aforementioned risks with respect to these vendors.

For example, we are dependent on our EMR vendor, athenahealth, Inc., with which the Privia Technology Solution is integrated, and which is utilized by most of our Medical Groups.

Our business could be adversely affected if that relationship were disrupted.

The Privia Technology Solution is not currently usable with other EMRs, and moving Privia Providers to another EMR provider would require considerable effort, time and expense.

In addition, our dependency and the dependency of most of our Medical Groups on athenahealth, Inc., heightens risks related to service disruptions or potential cybersecurity incidents experienced by, cessation of operations of, or price increases by this vendor.

Furthermore, changes to the athenahealth, Inc.

platform could require us, our Medical Groups or Privia Providers to make financial or operational investments or changes to respond to such changes to the platform.

A material change in our relationship with athenahealth, Inc., whether resulting from a dispute, a change in government regulation, other factor or the loss of this relationship, could impair our ability to provide services to Privia Providers and could have a material adverse effect our business, financial condition and results of operations.

Additionally, service certain of the Company’s service providers, including technology or AI-related service providers, may experience service disruptions from a variety of factors outside of the Company’s control ranging from severe or extreme weather to cybersecurity incidents and geopolitical conflict, and our operations could be negatively impacted by any disruption or vulnerabilities in the services they provide resulting from such factors outside our control.

If we are not able to maintain and enhance our reputation and brand recognition, including through the maintenance and protection of trademarks, our business and results of operations will be harmed.

We believe that maintaining and enhancing our reputation and brand recognition is critical to our relationships with Medical Groups, Privia Providers, patients, ACO participants, and payers, and to our ability to attract new Medical Groups, Privia Physicians and patients.

In addition, any factor that diminishes our reputation or that of our management, including failing to meet the expectations of our Medical Groups, Privia Physicians, ACO participants, health system or hospital partners, patients, or payers, or any adverse publicity or litigation involving or surrounding us, one of our Medical Groups, or our management, could make it substantially more difficult for us to attract new Privia Physicians, New Medical Group, or retain existing Privia Providers and Medical Groups.

In addition, negative publicity resulting from any adverse government investigation or payer audit could injure our reputation.

If we do not successfully maintain and enhance our reputation and brand recognition, our business may not grow and we could lose our relationships with Privia Physicians, Medical Groups, ACO

participants, health system or hospital partners, patients, or payers, which could harm our business, results of operations and financial condition.

We may not be able to protect our rights in these trademarks and trade names, which we need in order to build name recognition with patients, payers and other third parties.

In addition, third parties may in the future file for registration of trademarks similar or identical to our trademarks.

The operations of the Company and its Medical Groups are concentrated in the fourteen states and the District of Columbia in which we operate, which makes us sensitive to regulatory, economic, public health, environmental, competitive and other conditions and changes in these jurisdictions, and we may not be able to successfully establish a presence in new geographic markets.

A substantial portion of our revenue is driven by our Medical Groups in the fourteen states and the District of Columbia, in which we operate.

As a result, our exposure to many of the risks described herein are not mitigated by a diversification of geographic focus.

Furthermore, this concentration of the operations of the Company and its Medical Groups makes our business particularly sensitive to regulatory, economic, environmental (including natural disasters), competitive and other conditions and changes in these jurisdictions.

Any material change in payment programs or regulatory, economic, public health, environmental or competitive conditions in these states or the District of Columbia could have a disproportionate effect on our operating results and financial condition, and could disrupt the operations of our Medical Groups and Privia Providers.

The risks of geographic concentration could decrease as we expand the operations of the Company and its Medical Groups to other regions of the United States, but expansion is resource-intensive and we may encounter significant barriers to entry in new markets.

We anticipate that further geographic expansion may require us to make a substantial investment of management time, capital and/or other resources.

There can be no assurance that we will be able to continue to successfully expand our operations in any new geographic markets.

Changes in treatment methodologies, trends related to the usage of primary care and specialist healthcare services, and other factors outside our control that impact demand for medical services may reduce our revenues.

Patient volumes and case-mix trends related to the usage of primary care and specialist healthcare services may be impacted by factors beyond the control of the Company and its Medical Groups, such as changes in volume of certain high acuity services, variations in the prevalence and severity of outbreaks of influenza, COVID-19 and other illnesses, seasonal and severe weather conditions, changes in treatment regimens and medical technology and other advances.

Further, trends in physician treatment protocols and health plan design, such as health plans that shift increased costs and accountability for care to patients, could reduce the volume of certain procedures and treatments rendered by Privia Providers in favor of lower intensity and lower cost treatment methodologies or result in patients seeking care from other providers or failing to obtain appropriate, medically necessary care.

These and other factors beyond the control of the Company and its Medical Groups may reduce the demand for services we offer and decrease the reimbursement that we receive, which could have a material, adverse effect on our business, financial position, and results of operations.

The failure to obtain medical supplies and drugs for Medical Groups at favorable prices or in sufficient volumes could cause our results of operations to decline.

Costs of medical supplies and drugs may continue to increase due to market pressure from pharmaceutical companies and vendors, new product releases, product shortages and other factors including import/export restrictions, such as new, expanded or retaliatory tariffs, sanctions, quotas or trade barriers (including recent U.S.

tariffs imposed or threatened to be imposed on China, Canada and Mexico and other countries and any retaliatory actions taken by such countries).

If our we or our Medical Groups are unable to obtain sufficient supplies or are unable to access new or replacement products, it could negatively impact the ability of our Medical Groups to provide services to patients.

Higher costs and insufficient supplies could adversely affect our business, results of operations, financial condition, and cash flows.

Technology, Cybersecurity and Privacy Risks

Security threats, cybersecurity incidents or other forms of data breaches, catastrophic events and other disruptions to our, our Medical Groups’, our business partners’ or our vendors’ information technology and related systems could compromise sensitive information related to our business, the Medical Groups or patients, prevent access to critical information, harm patients, require remediation and other corrective action, which can be expensive, and expose us to liability, which could adversely affect our business, operations and reputation.

Information technology is a critical component of the day-to-day business operations of the Company and its Medical Groups.

Our business is highly dependent on maintaining effective information systems, in part because VBC arrangements involve extensive data

processing and analytics, as well as the integrity and timeliness of the data we use to serve our Privia Providers’ patients, support our Medical Groups and Privia Providers, monitor and manage our ACOs and management services organizations (including satisfaction of reporting obligations) and to otherwise operate our business.

We and our Medical Groups, directly and through our vendors and other third parties, collect and store on networks, devices and third-party technology platforms sensitive information, including intellectual property, proprietary and confidential business information, protected health information of patients and personally identifiable information of our employees and patients.

Our Medical Groups use EMRs and medical devices that are integral to the provision of patient care, and these systems and devices are increasingly connected to the internet and other downstream technology platforms.

We have implemented multiple layers of security measures to protect the confidentiality, integrity and availability of our data, networks, systems and devices.

Our and the Medical Groups’ systems interface with and rely on third-party provided systems that we do not directly control, such as the athenahealth EMR and platforms that support the interoperability of the healthcare infrastructure for treatment, payment and operations.

Third-party technology platforms are increasingly important to our business and continue to grow in complexity and scope.

We rely on third-party providers to have appropriate controls (including with respect to their own downstream third-party vendors) that protect confidential information and other sensitive or regulated data that is on their systems or otherwise in their control.

Our contracts with such third-party providers typically include terms holding them to our security standards.

We, our Medical Groups and our vendors have been and continue to be the target of attempted cybersecurity and other threats that could have a security impact, including efforts by third parties, including threat actors, to access, misappropriate, corrupt or manipulate our information or disrupt our operations.

Despite our implementation of security measures, we expect to continue to experience an increase in cybersecurity threats in the future, as the volume, intensity and sophistication of cyberattacks continue to increase, particularly within the healthcare industry.

Threats from malicious persons and groups, new vulnerabilities and advanced new attacks against our, our Medical Groups’, Privia Providers’ medical practices’, or our vendors’ information systems and devices create risk of cybersecurity incidents, including ransomware, data exfiltration, malware and phishing incidents as well as social engineering attacks.

As cybersecurity threats continue to evolve, we and our Medical Groups may not anticipate certain techniques used to obtain unauthorized access to, or to sabotage, information systems, and we may not be able to implement effective protective measures.

We and our Medical Groups may experience security incidents that remain undetected for an extended period, or, even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers using tools and techniques designed to circumvent controls, avoid detection, and remove or obfuscate forensic evidence.

The rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks.

Moreover, hardware, software or applications that we, our Medical Groups and vendors use may have inherent vulnerabilities or defects of design, manufacture or operations or could be inadvertently or intentionally implemented or used in a manner that could compromise information security.

As cyber threats continue to evolve and the volume and sophistication of threats increases, we may be required to expend significant additional resources to continue to modify or enhance security measures and investigate and remediate any potential vulnerabilities in our information technology systems and infrastructure.

Although to date no cyberattack or other information or security breach has resulted in material losses or other material consequences to us, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats will be sufficient and/or timely.

We, our Medical Groups or our vendors could be subject to incidents that bypass security measures, impact the integrity, availability or privacy of PHI or other data subject to privacy laws or disrupt our or their information systems, devices or business, including the ability to provide various healthcare services.

In such an event, we or our Medical Groups may incur substantial costs, including but not limited to, costs associated with remediating the effects of the cybersecurity incident, costs for security measures to guard against similar future incidents and costs to recover data.

In addition, the occurrence of cybersecurity incidents or other forms of data breaches or disruptions could result in harm to patients;

business interruptions and delays;

the loss, misappropriation, corruption or unauthorized access of data;

litigation and potential liability under privacy, security, breach notification and consumer protection laws (including penalties imposed under HIPAA), common law theories or other applicable laws;

reputational damage;

and foreign, federal and state governmental inquiries, any of which could have a material, adverse effect on our financial position and results of operations and harm our business relationships and reputation.

While we and our Medical Groups have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise.

Further, to the extent there are successful cyberattacks at other healthcare services companies, consumer confidence in the integrity and security of personal information and critical operations data in the healthcare industry generally could be shaken, which could have a material, adverse effect on our business, financial position or results of operations.

In addition to the risk of cyber threats, information systems may be vulnerable to damage from a variety of other sources, including telecommunications or network failures, human acts such as inadvertent or intentional misuse by employees or contractors and natural disasters.

Despite precautionary measures, we, our Medical Groups or our vendors and other third-parties (or their downstream third-party vendors) that we rely upon may experience system failures and disruptions.

Although we have disaster recovery systems and business continuity plans in place, we cannot provide assurance that there will not be disruptions in or other failures of our disaster recovery systems, and we cannot provide assurance that our business continuity plans sufficiently protect against extended technology or service outages of our third-parties.

The occurrence of any system failure could result in interruptions, delays, the loss or corruption of data and cessations or interruptions in the availability of systems, any of which could have a material, adverse effect on patient care, our financial position and results of operations and lead to reputational harm.

If we or our Medical Groups experience failures or interruption in services we receive through third-party internet infrastructure, bandwidth providers, EMR and other vendors, our business, ability to operate, financial condition, cash flows, results of operations, and relationships with our Medical Groups, Privia Providers and their patients could be negatively impacted.

The Company and its Medical Groups rely on internal systems as well as third-party suppliers, including network and infrastructure equipment providers, to maintain our platform and related services.

