Agilon Health (AGL) Risk Factors

As a company involved in the healthcare industry with substantially all of our revenue derived from government programs, our business activities are subject to substantial governmental regulation. There are significant costs involved in complying with these laws and regulations. If we are found to have violated any applicable laws or regulations, we could be subject to civil or criminal damages, fines, sanctions or penalties, including exclusion from participation in government healthcare programs, such as Medicare, and we may be required to change our method of operations and business strategy. These consequences could be the result of our prior or current conduct, and prior to existing physician partners joining our network. We have in the past incurred, and may in the future incur, significant costs to defend ourselves if we become the subject of an investigation or legal proceeding alleging a violation of these laws and regulations. A federal, state or local government could determine that we are not operating in accordance with the law. Further, it is unknown, whether, when or how the laws, or the interpretation thereof, will change in the future and impact our business, financial condition, cash flows, and results of operations. In addition, some of the governmental and regulatory bodies that regulate us may consider enhanced or new regulatory requirements or may seek to exercise their supervisory or enforcement authority in new or more robust ways. Any of these possibilities, if they occur, could adversely affect us. Our operations are subject to extensive federal, state and local government laws and regulations, such as: - Federal and state laws, and related regulations, including the fraud and abuse laws such as the FCA and Health Care Fraud Statute, which impose civil and criminal liability on individuals or entities that knowingly submit false or fraudulent claims for payment, or knowingly make, or cause to be made, a false statement in order to have a false claim paid, including qui tam or whistleblower suits, and impose civil monetary penalties on entities that fail to disclose and repay known overpayments;- Federal and state anti-kickback laws, and related regulations, which generally prohibit arrangements intended to induce or reward referrals for items or services reimbursable by a healthcare program;- Federal and state physician self-referral prohibition statutes, and related regulations, which generally prohibit physicians from referring a patient to an entity providing certain DHS if the physician (or his/her immediate family member) has a financial relationship with that entity;- Provisions of, and regulations enacted pursuant to, HIPAA, as amended, HITECH, and the American Recovery and Reinvestment Act of 2009, as well as similar or more stringent state laws, regarding the collection, use and disclosure of health information;- Provisions of, and regulations enacted pursuant to, the 21st Century Cures Act, regarding interoperability and prohibitions against information blocking;- Federal laws and regulations that require providers to enroll in the Medicare program before submitting any claims for services, to promptly report certain changes in operations to the agencies that administer these programs, and to re-enroll in these programs when changes in direct or indirect ownership occur or in response to revalidation requests from Medicare;- Federal and state laws that govern managed care organizations, such as our payors, and downstream contracted entities, such as our RBEs, including laws governing timely payment of claims, quality assurance, utilization review, credentialing, financial solvency, downstream transfers of risk and payor-provider contractual relationships;- State laws that govern the activities of third-party administrators and utilization review agents;- Laws relating to competition and anticorruption; and - State laws that prohibit general business entities from practicing medicine, controlling physicians' medical decisions or engaging in certain practices, such as splitting fees with physicians. These and other healthcare laws and regulations that may affect us are further described in "Business-Healthcare and Other Applicable Regulatory Matters" in Item 1. The laws and regulations applicable to our business are complex, changing and often subject to varying interpretations. As a result, we may not be able to adhere to all applicable laws and regulations. Any violation or alleged violation of any of these laws or regulations by us or our affiliates, or our physician partners or payors, could have a material adverse effect on our business, financial condition, cash flows, and results of operations. We may in the future be a party to various and material lawsuits, demands, claims, qui tam suits, government investigations and audits or government enforcement actions, of which any could result in, among other things, substantial financial penalties or awards against us, reputational harm, termination of relationships or contracts related to our business, mandated refunds, substantial payments made by us, required changes to our business practices, exclusion from future participation in Medicare and other healthcare programs and possible criminal penalties. If we are found in violation of applicable laws or regulations, we could suffer severe consequences that would have a material adverse effect on our business, results of operations, financial condition, cash flows, reputation and stock price, including: - suspension or termination of our participation in federal or state health care programs;- criminal or civil liability, fines, damages or monetary penalties for violations of healthcare fraud and abuse laws, including the federal FCA, Healthcare Fraud Statutes, CMPL, Anti-Kickback Statute and Stark Law;- enforcement actions by governmental agencies or claims for monetary damages by patients under federal or state patient privacy laws, including HIPAA;- enforcement actions by governmental agencies or monetary penalties for violations of the 21st Century Cures Act;- repayment of amounts received in violation of law or applicable payment program requirements, and related monetary penalties;- mandated changes to our practices or procedures that materially increase operating expenses;- imposition of corporate integrity agreements that could subject us to ongoing audits and reporting requirements as well as increased scrutiny of our billing and business practices;- termination of various relationships or contracts related to our business; and - harm to our reputation which could negatively affect our business relationships, decrease our ability to attract or retain patients and physicians, decrease access to new business opportunities and impact our ability to obtain financing, among other things. Responding to lawsuits and other proceedings as well as defending ourselves in such matters may require management's attention and cause us to incur significant legal expense. It is also possible that criminal proceedings may be initiated against us or individuals in our business in connection with investigations by the federal government. We rely on our physician partners to comply with certain laws or regulations, including licensure and certification requirements to provide healthcare services, operate facilities or administer pharmaceuticals in the states in which we conduct business, and billing and coding compliance with respect to the provision of services. Although we provide some high-level training, and, if needed, supplemented clinical or coding staff as appropriate, to ensure that all health conditions are assessed and sufficiently documented by our physician partners and network providers, and we perform audits on this process, we do not as a general matter supervise or control our physician partners or network providers; accordingly, any adverse effects on us regarding their noncompliance are uncertain and unpredictable.

Our payors are subject to audit by government health plans, including, but not limited to, CMS, in connection with the MA program. CMS and the HHS Office of Inspector General perform RADV audits, which can result in the recovery of payments from managed care organizations if errors are identified and influence the calculation of premium payments by CMS to MA plans. In addition, certain of our payor contracts incorporate language that enables payors to recoup funding from us in the event that CMS requires payment under a RADV audit. As a result of such audits and contracts, our payors may demand recoupments or adjustments from us, bring recovery proceedings against us, require us to submit and implement corrective action plans, or terminate agreements with our physician partners. The results of RADV audits could also adversely impact the compensation we receive from payors, which could have a material adverse effect on