Failure to adequately manage updates or enhancements to such platforms or interfaces between platforms or implementation of new technology could place us at a competitive disadvantage, disrupt operations and have a material, adverse impact on our business and results of operations.

Further, our ability to maintain our technology-enabled platform, including our virtual health services, is dependent on the development and maintenance of the infrastructure of the internet (including a reliable network connection with the necessary speed, data capacity and security for providing reliable internet access and services), reliable telephone and facsimile services and other services furnished by third parties.

Although we maintain redundancy with respect to the critical components of our platform, we do not currently maintain redundant systems or facilities for some of the services on which we depend.

The Privia Technology Solution is designed to operate without perceptible interruption in accordance with our service level commitments.

We have, however, experienced limited interruptions in these systems in the past, including temporary slowdowns in the performance of our EMR and platform, and we may experience similar or more significant interruptions in the future.

We rely on internal systems as well as third-party suppliers, including network and infrastructure equipment providers, to maintain our platform and related services.

We do not currently maintain redundant systems or facilities for some of these services.

Interruptions in these systems or services, whether due to system failures, cyber incidents, physical or electronic break-ins or other events, could affect the security or availability of our platform or services, including access to our EMR, patient scheduling, patient and Privia Physician portals, and prevent or inhibit the ability of our Privia Physicians and their patients to access our platform or services.

In the event of a catastrophic event with respect to one or more of these systems or facilities, we may experience an extended period of system unavailability, which could result in substantial costs to remedy those problems or harm our relationship with our Privia Physicians and our business.

Additionally, any disruption in the network access, telecommunications or co-location services provided by third-party providers or any failure of or by third-party providers’ systems or our own systems to handle current or higher volume of use could significantly harm our business.

We exercise limited control over our third-party suppliers, which increases our vulnerability to problems with services they provide.

Any errors, failures, interruptions or delays experienced in connection with these third-party technologies and information services or our own systems could hurt our relationships with our Medical Groups, Privia Physicians, patients, payers and other network participants, and expose us to third-party liabilities.

The reliability and performance of our internet connection may be harmed by increased usage or by denial-of-service attacks or related cyber incidents.

The services of other companies delivered through the internet have experienced a variety of outages and other delays as a result of damages to portions of the internet’s infrastructure, and such outages and delays could affect our systems and services in the future.

These outages and delays could reduce the level of internet usage as well as the availability of the internet to us for delivery of our internet-based services.

Any of the foregoing could harm our competitive position, business, financial condition, results of operations and prospects.

Additionally, our Privia Physicians’ Affiliated Practices, which furnish certain support services on behalf of our Medical Groups, act as a business associate of their respective Medical Groups.

In such capacity, they furnish certain services that support our platform, e.g., internet service access, modems, and computer hardware that access our EMR, and patient health information may, at times, reside on such hardware, including legacy servers.

Although each legacy practice is obligated to furnish such services in compliance with HIPAA and state law, and to obtain cybersecurity insurance to cover any breaches or security incidents, a failure to comply with these obligations could result in the imposition of penalties against our Medical Groups as the covered entity under HIPAA.

Further, such an incident could result in liability to the patient under state law and could damage our reputation among Privia Physicians and their patients all of which could adversely affect our business.

For additional risks related to our technology-enabled platform, see “ Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our patients, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, operations and our reputation.”

We rely on third-party vendors to host and maintain our technology-enabled platform.

Our ability to offer our solutions and services and operate our business is dependent on maintaining our relationships with third-party vendors and entering into new relationships to

meet the changing needs of our business.

Any deterioration in our relationships with such vendors or our failure to enter into agreements with vendors in the future could harm our business and our ability to pursue our growth strategy.

Because of the large amount of data that we collect and manage, it is possible that, despite precautions taken at our vendors’ facilities, the occurrence of a natural disaster, cyber incident, decision to close the facilities without adequate notice or other unanticipated problems could result in our non-compliance with privacy laws and regulations, loss of proprietary or personal information and in lengthy interruptions in our service.

These service interruptions could also cause our platform to be unavailable to our Medical Groups, Privia Providers, patients and network members, and impair our ability to deliver solutions and services and to manage our relationships with new and existing Medical Groups, Privia Providers, patients and network members.

We do, however, maintain redundancy with respect to the critical components of our platform.

We take steps to monitor the performance of third-party vendors, including in our agreements with such parties, but our oversight controls could prove inadequate.

Since we do not fully control the actions of vendors and other third parties, including our Medical Groups and Privia Providers, we are subject to the risk that their decisions or operations adversely impact us and replacing such third-party vendors could create significant delay and expense.

If these third-party vendors fail to satisfy their obligations to us or if they fail to comply with legal or regulatory requirements in a high-quality and timely manner, our operations and reputation could be compromised, we may not realize the anticipated economic and other benefits from these arrangements, and we could suffer adverse legal, regulatory and financial consequences.

If our third-party vendors are unable or unwilling to provide the services necessary to support our business, or if our agreements with such vendors are terminated, our operations could be significantly disrupted.

Some of our vendor agreements may be unilaterally terminated by the licensor for convenience, and if such agreements are terminated, we may not be able to enter into similar relationships in the future on reasonable terms or at all.

We may also incur substantial costs, delays and disruptions to our business in transitioning such services to ourselves or other third-party vendors.

In addition, third-party vendors may not be able to provide the services required in order to meet the changing needs of our business or scale as quickly as we require.

Any of the foregoing could harm our competitive position, business, financial condition, results of operations and prospects.

The Privia Technology Solution may not operate properly, which could damage our reputation, give rise to claims against us or divert application of our resources from other purposes, any of which could harm our business.

Our technology-enabled platform provides patients with the ability to, among other things, schedule services with our Privia Physicians and communicate and interact with providers, and it allows our Privia Providers to, among other things, streamline patient charting and identify gaps in care and conduct virtual visits (via video, phone or the internet).

Interruptions in third-party systems or services, or our own systems or our Medical Groups’ systems, whether due to system failures, cyber incidents, physical or electronic break-ins or other events, could affect the security or availability of our platform or services and Medical Group services, including EMR access, patient scheduling, patient and Privia Physician portals;

prevent or limit access to the Privia Technology Solution or other services by Privia Physicians and their patients;

result in noncompliance with privacy laws and regulations;

result in the loss of proprietary or personal information;

hurt our relationships with Medical Groups, Privia Physicians, patients, payers, and other network participants;

and expose us and our Medical Groups to third-party liabilities.

In the event of a catastrophic event with respect to one or more of these systems or facilities, we and our Medical Groups may experience an extended period of system unavailability, which could result in substantial remediation costs and harm our business relationships and our business.

Any interruption or delay in third-party systems and services could harm our competitive position, business, financial condition, results of operations and prospects.

We and our Medical Groups take steps to monitor the performance of third-party vendors, including in our agreements with such parties, but our oversight controls could prove inadequate.

Since we do not fully control the actions of vendors and other third parties, including our Medical Groups and Privia Providers, we are subject to the risk that their decisions or operations could adversely impact us and our Medical Groups, and replacing such third-party vendors could create significant delay and expense.

If these third-party vendors fail to satisfy their obligations to us or our Medical Groups, timely comply with legal or regulatory requirements, or deliver high-quality services, the operations and reputation of the Company and its Medical Groups could be compromised, we may not realize the anticipated economic and other benefits from these arrangements, and we could suffer adverse legal, regulatory and financial consequences.

In addition, these third parties face their own technology, operating, business and economic risks, and any significant failures by them, including the improper use or disclosure of confidential Company or Medical Group information or failure to comply with applicable laws and regulations, or any failure by them to effectively oversee, monitor or protect against their own downstream third-party vendors’ risks (so-called “fourth-party risk”), could result in reputational harm or otherwise expose the Company and its Medical Groups to liability.

For additional risks related to our third-party vendors, see “ If certain of our vendors do not meet our needs, if there are material price increases or reductions in reimbursement rates on vendor services and products, if they experience service disruptions as a result of factors outside of our control, or if we are unable to effectively access new or replacement services or products, our business, ability to operate, financial condition, cash flows, results of operations, and relationships with our Medical Groups, Privia Providers and their patients could be negatively impacted.”

If we cannot timely implement the Privia Technology Solution for Privia Physicians and new Medical Groups, or promptly resolve Privia Provider and patient concerns, or if the Privia Technology Solution fails to operate as we expect, our business and results of operations may be adversely impacted, we could be subject to litigation, and our reputation may be harmed.

The Privia Technology Solution, our end-to-end, cloud-based technology-enabled platform, provides patients with the ability to schedule services with our Privia Physicians and communicate and interact with providers, and it allows our Privia Providers to streamline patient charting and identify gaps in care and conduct virtual visits (via video, phone or the internet), among other functions.

The seamless onboarding of Privia Physicians onto the Privia Technology Solution, including training on conversion to and the use of our EMR and the credentialing of Privia Physicians and other providers with applicable federal health care programs and commercial payers is essential to a timely transition to our technology-enabled platform.

As of December 31, 2024, practices on the Privia Platform were converted from approximately 50 different EMR vendors.

If we face unanticipated implementation difficulties or Medical Groups, Privia Physicians or support staff are unable or unwilling to smoothly transition to the Privia Technology Solution, we risk delaying the go live date of our new Medical Groups.

Delays could cause us to incur significant costs and negatively impact our revenue, and Privia Providers could become dissatisfied, which could negatively impact our reputation, our relationships with Privia Providers, our ability to attract and retain new providers or our ability to negotiate and perform in payer contracts.

We also face risks related to the operation of our Privia Technology Solution.

Proprietary software development is time-consuming, expensive and complex, and may involve unforeseen difficulties.

We may encounter technical obstacles, and it is possible that we may discover additional problems that prevent our proprietary software from operating properly.

We are currently implementing software with respect to a number of new applications and services.

If our solutions do not function reliably or fail to achieve Medical Group, Privia Provider, or patient expectations in terms of performance, we may lose or fail to grow our Privia Providers and patients, could assert liability claims against us and our Medical Groups, and our Medical Groups, affiliate providers, health system partners, and ACO participants may attempt to cancel their relationships with us.

This could damage our reputation and impair our ability to attract or maintain Medical Groups, Privia Physicians, patients and relationships with commercial payers.

Disruptions in our disaster recovery systems or management continuity planning could limit our ability to operate our business effectively.

Our information technology systems facilitate our ability to conduct our business.

While we have disaster recovery systems and business continuity plans in place, any disruptions in our disaster recovery systems or the failure of these systems to operate as expected could, depending on the magnitude of the problem, adversely affect our operating results by limiting our capacity to effectively monitor and control our operations.

Despite our implementation of a variety of security measures, our information technology systems could be subject to physical or electronic break-ins, and similar disruptions from unauthorized tampering, any weather-related disruptions or fires where our headquarters is located.

In addition, in the event that a significant number of our management personnel were unavailable in the event of a disaster, our ability to effectively conduct business could be adversely affected.

We may be subject to legal proceedings and litigation, including intellectual property and privacy disputes, which are costly to defend and could materially harm our business and results of operations.

We have been in the past and may be party to lawsuits and legal proceedings in the future in normal course of business.

These matters are often expensive and disruptive to normal business operations.

We may face allegations, lawsuits and regulatory inquiries, audits and investigations regarding claim submission, supporting documentation for claimed reimbursement, coding for services furnished by our Privia Providers, data privacy, security, labor and employment, consumer protection and intellectual property infringement, misappropriation and other violations, including claims related to privacy, patents, publicity, trademarks, copyrights and other rights.

We may also face allegations or litigation related to our acquisitions, securities issuances or business practices, including public disclosures about our business.

Litigation and regulatory proceedings may be protracted and expensive, and the results are difficult to

Certain of these matters may include speculative claims for substantial or indeterminate amounts of damages and may include claims for injunctive relief.

Additionally, our litigation costs could be significant.

Adverse outcomes with respect to litigation or any of these legal proceedings may result in significant settlement costs or judgments, penalties and fines, or require us to modify our services or require us to stop serving certain patients or geographies, all of which could negatively impact our geographical expansion and revenue growth.

We may also become subject to periodic audits, which could increase our regulatory compliance costs and may require us to change our business practices, which could negatively impact our revenue growth.

Managing legal proceedings, litigation and audits, even if we achieve favorable outcomes, is time-consuming and diverts management’s attention from our business.

The results of regulatory proceedings, litigation, claims, and audits cannot be predicted with certainty, and determining reserves for pending litigation and other legal, regulatory and audit matters requires significant judgment.

There can be no assurance that our expectations will prove correct, and even if these matters are resolved in our favor or without significant cash settlements, these matters, and the time and resources necessary to litigate or resolve them, could harm our reputation, business, financial condition, results of operations and the market price of our common stock.

We and our Medical Groups, Privia Providers, ACOs, management services organizations also may be subject to lawsuits under the FCA and comparable state laws for submitting allegedly fraudulent or otherwise inappropriate bills for services to the Medicare and Medicaid programs.

These lawsuits, which may be initiated by government authorities as well as private party relators, which are often disgruntled employees or physicians, can involve significant monetary damages, fines, attorney fees and the award of bounties to private plaintiffs who successfully bring these suits, as well as to the federal health care programs.

In recent years, government oversight and law enforcement have become increasingly active and aggressive in investigating and taking legal action against potential fraud and abuse especially in the health care industry.

Furthermore, our business exposes our Medical Groups and Privia Providers to potential medical malpractice, professional negligence or other related actions or claims that are inherent in the provision of healthcare services.

Our management services organizations and ACOs could also be subject to malpractice claims based upon an allegation that we limited medically necessary services or were otherwise negligent in setting incentives that were adverse to patient outcomes.

These claims, with or without merit, could cause us to incur substantial costs, and could place a significant strain on our financial resources, divert the attention of management from our core business, harm our reputation and adversely affect our ability to attract and retain patients, any of which could have a material adverse effect on our business, financial condition and results of operations.

Although we and our Medical Groups and Privia Providers maintain third-party professional liability insurance coverage, it is possible that claims against us may exceed the coverage limits of our insurance policies, or the particular claim could be excluded from coverage (for example, a tort claim or lack of patient consent claim).

Even if any professional liability loss is covered by an insurance policy, these policies typically have substantial deductibles for which we are responsible.

Professional liability claims in excess of applicable insurance coverage could have a material adverse effect on our business, financial condition and results of operations.

In addition, any professional liability claim brought against us, with or without merit, could result in an increase of our professional liability insurance premiums.

Insurance coverage varies in cost and can be difficult to obtain, and we cannot guarantee that we will be able to obtain insurance coverage in the future on terms acceptable to us or at all.

If our costs of insurance and claims increase, then our earnings could decline.

Our business depends on our ability to effectively invest in, implement improvements to and properly maintain the uninterrupted operation, data integrity and security of our information technology and other business systems.

Our business is highly dependent on maintaining effective information systems as well as the integrity and timeliness of the data we use to serve our Privia Providers’ patients, support our Privia Providers and care teams, monitor and manage our ACOs, monitor and manage, including reporting on behalf of, our management services organizations, and to otherwise operate our business.

Because of the large amount of data that we collect and manage, it is possible that hardware failures or errors in our systems could result in data loss or corruption or cause the information that we collect to be incomplete or contain inaccuracies that our customers regard as significant.

If our data were found to be inaccurate or unreliable due to fraud, corruption or other error, or if we, or any of the third-party service providers we engage, were to fail to maintain information systems and data integrity effectively, we could experience operational disruptions that may impact our Privia Physicians, Medical Groups, health system or hospital partners, patients and our commercial plan customers, as well as our compliance with reporting obligations under the Medicare program, Medicare Advantage plans and the MSSP, and commercial VBC arrangements, and hinder our ability to provide services, establish appropriate pricing for our services, retain and attract Medical Groups and Privia Physicians, manage VBC obligations, determine total cost of care and spend, establish appropriate reserves, report financial results timely and accurately, and maintain regulatory compliance, among other things.

We are currently implementing software for a number of new applications and services.

If our solutions do not function reliably or fail to satisfy user expectations, we may lose or fail to grow our Medical Groups, Privia Provider relationships and patient volumes, we or our Medical Groups could face liability claims, and our Medical Groups, affiliate providers, health system partners, and ACO participants may attempt to terminate their relationships with us.

This could damage our reputation and impair our ability to attract or maintain Medical Groups, Privia Providers, patients and relationships with commercial payers.

Medical Groups, Privia Providers and their patients depend on our call center support services to resolve their operational concerns including technical issues relating to the Privia Technology Solution and services and patient billing inquiries.

It is difficult to predict demand for call center support services, and if demand increases significantly, we may be unable to provide satisfactory support services in the short- and long-term to our Privia Physicians and their patients, particularly as we increase the size of our Privia Physicians and patient bases.

We also may be unable to modify the format of our support services to compete with changes in support services provided by competitors.

If we are unable to address our Privia Physicians and their patients’ needs in a timely fashion or further develop and enhance our support services, or if a Privia Physician or patient is not satisfied with the quality of work performed by us or with the call center support services rendered, then we could incur additional costs to address the situation or, in certain markets, be required to issue credits or incur penalties related for such untimely or poor performance.

In addition, our profitability may be impaired and our Privia Physicians and their patients’ dissatisfaction with our support services could damage our ability to retain Medical Groups, Privia Physicians and their patients.

Such Medical Groups or Privia Physicians may not renew their contracts, seek to terminate their relationship with us or renew on less favorable terms.

Moreover, negative publicity related to our Medical Groups and Privia Physician relationships, regardless of its accuracy, may further damage our business by affecting our reputation or ability to compete for new Privia Physicians in the market.

If any of these were to occur, our revenue may decline and our business, financial condition and results of operations could be adversely affected.

Our business depends on our ability to effectively invest in, implement improvements to and properly maintain our information technology and other business systems.

Our information technology strategy and execution are critical to our continued success.

1 unchanged sentence

Our success is dependent, in large part, on maintaining the effectiveness of existing technology systems and continuing to deliver and enhance technology systems that support our business processes in a cost-efficient and resource-efficient manner.

Increasing regulatory and legislative changes will place additional demands on our information technology infrastructure that could have a direct impact on resources available for other projects tied to our strategic initiatives.

recent trends toward greater patient engagement in health care require new and enhanced technologies, including more sophisticated applications for mobile devices.

Increasing regulatory and legislative changes may place additional demands on our information technology infrastructure, which could impact availability of resources for other projects tied to our strategic initiatives.

In addition, recent trends toward greater patient engagement in health care require new and enhanced technologies, including more sophisticated applications for mobile devices.

Connectivity among technologies is becoming increasingly important.

28 unchanged sentences

Additionally, in recent years, individuals and groups have begun acquiring intellectual property assets for the purpose of making claims of infringement and attempting to extract settlements from companies like ours.

We may also face allegations that our employees have

misappropriated the intellectual property or proprietary rights of their former employers or other third parties.

We may also face allegations that our employees have misappropriated the intellectual property or proprietary rights of their former employers or other third parties.

It may be necessary for us to initiate litigation to defend ourselves in order to determine the scope, enforceability and validity of third-party intellectual property or proprietary rights, or to establish or enforce our respective rights.

9 unchanged sentences

Some third parties may be able to sustain the costs of complex litigation more effectively than we can because they have substantially greater resources.

Even if resolved in our favor, litigation or other legal proceedings relating to intellectual property claims may cause us to incur significant expenses, and could distract our technical and management personnel from their normal responsibilities.

Even if resolved in our favor, litigation or other legal proceedings relating to intellectual property claims may cause us to incur significant expenses, and could divert our technical personnel and management’s attention from the operation of our business.

In addition, there could be public announcements of the results of hearings, motions or other interim proceedings or developments, and if securities analysts or investors perceive these results to be negative, it could have a material adverse effect on the price of our common stock.

Moreover, any uncertainties resulting from the initiation and continuation of any legal proceedings could have a material adverse effect on our ability to raise the funds necessary to continue our operations.

Assertions by third parties that we infringe, misappropriate or otherwise violate their intellectual property rights could therefore have a material adverse effect on our business, financial condition and results of operations.

Assertions by third parties that we

infringe, misappropriate or otherwise violate their intellectual property rights could therefore have a material adverse effect on our business, financial condition and results of operations.

If we are unable to protect the confidentiality of our trade secrets, know-how and other proprietary and internally developed information, the value of our technology could be adversely affected.

5 unchanged sentences

However, we may fail to enter into such agreements with all of our employees, independent contractors, consultants, customers and other companies, and these agreements may not be self-executing, or they may be breached and we may not have adequate remedies for such breach.

Moreover, third parties may independently develop similar or equivalent proprietary information or otherwise gain access to our trade secrets, know-how and other internally developed information.

Moreover, third parties may independently develop similar or equivalent proprietary information or otherwise gain access to our trade secrets, know-how and other internally developed information and the value of our technology could be adversely impacted.

Any restrictions on our use of, or ability to license, data, or our failure to license data and integrate third-party technologies, could have a material adverse effect on our business, financial condition and results of operations.

8 unchanged sentences

In addition, data providers could fail to adhere to our quality control standards in the future, causing us to incur additional expense to appropriately utilize the data.

If a substantial number of data providers were to withdraw or restrict their data, or if they fail to adhere to our quality control standards, and if we are unable to identify and contract

with suitable alternative data suppliers and integrate these data sources into our service offerings, our ability to provide appropriate services to our Privia Physicians, Medical Groups, health system or hospital partners, patients, and commercial payer customers could be materially adversely impacted, which could have a material adverse effect on our business, financial condition and results of operations.

If a substantial number of data providers were to withdraw or restrict their data, or if they fail to adhere to our quality control standards, and if we are unable to identify and contract with suitable alternative data suppliers and integrate these data sources into our service offerings, our ability to provide appropriate services to our Privia Physicians, Medical Groups, health system or hospital partners, patients, and commercial payer customers could be materially adversely impacted, which could have a material adverse effect on our business, financial condition and results of operations.

We also integrate into our internally developed applications and use third-party software to support our technology infrastructure.

9 unchanged sentences

Companies that incorporate open source software into their technologies have, from time to time, faced claims challenging the use of open source software and/or compliance with open source license terms.

As a result, we could be subject to suits by parties claiming ownership of what we believe to be open source software or claiming noncompliance with open source licensing terms.

As a result, we could be subject to suits by parties claiming ownership of what we believe to be open source software or claiming noncompliance with open source

licensing terms.

Some open source software licenses require users who use software containing open source software to publicly disclose all or part of the source code to such software and/or make available any derivative works of the open source code, which could include valuable proprietary code of the user, on unfavorable terms or at no cost.

7 unchanged sentences

If we inappropriately use or incorporate open source software subject to certain types of open source licenses that challenge the proprietary nature of our technology-enabled platform and service, we may be required to re-engineer our platform, discontinue the commercialization of our platform or take other remedial actions, any of which could adversely impact our business, financial condition and results of operations.

We may face risks associated with our use of certain artificial intelligence and machine learning models.

Our business utilizes artificial intelligence (AI) and machine learning technologies, to add AI-based applications to our offering and to drive efficiencies in our business.

Further, certain of our third-party vendors utilize AI and machine learning technologies in furnishing services to us.

As with many technological innovations, AI presents risks and challenges that could affect its adoption, and therefore our business.

Our offerings utilize, and we plan to further examine, develop and introduce, machine learning algorithms, predictive analytics, and other AI technologies to offer new applications, upgrade our solutions and enhance our capabilities, among other things, to identify trends, anomalies and correlations, provide alerts and initiate business processes.

If these AI or machine learning models are incorrectly designed, the performance of our products, services, and business, as well as our reputation, could suffer or we could incur liability through the violation of laws or contracts to which we are a party.

Additionally, we may make future investments in adopting AI and machine learning technologies across our business, including introducing generative AI capabilities within our Technology Platform Solution.

AI and machine learning technologies are complex and rapidly evolving, and we face significant competition from other companies in our industry as well as an evolving regulatory

Our efforts in developing AI and machine learning technology may not succeed and our competitors may be able to deploy the technology faster.

We may further be exposed to competitive risks related to the adoption and application of new technologies by established market participants or new entrants, and others.

The speed of technological development may prove disruptive to some of our markets if we are unable to maintain the pace of innovation.

In addition, market acceptance of artificial intelligence and machine learning technologies is uncertain.

These efforts, including the introduction of new products or changes to existing products, may result in new or enhanced governmental or regulatory scrutiny, litigation, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results.

Changes to existing regulations, their interpretation or implementation or new regulations could impede our use of AI and machine learning technology and also may increase our estimated costs in this area.

In addition, market acceptance of AI and machine learning technologies is uncertain, and we may be unsuccessful in our product development efforts.

We face risks associated with healthcare technology initiatives, including those related to sharing patient data and interoperability, as well as our use of certain artificial intelligence and machine learning models.

The federal government is working to promote the adoption of health information technology to improve healthcare, including through the nationwide health information network exchange.

As the health information technologies have become widespread, the focus has shifted to increasing patient access to health care data and interoperability.

The 21 st Century Cures Act and its implementing regulations promote information sharing by prohibiting information blocking by healthcare providers and certain other entities.

Information blocking is defined as engaging in activities likely to interfere with the access, exchange or use of electronic health information, except as required by law or specified by HHS as a reasonable and necessary activity.

In addition, HHS incentivizes the adoption and meaningful use of certified EMR technology through its Promoting Interoperability Programs.

In a final rule published in July 2024, MIPS-eligible clinicians (including group practices) that commit information blocking will not be considered meaningful EMR users during the calendar year for of the performance period in which OIG refers its determination to CMS, resulting in a zero score in the MIPS Promoting Interoperability category, which would negatively affect reimbursement.

Under the same rule, a provider that is an ACO, ACO participant, or ACO provider or supplier and that commits information blocking may be ineligible to participate in the MSSP for a period of at least one year.

Our business utilizes, and may invest in the future in, AI, predictive analytics and other AI technologies to add AI-based applications to our offering to drive efficiencies in our business, offer new applications, upgrade our solutions and security, and enhance our capabilities.

In addition, certain of our third-party vendors utilize AI in furnishing products and services to us and our Medical Groups.

These efforts, including the design and introduction of new products and services or changes to existing products and services, may result in new or enhanced governmental or regulatory scrutiny, litigation, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results.

Further, information systems, AI and other predictive analytics are susceptible to flaws, biases, malfunctions or manipulations, which may disrupt our and our Medical Groups’ operations, result in erroneous decision-making, elevate our and our Medical Groups’ cyber risk profile, or expose us to liability.

Current and future initiatives related to health care technology (including AI and other predictive algorithms), data sharing and interoperability may require changes to the operations of the Company and its Medical Groups, impose new and complex compliance obligations and require investments in infrastructure.

For example, HHS finalized a rule in December 2023 imposing transparency requirements for AI and other predictive algorithms that are part of certified health information technology.

Federal and state legislative and regulatory bodies, including at the executive level, continue to signal increased scrutiny and potential rulemaking surrounding the creation, adoption, and leveraging of AI- based or AI-enhanced tools, systems, and functions.

The Company and its Medical Groups may be subject to financial penalties or other disincentives or experience reputational damage for failure to comply with applicable laws and regulations.

Changes to existing regulations, their interpretation or implementation or new regulations could impede our use of AI and also may increase our estimated costs in this area.

Further, if we are not successful in our efforts to innovate, the performance of our various products, services, and business, as well as our reputation, could suffer or we could incur liability through the violation of laws or contracts to which we are a party.

Any of these factors could adversely affect our business, financial condition, and results of operations.

The AI field is complex and rapidly evolving, and we face significant competition from other companies in our industry.

Our efforts in developing and deploying AI may not succeed and our competitors may be able to deploy the technology faster.

We may further be

exposed to competitive risks related to the adoption and application of new technologies by established market participants or new entrants, and others, and market acceptance of AI is uncertain.

The speed of technological development may prove disruptive to some of our markets if we are unable to maintain the pace of innovation.

Further, professionals specializing in development, deployment, and enterprise adoption of AI represent a niche pool of qualified individuals.

Other participants in our market may be more effectively equipped in terms of financial position and underlying technological resources to recruit and/or retain such individuals.

To compete effectively we must also be responsive to technological change, potential regulatory developments, and public scrutiny.

Our use, disclosure, and other processing of personal information, including health-related information, is subject to HIPAA, other federal and state privacy and security regulations, and contractual obligations, and our actual or perceived failure to comply with those regulations or contractual obligations could result in significant liability or reputational harm and, in turn, a material adverse effect on our patient base and revenue.

As discussed above under “ We conduct business in a heavily regulated industry, which increases our costs and could restrict the conduct of our business, and if the Company or our Medical Groups fail to comply with the extensive applicable healthcare laws and government regulations, which may change from time to time, we could suffer penalties, be required to make significant changes to our operations, or experience reputational harm, any or all of which may adversely affect our business” , numerous state and federal laws and regulations govern the collection, dissemination, use, privacy, confidentiality, security, availability, integrity, and other processing of PHI and personal information, including HIPAA.

HIPAA requires covered entities, like us, our Owned or Non-Owned Medical Groups, and their business associates to develop and maintain policies and procedures with respect to PHI that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information.

Our Medical Groups may be all participants in an “Affiliated Covered Entity” or an “Organized Health Care Arrangement” under HIPAA, which groups of legally separate covered entities that consider themselves a single covered entity due to affiliation, some common control or ownership, or through clinical integration and/or care coordination.

Participation in an affiliated covered entity or an organized health care arrangement allows us to share certain HIPAA compliance efforts but also provides for joint and several liability for HIPAA violations among all the participants in the Affiliated Covered Entity.

In addition to our status as a covered entity, our management services organizations and ACOs may also be “business associates” to our Medical Groups and ACO participants.

Entities that are found to be in violation of HIPAA as the result of a breach of unsecured PHI, a complaint about privacy practices or an audit by the U.S.

Department of Health and Human Services (“HHS”), may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance.

HIPAA also authorizes state attorneys general to file suit on behalf of their residents.

Courts may award damages, costs and attorneys’ fees related to violations of HIPAA in such cases.

While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI.

HIPAA further has certain patient notification requirements for breaches or non-permitted use or disclosure of PHI, which include thresholds for reporting to HHS and local media, and such public reporting may also increase the risk of civil suits related to privacy incidents.

Numerous other federal and state laws and regulations protect the confidentiality, privacy, availability, integrity and security of PHI and other types of personal information.

These laws and regulations are often uncertain, contradictory, and subject to changed or differing interpretations, and we expect new laws, rules and regulations regarding privacy, data protection, and information security to be proposed and enacted in the future, any of which could impact our business.

For example, the California Consumer Privacy Act of 2018, as amended (the “CCPA”) affords consumers certain privacy protections and rights, including the right to request that a business delete their personal information unless it is necessary for the business to maintain for certain purposes, to direct a business to correct errors in their personal information, and to limit the use and disclosure of sensitive information.

They have the right to know if their personal information is being sold or shared and the right to opt out of the “sale” or “sharing” of personal information, as those terms are defined under the CCPA.

Further, the CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that may increase data breach litigation.

Compliance with the evolving landscape of privacy, data protection and information security laws and regulations could be time-consuming and expensive and require changes to our current processes and practices, and any failure by us or our Medical Groups to comply with these and any other comprehensive privacy laws passed at the state or federal level may result in regulatory enforcement action, civil litigation and reputational harm.

While we have implemented data privacy and security measures in an effort to comply with applicable laws, regulations, and contractual obligations relating to privacy and data protection, some PHI and other personal information or confidential information is transmitted to us by third parties, who may not implement adequate security and privacy measures.

Additionally, we transmit PHI and other personal information or confidential information to third parties, which carries the risk of breach despite our security and privacy measures.

Further, any PHI or other personal information residing with a Privia Physicians’ legacy practice entity pursuant to our Support Services Agreement with such entity may not be subject to adequate security and privacy measures, which may result in a breach of its Business Associate Agreement, or BAA, with the relevant covered entity.

Although a business associate may be

independently found liable for a breach of the privacy or security requirements of HIPAA, we could also be held liable for such breach as the covered entity, result in government-imposed fines, orders requiring that we or these third parties change our or their practices, or criminal charges, any or all of which could adversely affect our business.

Additionally, we publish privacy policies and other documentation regarding our collection, processing, use and disclosure of personal information.

Although we endeavor to comply with our published policies and other documentation, we may at times fail to do so or may be perceived to have failed to do so.

Moreover, despite our efforts, we may not be successful in achieving compliance, including if our employees, contractors, service providers or vendors fail to comply with our published policies and documentation.

Such failures can subject us to potential local, state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices.

Claims that we have violated individuals’ privacy rights or failed to comply with data protection laws or applicable privacy notices, even if we are not found liable, could be expensive and time-consuming to defend, result in reputational harm, or have a material adverse impact on our business and our financial results.

Human Capital Risks

We depend on our senior management team and other key employees, and the loss of one or more of these employees or an inability to attract, recruit, motivate, develop and retain other highly skilled employees could harm our business.

2 unchanged sentences

employee expectations;

the effectiveness of our talent strategies and benefits and wellbeing programs, including compensation;

the effectiveness of our talent strategies and benefits and well-being programs, including compensation;

the effectiveness of our training programs and our ability to effectively integrate employees into our business and operating model;

and fluctuations in the labor market, including rising wages and competition for talent, which has increased due to persistent labor shortages and wage inflation.

9 unchanged sentences

Furthermore, our business and results of operations could be adversely affected if we fail to adequately plan for and successfully carry out the succession of our key executives and senior leaders.

For additional information, see “Human Capital Resources.”

Our Medical Groups are concentrated in Virginia, Maryland, the District of Columbia, Texas, Florida, and Georgia, and we may not be able to successfully establish a presence in new geographic markets.

A substantial portion of our revenue is driven by our medical practices in Virginia, Maryland, the District of Columbia, Texas, Florida, and Georgia.

As a result, our exposure to many of the risks described herein are not mitigated by a diversification of geographic focus.

Furthermore, due to the concentration of our operations in these states, our business may be adversely affected by economic conditions, natural disasters, contagious disease outbreaks, including COVID-19, political unrest, and other conditions over which we have no control that disproportionately affect these states as compared to other states.

Such conditions could adversely affect our operating results and disrupt the operation of our Medical Groups and Privia Providers.

To continue to expand our operations to other regions of the United States, we will have to devote resources to identifying and exploring such perceived opportunities.

Thereafter, we will have to, among other things, recruit and retain qualified personnel, develop new Medical Groups and establish new relationships with physicians and other healthcare providers.

In addition, we would be required to comply with laws and regulations of states that may differ from the ones in which we currently operate, and could face competitors with greater knowledge of such local markets.

We anticipate that further geographic expansion will require us to make a substantial investment of management time, capital and/or other resources.

There can be no assurance that we will be able to continue to successfully expand our operations in any new geographic markets.

Our overall business results may suffer from an economic downturn.

During periods of high unemployment and inflation, governmental entities often experience budget deficits as a result of increased costs and lower than expected tax collections.

These budget deficits at federal, state and local government entities have decreased, and may continue to decrease, spending for federal health care programs, including Medicare, Medicaid and similar programs, which represent significant payer sources for our Medical Groups.

Other risks we face during periods of high unemployment include potential declines in the patient base, potential increases in the uninsured and underinsured populations, which could negatively impact our payer mixes, a contracting of discretionary spending by our patient base, which could negatively affect demand for the services of our Privia Physicians, and further difficulties in our collecting patient co-payment and deductible receivables.

We must attract and retain highly qualified personnel, including non-physician clinicians, in order to execute our growth plan.

Competition for highly qualified personnel with healthcare experience is intense and changes in the labor market have increased such competition while increasing pressure on wage growth to retain our existing personnel.

We and our Medical Groups have, from time to time, experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications at acceptable salary ranges.

Further, Privia Physicians may have similar difficulty in hiring and retaining support staff.

Many of the companies and healthcare providers with which we compete for experienced personnel have greater resources than we have.

If we hire employees from competitors or other companies or healthcare providers, their former employees may attempt to assert that these employees or we have breached certain legal obligations, resulting in a diversion of our time and resources.

If we fail to attract new personnel or fail to retain and motivate our current personnel, our business and future growth prospects could be adversely affected.

Further, such scarcity and demand can significantly drive up labor costs associated with hiring and retaining highly qualified personnel, which could negatively affect our results of operations, financial condition and cash flows.

For additional information, see “Business - Human Capital Resources.”

The operations and growth strategy of the Company and its Medical Groups depend on our ability to recruit and retain qualified talent, including physicians and non-physician practitioners.

The operations and growth strategy of the Company and its Medical Groups depend on the efforts, abilities, and experience of Privia Providers and other medical support personnel.

Changes in the healthcare industry’s labor market have generally increased labor costs and competition for qualified and experienced individuals.

In some markets in which our business operates or may consider operating, there are shortages of physicians, non-physician clinicians or other medical support personnel.

We and our Medical Groups have experienced, and expect to continue to experience, difficulty in hiring and retaining qualified individuals at acceptable salary ranges.

We may be required to enhance wages and benefits to recruit and retain physicians, non-physician clinicians and medical support personnel.

If the Company and its Medical Groups are unable to recruit or retain a sufficient number of qualified personnel at an acceptable cost, we may not be able to fully implement our operating model in existing or new markets or execute our growth strategy.

In particular, the success of our business depends, in part, on the number, specialties, and quality of Privia Physicians, the utilization practices of these physicians, maintaining good relations with these physicians, and physician expenses, such as salary and medical malpractice expenses, as well as our ability to recruit a sufficient number of Privia Providers from the overall pool of physicians and non-physician practitioners and state-level restrictions on autonomous practice by non-physician practitioners.

Our operating model and growth strategy rely on aggregating a sufficient number of Privia Physicians in each Medical Group, as the number of Privia Physicians in a particular market impacts our attributed lives for VBC purposes, our costs and our Medical Groups’ costs, and our revenues from management services.

The departure of a large number of Privia Physicians or certain of our Affiliated Practices could negatively impact our financial performance and ability to perform under our VBC arrangements.

Further, the loss of any Privia Physician could result in that physician’s patient population shifting their care preferences to a non-Privia provider, which could negatively affect our revenues.

We may not be able to recruit new providers to replace the services of the departing Privia Physician, and we may not be able to satisfy certain obligations under third-party payer programs.

We and our Medical Groups may face increased challenges recruiting and retaining quality physicians as the physician population reaches retirement age, particularly if there are shortages of physicians willing and able to provide comparable services.

Further, the ability to recruit and contract with physicians is closely regulated.

For example, the types, amount and duration of compensation and assistance that can be provided when recruiting

physicians is limited by the federal Anti-Kickback Statute, the Stark Law, and other applicable laws and regulations intended to prevent fraud and abuse.

The Company and its Medical Groups continue to face increasing competition recruiting and retaining quality physicians and non-physician clinicians, including from health systems, independent physician practice management companies, and health insurers and private equity-backed companies seeking to acquire or affiliate with physicians or physician practices.

Healthcare providers and companies with which we and our Medical Groups compete for personnel may have greater resources than we have.

Our ability to recruit and retain physicians and non-physician clinicians may be negatively impacted if we are unable to provide adequate managerial support, support personnel, or technologically advanced equipment and facilities.

In addition, our ability to compete for personnel may be affected by the unenforceability of non-compete restrictions under state and federal laws and regulations, such as the Federal Trade Commission’s recently-vacated rule banning non-compete restrictions for workers.

If we or our Medical Groups hire individuals formerly associated with competitors, their former employers may attempt to enforce non-compete provisions and similar restrictions, resulting in a diversion of our time and resources.

Further, former employers may pursue legal claims against us or our Medical Groups on the basis of interference with contractual relationships.

Labor costs associated with hiring and retaining qualified personnel may negatively affect our results of operations, financial condition, and cash flows.

For additional risks related to attracting and retaining highly qualified personnel, see “ We depend on our senior management team and other key employees, and the loss of one or more of these employees or an inability to attract, recruit, motivate, develop and retain other highly skilled employees could harm our business.”

Failure to attract and retain talent within our growth and business development teams could impede our growth.

We believe that our future growth will depend on the continued development of our growth team and its ability to obtain new Privia Physicians while our implementation team and practice consultants manage existing affiliate physician relationships.

Additionally, we rely upon our business development staff to identify and develop potential relationships with new Medical Groups and health system or hospital partners.

Identifying and recruiting qualified personnel and training them requires significant time, expense and attention especially given the complexity of our business and the Privia operating model.

It can take six months or longer before a new sales representative is fully trained and productive.

Our business may be adversely affected if our efforts to expand and train our direct sales force and business development staff do not generate a corresponding increase in revenue.

Our management team has limited experience managing a public company.

8 unchanged sentences

For additional risks related to our corporate culture, see “ We depend on our senior management team and other key employees, and the loss of one or more of these employees or an inability to attract, recruit, motivate, develop and retain other highly skilled employees could harm our business .”

If certain of our vendors do not meet our needs, if there are material price increases on vendor services and products, if we do not price our services correctly, if our Medical Groups are not reimbursed or adequately reimbursed for the costs of any vendor services or products borne by such Medical Groups, or if we are unable to effectively access new or replacement services or products, it could negatively impact our ability to effectively provide the services we offer and could have a material adverse effect on our business, results of operations, financial condition and cash flows.

We have vendors that may be the sole or primary source of certain services, products or technology critical to the services either we or our Privia Providers furnish, or to which we have committed obligations to make purchases, sometimes at particular prices.

If any of these vendors do not meet our needs for the services or products they supply, including in the event of a product recall, shortage or dispute, and we are not able to find adequate alternative sources, if we experience material price increases from these vendors that we are unable to mitigate, or if the costs of some of the products or services that we purchase are borne by our Medical Groups and such Medical Groups are not reimbursed or not adequately reimbursed for such products or services, it could have a material adverse effect on our business, results of operations, financial condition and cash flows.

In addition, the technology related to the services or products critical to the services we provide is subject to new developments that may result in superior products.

If we are not able to access new or replacement services or products on a cost-effective basis or if vendors are not able to fulfill our requirements for such services or products, or unable to scale as fast as our operations grow, we could face Privia Physician attrition and other negative consequences which could have a material adverse effect on our business, results of operations, financial condition and cash flows.

For additional risks related to our third-party vendors, see “We rely on third-party vendors to host and maintain our technology-enabled platform.”

With respect to any Medicare Advantage plans with which our Medical Groups participate, our records and submissions to such plans may contain inaccurate or unsupportable information regarding risk adjustment scores of such plans’ enrollees, which could cause us to overstate or understate the average health care burden of such population, which could result in an incorrect statement of our revenue and could subject us and our Medical Groups to various penalties.

We submit claims and encounter data, on behalf of our participating Medical Groups, to applicable Medicare Advantage plans that are used to establish the annual, average Medicare Risk Adjustment Factor, or RAF, scores attributable to each Medical Group’s Medicare Advantage population.

These RAF scores determine, in part, the revenue to which the health plans and, in turn, our Medical Groups are entitled for the provision of medical care to such population.

CMS has made significant changes to the structure of its Hierarchical Condition Categories (HCC) codes, Version 28 (V28), which will likely result in lower Risk Adjustment Factor (RAF) scores in 2024 for our Medical Groups entering into new Medicare Advantage agreements.

The data submitted to CMS by each health plan is based, in part, on medical charts and diagnosis codes that our Privia Providers prepare and we submit to the health plans.

Each health plan generally relies on us and our Privia Providers to appropriately document and support such RAF data in our medical records.

Each health plan also relies on us and our Privia Providers to appropriately code claims for medical services provided to members.

Erroneous claims and erroneous encounter records and submissions could result in inaccurate revenue and risk adjustment payments, which may be subject to correction or retroactive adjustment in later periods.

This corrected or adjusted information may be reflected in financial statements for periods subsequent to the period in which the revenue was recorded.

We might also need to refund a portion of the revenue that we received, which refund, depending on its magnitude, could damage our relationship with the applicable health plan and could have a material adverse effect on our business, results of operations, financial condition and cash flows.

Additionally, CMS audits Medicare Advantage plans for documentation to support RAF-related payments for enrollees chosen at random.

The Medicare Advantage plans ask providers to submit the underlying documentation for members that they serve.

It is possible that claims associated with members with higher RAF scores could be subject to more scrutiny in a CMS or plan audit.

There is a possibility that a Medicare Advantage plan may seek repayment from us, our ACOs, or our Medical Groups should CMS make any payment adjustments to the Medicare Advantage plan as a result of its audits.

CMS has indicated that payment adjustments will not be limited to RAF scores for the specific MA enrollees for which errors are found but may also be extrapolated to the entire MA plan subject to a particular CMS contract.

Based on a final rule issued by CMS in January 2023, although 2011 to 2017 plan years are still subject to audit, overpayments to MA plans that are identified as a result of a Risk Adjustment Data Validation, or RADV, audit will only be subject to extrapolation for plan year 2018 and any subsequent plan year.

In addition, CMS will not apply an adjustment factor, known as Fee-For-Service, or FFS, Adjuster in RADV audits to account for potential differences in diagnostic coding between the Medicare Advantage program and Medicare FFS program.

Although we are continuing to assess the potential impact this final rule may have on our business and operations, such adjustments could adversely affect our revenue, financial conditions and results of operations.

Moreover, we may face civil and criminal liability under healthcare fraud and abuse laws, including, without limitation, the False Claims Act.

By way of example, in 2018, the Department of Justice, or the DOJ, reached a $270 million settlement agreement with HealthCare Partners Holdings, LLC based upon the organization’s internal coding policies and provider education that resulted in the submission of inappropriate diagnosis codes, and the inappropriate capture of historical diagnoses both of which inflated the organization’s RAF scores and resulted in inflated payment rates.

The DOJ alleged that such submissions constituted a civil False Claims Act violation.

In August 2021, Sutter Health agreed to pay $90 million to resolve allegations that it violated the False Claims Act by knowingly submitting inaccurate information about health status of beneficiaries enrolled in Medicare Advantage plans and entered into a five-year Corporate Integrity Agreement with the OIG.

More recently, in September 2023, the Cigna Group agreed to pay $172 million to settle False Claims Act allegations arising from its chart review program whereby it allegedly added diagnosis codes to its Medicare Advantage enrollees, thereby increasing RAF scores without removing diagnosis codes which were no longer applicable or supported by the chart review.

There can be no assurance that a Medicare Advantage plan in which our Medical Groups participate will not be randomly selected or targeted for review by CMS or that the outcome of such a review will not result in a material adjustment in our revenue and profitability, even if the information we submitted to the plan is accurate and supportable.

Further, although we have built safeguards in our provider education efforts and unreported diagnoses review, there can be no assurance that the CMS, the DOJ, the OIG, or a whistleblower would not allege such action constitutes a civil False Claims Act violation or, if pursued that we could successfully defend against such allegation.

In such event, even if we successfully defend against it, such an allegation could cause us to incur significant legal expenses, divert our management’s attention from the operation of our business and result in adverse publicity.

If the estimates and assumptions we use to determine the size of our total addressable market, or TAM, are inaccurate, our future growth rate may be impacted and our business could be harmed.

Market estimates and growth forecasts are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate.

The estimates and forecasts in this report relating to the size and expected growth of the TAM for available physicians with which our Medical Groups can affiliate may prove to be inaccurate.

Even if the markets in which we compete meet our size estimates and forecasted growth, our business could fail to grow at similar rates, if at all.

In addition to a sufficiently large TAM to allow us to affiliate with a sufficiently large number of physicians to make the

market economically viable, each market is evaluated to determine if there is sufficient reimbursement variation in fee schedules paid by commercial payers to physicians to create sufficient economic opportunity to allow such physicians to embrace our Privia operating model.

Our targeted TAM is also based on the assumption that the strategic approach that our solution enables for potential Privia Physicians will be more attractive to our available physicians than many competing opportunities.

If these assumptions prove inaccurate, our business, financial condition and results of operations could be adversely affected.

The use of funds made available under the CARES Act by our Medical Groups and Privia Physicians’ Affiliated Practices could adversely affect our business.

Some of our Privia Physicians and/or their Affiliated Practices may have outstanding loan obligations under the Paycheck Protection Program implemented pursuant to the Coronavirus Aid, Relief, and Economic Security Act, or the CARES Act.

Although we are not liable for such loan amounts, our Privia Physicians’ inability to either have such loan amounts forgiven or pay such loan amounts could negatively impact our business, including due to responding to Privia Physician bankruptcy filings and, potentially, federal seizure of assets, including federal health care program funds, which could include funds owing to us, such as management fees.

Although our claims to such amounts may ultimately be released, the cost of collections could increase from our standard business model, which will negatively affect both our revenue and profits.

Because of the Paycheck Protection Program affiliation rules, none of our Owned Medical Groups (as opposed to our Privia Physicians’ Affiliated Practices) borrowed any amounts under the program.

One of the Non-Owned Medical Groups did partake in the Paycheck Protection Program, but the outstanding balance has already been forgiven.

Likewise, none of our Medical Groups partook of CMS’ Accelerated and Advance Payment Programs under the CARES Act.

Each of our Medical Groups did, however, accept funds distributed by HHS under the Provider Relief Fund enacted as part of the CARES Act.

Given that each of our Medical Groups received in excess of $10,000 under the Provider Relief Fund, each Medical Group is subject to HHS’ reporting requirements for the use of such funds.

Two of our Owned Medical Groups are subject to heightened reporting requirements for providers receiving more than $500,000 from the Provider Relief Fund.

Independent audits were conducted to provide assurance that the Owned Medical Groups’ receipt of funds from HHS Provider Relief Fund and the American Rescue Plan followed the requirements of the statutes, regulations and the terms and conditions of the awards.

It was filed in accordance with the requirements of the Consolidated Appropriations Act of 2021 and additional guidance issued by HHS.

Although continued reporting obligations exist for these Owned Medical Groups, the amount of funds distributed for such periods will no longer be subject to the single audit requirements.

The Owned Medical Groups will continue to have obligations regarding maintenance of documentation of such records and costs, and remain potentially subject to additional audits by HHS, the OIG, and the Pandemic Response Accountability Committee.

Any recipient identified as providing inaccurate information will be subject to recoupment and deliberate omission, misrepresentation or falsification of any information associated with such reporting may be punishable by criminal, civil or administrative penalties, including but not limited to revocation of Medicare billing privileges, exclusion from federal health care programs, and/or the imposition of fines, civil damages and/or imprisonment.

The law relative to the Provider Relief Fund as well as guidance from HHS continues to evolve and we cannot say definitively whether HHS will agree with our assessment that funds were appropriately utilized by the Owned Medical Groups.

In the event that such funds were used inappropriately or revenue losses were insufficient, it would be necessary to reimburse HHS for Provider Relief Funds received by our Owned Medical Groups, which would have a material adverse effect on our business, financial condition, and operations.

Further, a failure to adequately report and maintain records related to the use of amounts from the Provider Relief Funds could have a materially adverse effect on our business, financial condition and the results of operations.

Numerous state and federal laws and regulations govern the collection, dissemination, use, privacy, confidentiality, security, availability, integrity, and other processing of PHI and personal information.

These laws and regulations include HIPAA.

HIPAA establishes a set of national privacy and security standards for the protection of PHI by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates with whom such covered entities contract for services.

In addition to our status as a covered entity, our management services organizations and ACOs may also be “business associates” to our Medical Groups and ACO participants.

Entities that are found to be in violation of HIPAA as the result of a breach of unsecured PHI, a complaint about privacy practices or an audit by the U.S.

Department of Health and Human Services, or HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance.

HIPAA also authorizes state attorneys general to file suit on behalf of their residents.

Courts may award damages, costs and attorneys’ fees related to violations of HIPAA in such cases.

In addition, HIPAA mandates that the Secretary of HHS conduct periodic compliance audits of HIPAA covered entities and business associates for compliance with the HIPAA Privacy and Security Standards.

It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the Civil Monetary Penalty fine paid by the violator.

HIPAA further requires that patients be notified of any unauthorized acquisition, access, use or disclosure of their unsecured PHI that compromises the privacy or security of such information, with certain exceptions related to unintentional or inadvertent use or disclosure by employees or authorized individuals.

HIPAA specifies that such notifications must be made “without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.” If a breach affects 500 patients or more, it must be reported to HHS without unreasonable delay, and HHS will post the name of the breaching entity on its public website.

Breaches affecting 500 patients or more in the same state or jurisdiction must also be reported to the local media.

If a breach involves fewer than 500 people, the covered entity must record it in a log and notify HHS at least annually.

A non-permitted use or disclosure of PHI is presumed to be a breach under HIPAA unless the covered entity or business associate establishes that there is a low probability the information has been compromised consistent with requirements enumerated in HIPAA.

We are also subject to a provision of the federal 21st Century Cures Act that is intended to facilitate the appropriate exchange of health information.

In May 2020, the United States Department of Health and Human Services Office of the National Coordinator for Health Information Technology and CMS issued complementary new rules that are intended to clarify provisions of the 21st Century Cures Act regarding interoperability and information blocking and include, among other things, requirements surrounding information blocking, changes to ONC’s health IT certification program and requirements that CMS regulated payers make relevant claims/care data and provider directory information available through standardized patient access and provider directory application programming interfaces, or APIs, that connect to provider electronic health record systems, or EHRs.

The companion rules will transform the way in which healthcare providers, health IT developers, health information exchanges/health information networks, or HIEs/HINs, and health plans share patient information, and create significant new requirements for healthcare industry participants.

For example, the ONC rule, which went into effect on April 5, 2021, prohibits healthcare providers, health IT developers of certified health IT, and HIEs/HINs from engaging in practices that are likely to interfere with, prevent, materially discourage, or otherwise inhibit the access, exchange or use of electronic health information, or EHI, also known as “information blocking.” To further support access and exchange of EHI, the ONC rule identifies eight “reasonable and necessary activities” as exceptions to information blocking activities, as long as specific conditions are met.

Any failure to comply with these rules could have a material adverse effect on our business, results of operations and financial condition.

Numerous other federal and state laws and regulations protect the confidentiality, privacy, availability, integrity and security of PHI and other types of personal information.

State statutes and regulations vary from state to state, and these laws and regulations in many cases are more restrictive than HIPAA and its implementing rules.

For example, the California Consumer Privacy Act of 2018, as amended (the “CCPA”) affords consumers certain privacy protections and rights.

California residents have the right to request that a business delete their personal information unless it is necessary for the business to maintain for certain purposes, to direct a business to correct errors in their personal information, and to limit the use and disclosure of sensitive information.

The California Privacy Rights Act creates a new regulator responsible for enforcement of the CCPA, and the CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that may increase data breach litigation.

Additional states have passed and will continue to pass comprehensive privacy legislation with privacy protections and rights, and several additional privacy bills have been proposed both at the federal and state level that may result in additional legal requirements of their own that impact our business.

Failure to comply with these and any other comprehensive privacy laws passed at the state or federal level may result in regulatory enforcement action and damage to our reputation.

The potential effects of such legislation are far-reaching and may require us to modify our data processing practices and policies and to incur substantial costs and expenses to comply.

Further, in the event that new data privacy or security laws are implemented that impact our operations or patients, we may not be able to timely comply with such requirements, or such requirements may not be compatible with our current processes.

Changing our processes could be time consuming and expensive, and failure to timely implement required changes could subject us to liability for non-compliance.

Some states may afford private rights of action to individuals who believe their personal information has been misused.

This complex, dynamic legal landscape regarding privacy, data protection, and information security

creates significant compliance issues for us and potentially restricts our ability to collect, use and disclose data and exposes us to additional expense, adverse publicity and liability.

In the event that we are subject to or affected by the CCPA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

Furthermore, the Federal Trade Commission, or FTC, and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive.

For example, according to the FTC, failing to take appropriate steps to keep consumers’ personal information secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.

The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities.

Further, in July 2023, the FTC and the U.S.

Department of Health and Human Services' Office for Civil Rights (“OCR”) cautioned hospitals and telehealth providers about the privacy and security risks related to the use of online tracking technologies integrated into their websites or mobile apps that may be impermissibly be disclosing consumers’ sensitive personal health data to third parties.

Our technology-enabled platform and the other systems or networks used in our business may experience an increase in attempted cyber-attacks, targeted intrusion, ransomware, and phishing campaigns seeking to take advantage of shifts to employees working remotely using their household or personal internet networks.

The success of any of these unauthorized attempts could substantially impact our technology-enabled platform, the proprietary and other confidential data contained therein or otherwise stored or processed in our operations, and ultimately our business.

Any actual or perceived security incident also may cause us to incur increased expenses to improve our security controls and to remediate security vulnerabilities.

Additionally, we transmit PHI and other personal information or confidential information to third parties, which carries the risk of breach despite our security and privacy measures.

Moreover, it is possible that laws, rules and regulations relating to privacy, data protection, or information security may be interpreted and applied in a manner that is inconsistent with our practices or those of third parties who transmit PHI and other personal information or confidential information to us.

Although a business associate may be independently found liable for a breach of the privacy or security requirements of HIPAA, we could also be held liable for such breach as the covered entity.

If we or any third parties are found to have violated such laws, rules or regulations, it could result in government-imposed fines, orders requiring that we or these third parties change our or their practices, or criminal charges, which could adversely affect our business.

Complying with these various laws and regulations could cause us to incur substantial costs or require us to change our business practices, systems and compliance procedures in a manner adverse to our business.

Additionally, we publish privacy policies and other documentation regarding our collection, processing, use and disclosure of personal information.

Although we endeavor to comply with our published policies and other documentation, we may at times fail to do so or may be perceived to have failed to do so.

Such failures can subject us to potential local, state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices.

Claims that we have violated individuals’ privacy rights or failed to comply with data protection laws or applicable privacy notices, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business.

Any of the foregoing consequences could have a material adverse impact on our business and our financial results.

Macroeconomic Risks

Our overall business results may suffer from an economic downturn.

During periods of high unemployment and inflation, governmental entities often experience budget deficits as a result of increased costs and lower than expected tax collections.

Budget deficits at the federal level and within some state and local government entities have had a negative impact on spending for many health and human services programs, including Medicare, Medicaid and similar programs, which represent significant payer sources for our Medical Groups.

We anticipate that budget deficits, the growing magnitude of Medicare and Medicaid expenditures and the aging of the U.S.

population, among other factors, will continue to place pressure on government healthcare programs.

Other risks we face during periods of economic weakness and high unemployment

include potential declines in the numbers of patients seeking care, potential increases in the uninsured and underinsured populations, which could negatively impact payer mix, a contracting of discretionary spending by patients, which could negatively affect demand for the services of our Privia Providers, and increased difficulties collecting patient responsibility amounts (co-payments, deductibles, coverage exclusions).

A deterioration of public health conditions associated with a pandemic, epidemic or outbreak of an infectious disease in the markets in which we operate could adversely impact our business.

If a pandemic, epidemic, outbreak of infectious disease, or other widespread health crisis affects our markets, our business and operations could be adversely affected.

Any such crisis could diminish the public trust in healthcare facilities and providers, particularly those that are treating or have treated patients affected by infectious diseases, and cause changes in the utilization of healthcare services.

If any of our Medical Groups or Privia Providers are involved, or perceived as being involved, in treating patients with an infectious disease, patients might avoid seeking needed care or cancel elective procedures, and our reputation may be negatively affected.

Patient volumes may decline or volumes of insured and underinsured patients may increase, depending on the economic circumstances surrounding the pandemic, epidemic or outbreak.

In addition, a pandemic, epidemic or outbreak might adversely affect the business and operations of the Company and Medical Groups by causing a temporary shutdown or diversion of patients from Medical Groups, causing disruptions or delays in supply chains for materials and products, or by causing staffing shortages.

Further, we, our Medical Groups and Privia Providers could be unable to implement clinical initiatives to manage healthcare conditions of patients and appropriately document patient risk profiles, and any such public health crisis could impact our ability to accurately project medical cost trends.

A pandemic, epidemic or outbreak could also increase the clinical disease burdens of patients over time, reduce preventive care to manage more acute clinical conditions and have other effects that could result in unexpected increased medical expenses in future periods.

Although we have business resiliency plans to address circumstances including a future pandemic, the potential impact of, as well as the response of the public and applicable governments to, a future pandemic, epidemic or outbreak is difficult to predict and could adversely affect our business, results of operations, and financial condition.

Financial Risks

We have a history of net losses, we anticipate increasing expenses in the future, and we may not be able to maintain profitability.

We reported net income (loss) of $14.4 million, $23.1 million, and $(8.6) million for the years ended December 31, 2024, 2023 and 2022, respectively.

Our accumulated deficit is $(179.2) million and $(193.6) million as of December 31, 2024 and 2023, respectively.

These efforts may prove more expensive than we currently anticipate, and we may not succeed in increasing our revenue sufficiently to offset these higher expenses.

In addition to the expected costs to grow our business, we also expect to incur additional legal, accounting and other expenses as a newly public company.

If our growth rate were to decline significantly or become negative, it could adversely affect our financial condition and results of operations.

If we are unable to successfully address these risks and challenges as we encounter them, our business, results of operations and financial condition could be adversely affected.

Our failure to achieve or maintain profitability could negatively impact the value of our common stock.

Our ability to use our net operating losses to offset future taxable income may be subject to certain limitations.

3 unchanged sentences

As of December 31, 2024, we had approximately $47.2 million of federal and $30.1 million of state (post-apportioned state NOL) NOL carryforwards.

The federal NOL carryforwards for years before 2018 begin to expire in 2034 and the state NOL carryforwards begin to expire in 2034.

Changes in the ownership of our stock in the future, including as a result of future offerings, and some of which are outside of our control, could result in an ownership change under Section 382 of the Code (or applicable state law) after such date, which could significantly limit our ability to utilize our existing and future NOL carryforwards arising at any time prior to such ownership change.

General Risks

As a public reporting company, we are obligated to maintain proper and effective internal control over financial reporting in order to comply with Section 404 of the Sarbanes-Oxley Act.

If we fail to maintain effective internal control over financial reporting, we may not be able to accurately report our financial results or report them in a timely manner, which may adversely affect investor confidence in us .

Reporting obligations as a public company place a considerable strain on our financial and management systems, processes and controls, as well as on our personnel.

As a public company, we are required to document and test our internal control over financial reporting pursuant to Section 404 of the Sarbanes-Oxley Act so that our management can certify as to the effectiveness of our internal control over financial reporting.

Section 404(a) of the Sarbanes-Oxley Act (“Section 404(a)”) requires that management assess and report annually on the effectiveness of our internal control over financial reporting and identify any material weaknesses in our internal control over financial reporting.

Section 404(b) requires our independent registered public accounting firm to issue an annual report that addresses the effectiveness of our internal control over financial reporting.

Our compliance with Section 404(a) has required to incur substantial expenses and expend significant management efforts.

If we identify material weaknesses in our internal control over financial reporting in the future, our management will be unable to assert that our disclosure controls and procedures and our internal control over financial reporting is effective.

If we are unable to assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an unqualified opinion as to the effectiveness of our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports, the market price of our common stock could be adversely affected and we could become subject to litigation or investigations by Nasdaq, the SEC, or other regulatory authorities, which could require additional financial and management resources.

Negative publicity relating to our business, industry, Medical Groups or Privia Providers may have a material adverse effect on our financial results.

We may be negatively affected if another company in our industry, or if one of our Medical Groups or Privia Providers, engages in practices that subject our industry or business to negative publicity.

Negative publicity may result from judicial inquiries, unfavorable outcomes in lawsuits, social media, regulatory or governmental actions with respect to our services.

Negative publicity may cause increased regulation and legislative scrutiny of industry practices as well as increased litigation or enforcement action by civil and criminal authorities.

Additionally, negative publicity may increase our costs of doing business and adversely affect our profitability by impeding our ability to market our services, constraining our ability to price our services appropriately for the risks we are assuming, requiring us to change the services we offer or increasing the regulatory burdens under which we operate.

For additional risks related to negative publicity of our Medical Groups or Privia Providers, see “ If we are not able to maintain and enhance our reputation and brand recognition, including through the maintenance and protection of trademarks, our business and results of operations will be harmed.” and “If we cannot timely implement the Privia Technology Solution for Privia Physicians and new Medical Groups, or resolve Privia Provider and patients concerns, including any technical and billing issues, in a timely manner, we may lose Medical Groups, Privia Providers and their patients, and our reputation may be harmed.”

Increased attention to, and evolving expectations for, environmental, social, and governance (“ESG”) initiatives could increase our costs, harm our reputation, or otherwise adversely impact our business .

Companies across industries are facing increasing scrutiny from a variety of stakeholders related to their ESG and sustainability practices.

Expectations regarding voluntary ESG initiatives and disclosures may result in increased costs (including but not limited to increased costs related to compliance, stakeholder engagement, contracting and insurance), enhanced compliance or disclosure obligations, or other adverse impacts to our business, financial condition, or results of operations.

While we may at times engage in voluntary initiatives (such as voluntary disclosures, certifications, or goals, among others) to improve the ESG profile of the Company, such initiatives may be costly and may not have the desired effect.

Moreover, we may not be able to successfully complete such initiatives due to factors that are within or outside of our control.

Even if this is not the case, our actions may subsequently be determined to be insufficient by various stakeholders, and we may be subject to investor or regulator engagement on our ESG efforts, even if such initiatives are currently voluntary.

Certain market participants, including major institutional investors and capital providers, use third-party benchmarks and scores to assess companies’ ESG profiles in making investment or voting decisions.

Unfavorable ESG ratings could lead to increased negative investor sentiment towards us, which could negatively impact our share price as well as our access to and cost of capital.

To the extent ESG matters negatively impact our reputation, it may also impede our ability to compete as effectively to attract and retain employees, which may adversely impact our operations.

In addition, we expect there will likely be increasing levels of regulation, disclosure-related and otherwise, with respect to ESG matters.

For example, the SEC has published proposed rules that would require companies to provide significantly expanded climate-related disclosures in their periodic reporting, which may require us to incur significant additional costs to comply, including the implementation of significant additional internal controls processes and procedures regarding matters that have not been subject to such controls in the past, and impose increased oversight obligations on our management and board of directors.

Increasingly, different stakeholder groups have divergent views on sustainability and ESG matters, which increases the risk that any action or lack thereof with respect to sustainability or ESG matters will be perceived negatively by at least some stakeholders and adversely impact our reputation and business.

Anti-ESG sentiment has gained some momentum across the United States, with several states having enacted or proposed “anti-ESG” policies or legislation.

If we do not successfully manage ESG-related expectations across stakeholders, it could erode stakeholder trust, impact our reputation, and adversely affect our business.

These and other changes in stakeholder expectations will likely lead to increased costs as well as scrutiny that could heighten all of the risks identified in this risk factor.

Additionally, our business partners may be subject to similar expectations, which may augment or create additional risks, including risks that may not be known to us.

Risks Related to Our Indebtedness

Our existing indebtedness could adversely affect our business and growth prospects.

During the year ended December 31, 2024, we utilized the remaining federal NOL carryforwards for years before 2018 which would have otherwise began to expire in 2034.

All remaining federal NOL carryforwards are indefinite-lived.

The state NOL carryforwards begin to expire in 2034.

Changes in the

ownership of our stock in the future, including as a result of future offerings, and some of which are outside of our control, could result in an ownership change under Section 382 of the Code (or applicable state law) after such date, which could significantly limit our ability to utilize our existing and future NOL carryforwards arising at any time prior to such ownership change.

We face risks associated with our indebtedness, which could adversely affect our business and growth prospects.

As of December 31, 2024, there was no amount outstanding under our Revolving Credit Facility and $125.0 million of borrowing availability under our Revolving Credit Facility.

Our indebtedness, or any additional indebtedness we may incur, could require us to divert funds identified for other purposes for debt service and impair our liquidity position.

If we cannot generate sufficient cash flow from operations to service our debt, we may need to refinance our debt, dispose of assets or issue equity to obtain necessary funds.

We do not know whether we will be able to take any of these actions on a timely basis, on terms satisfactory to us or at all.

If we cannot generate sufficient cash flow from operations to service our debt, we may need to restructure or refinance our debt, reduce or delay capital expenditures, dispose of assets or issue equity to obtain necessary funds.

We cannot assure you that we will be able to refinance any of our indebtedness on a timely basis, on satisfactory or commercially reasonable terms or at all.

There can be no assurance that we will be able to obtain sufficient funds to enable us to repay or refinance our debt obligations on commercially reasonable terms, or at all.

If we cannot meet our debt service obligations, the holders of our indebtedness may accelerate such indebtedness and, to the extent such indebtedness is secured, foreclose on our assets.

In such an event, we may not have sufficient assets to repay all of our indebtedness.

Our indebtedness and the cash flow needed to satisfy our debt have important consequences, including:

2 unchanged sentences

• making us more vulnerable in the event of a downturn in our business.

Our level of indebtedness may place us at a competitive disadvantage to our competitors that are not as highly leveraged.

Any failure to make payments of interest and principal on our outstanding indebtedness on a timely basis would likely result in penalties or defaults, which would also harm our ability to incur additional indebtedness.

Any refinancing of our indebtedness could be at higher interest rates and may require us to comply with more onerous covenants.

Fluctuations in interest rates can increase borrowing costs.

3 unchanged sentences

The ability to make these payments depends on our financial and operating performance, which is subject to prevailing economic, industry and competitive conditions and to certain financial, business, economic and other factors beyond our control.

We may not be able to generate sufficient cash flow to service all of our indebtedness, and may be forced to take other actions to satisfy our obligations under such indebtedness, which may not be successful.

Our ability to make scheduled payments or to refinance outstanding debt obligations depends on our financial and operating performance, which will be affected by prevailing economic, industry and competitive conditions and by financial, business and other factors beyond our control.

We may not be able to maintain a sufficient level of cash flow from operating activities to permit us to pay the principal, premium, if any, and interest on our indebtedness.

If our cash flows and capital resources are insufficient to fund our debt service obligations, we may be forced to reduce or delay capital expenditures, sell assets, seek additional capital or seek to restructure or refinance our indebtedness.

Any refinancing of our indebtedness could be at higher interest rates and may require us to comply with more onerous covenants.

These alternative measures may not be successful and may not permit us to meet our scheduled debt service obligations.

In the absence of such cash flows and resources, we could face substantial liquidity problems and might be required to sell material assets or operations to attempt to meet our debt service obligations.

If we cannot meet our debt service obligations, the holders of our indebtedness may accelerate such indebtedness and, to the extent such indebtedness is secured, foreclose on our assets.

In such an event, we may not have sufficient assets to repay all of our indebtedness.

We may be unable to refinance our indebtedness.

We may need to refinance all or a portion of our indebtedness before maturity.

We cannot assure you that we will be able to refinance any of our indebtedness on commercially reasonable terms or at all.

There can be no assurance that we will be able to obtain sufficient funds to enable us to repay or refinance our debt obligations on commercially reasonable terms, or at all.

The terms of our Revolving Credit Agreement restrict our current and future operations, particularly our ability to respond to changes or to take certain actions.

7 unchanged sentences

• materially alter the business we conduct.

The restrictive covenants in the Revolving Credit Agreement require us to satisfy certain financial condition tests as described in Item 7 - Management’s Discussion and Analysis.

The restrictive covenants in the Revolving Credit Agreement require us to satisfy certain financial condition tests, as described in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” of this Annual Report on Form 10-K.

Our ability to satisfy those tests can be affected by events beyond our control.

20 unchanged sentences

In addition, if we issue additional equity to raise capital, your interest in us will be diluted.

General Risks

As a public reporting company, we are obligated to maintain proper and effective internal control over financial reporting in order to comply with Section 404 of the Sarbanes-Oxley Act.

Reporting obligations as a public company place a considerable strain on our financial and management systems, processes and controls, as well as on our personnel.

Section 404(b) of the Sarbanes-Oxley Act requires our independent registered public accounting firm to issue an annual report that addresses the effectiveness of our internal control over financial reporting.

Our compliance with Section 404(a) has required to incur substantial expenses and expend significant management efforts.

Negative publicity relating to our business, industry, Medical Groups or Privia Providers may have a material adverse effect on our financial results.

Negative publicity may result from judicial inquiries, unfavorable outcomes in lawsuits, social media, regulatory or governmental actions with respect to our services.

Negative publicity may cause increased regulation and legislative scrutiny of industry practices as well as increased litigation or enforcement action by civil and criminal authorities.

results of operations will be harmed.” and “If we cannot timely implement the Privia Technology Solution for Privia Physicians and new Medical Groups, or resolve Privia Provider and patients concerns, including any technical and billing issues, in a timely manner, we may lose Medical Groups, Privia Providers and their patients, and our reputation may be harmed.”

Companies across industries are facing increasing scrutiny from a variety of stakeholders related to their ESG and sustainability practices.

Moreover, we may not be able to successfully complete such initiatives due to factors that are within or outside of our control.

Unfavorable ESG ratings could lead to increased negative investor sentiment towards us, which could negatively impact our share price as well as our access to and cost of capital.

To the extent ESG matters negatively impact our reputation, it may also impede our ability to compete as effectively to attract and retain employees, which may adversely impact our operations.

In addition, we continue to evaluate our ESG disclosure practices in light of increasing levels of regulation with respect to ESG matters, such as the recently-enacted California laws related to greenhouse gas emissions and climate-related financial risks reporting and the SEC’s climate rule, either of which may require us to incur significant additional costs to comply, and impose increased oversight obligations on our management and board of directors.

Anti-ESG sentiment has gained some momentum across the United States, with several states having enacted or proposed “anti-ESG” policies or legislation.

If we do not successfully manage ESG-related expectations across stakeholders, it could erode stakeholder trust, impact our reputation, and adversely affect our business.

These and other changes in stakeholder expectations will likely lead to increased costs as well as scrutiny that could heighten all of the risks identified in this risk factor.

Additionally, our business partners may be subject to similar expectations, which may augment or create additional risks, including risks that may not be known to us.

Risks Related to Our Common Stock

1 unchanged sentence

As a public company, we incur legal, accounting and other expenses that we did not previously incur as a privately held company.

We are subject to the reporting requirements of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), and certain requirements under the Sarbanes-Oxley Act, the listing requirements of NASDAQ and other applicable securities rules and regulations.

Compliance with these rules and regulations have increased our legal and financial compliance costs, made some

activities more difficult, time-consuming or costly and increased demand on our systems and resources.

We are subject to the reporting requirements of the Exchange Act, and certain requirements under the Sarbanes-Oxley Act, the listing requirements of Nasdaq and other applicable securities rules and regulations.

Compliance with these rules and regulations have increased our legal and financial compliance costs, made some activities more difficult, time-consuming or costly and increased demand on our systems and resources.

We will continue to experience such increased costs and challenges particularly because we are no longer an “emerging growth company.” The Exchange Act requires that we file annual, quarterly and current reports with respect to our business, financial condition and results of operations.

7 unchanged sentences

This could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices.

We intend to invest resources to comply with evolving laws, regulations and standards, and this investment may result in increased general and administrative expenses and a diversion of our management’s time and attention from revenue-generating activities to compliance activities.

activities to compliance activities.

If our efforts to comply with new laws, regulations and standards differ from the activities intended by regulatory or governing bodies due to ambiguities related to their application and practice, regulatory authorities may initiate legal proceedings against us and there could be a material adverse effect on our business, financial condition and results of operations.

5 unchanged sentences

• prohibit shareholder action by written consent and shareholder special meetings as well as permit removal of directors only for cause;

• provide that any amendment, alteration, rescission or repeal of our amended and restated bylaws by our shareholders will require the affirmative vote of the holders of at least 66.6% in voting power of all the then-outstanding shares of our stock entitled to vote thereon, voting together as a single class;

• establish advance notice requirements for nominations for elections to our Board or for proposing matters that can be acted upon by shareholders at shareholder meetings.

39 unchanged sentences

All of our common stock sold pursuant to an offering covered by a registration statement, including common stock sold by stockholders rather than the Company, will be freely transferable.

In addition, shares of our common stock issued or issuable under our equity incentive plans to employees and directors have been registered on a Form S-8 registration statement and may be

freely sold in the public market upon issuance, except for shares held by affiliates who have certain restrictions on their ability to sell.

In addition, shares of our common stock issued or issuable under our equity incentive plans to employees and directors have been registered on one or more Form S-8 registration statements and may be freely sold in the public market upon issuance, except for shares held by affiliates who have certain restrictions on their ability to sell.

The market price of our stock could decline if the holders of our shares of common stock sell them or are perceived by the market as intending to sell them.

4 unchanged sentences

Therefore, any return on investment in our common stock is solely dependent upon the appreciation of the price of our common stock on the open market, which may not occur.

For additional information, see “Dividend Policy.”

If securities or industry analysts do not continue to publish research or reports about our business, if they adversely change their recommendations regarding our shares or if our results of operations do not meet their expectations, our stock price and trading volume could decline.

The trading market for our shares will be influenced by the research and reports that industry or securities analysts publish about us or our business.

We do not have any control over these analysts.

If one or more of these analysts cease coverage of us or fail to publish reports on us regularly, we could lose visibility in the financial markets, which in turn could cause our stock price or trading volume to decline.

Moreover, if one or more of the analysts who cover us downgrade our stock, or if our results of operations do not meet their expectations, our stock price could decline.

We may issue shares of preferred stock in the future, which could make it difficult for another company to acquire us or could otherwise adversely affect holders of our common stock, which could depress the price of our common stock.

Our amended and restated certificate of incorporation authorizes us to issue one or more series of preferred stock.

Our Board has the authority to determine the preferences, limitations and relative rights of the shares of preferred stock and to fix the number of shares constituting any series and the designation of such series, without any further vote or action by our shareholders.

Our preferred stock could be issued with voting, liquidation, dividend and other rights superior to the rights of our common stock.

The potential issuance of preferred stock may delay or prevent a change in control of us, discouraging bids for our common stock at a premium to the market price, and materially adversely affect the market price and the voting and other rights of the holders of our common stock.

For additional information, see “Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities - Dividend Policy.”

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors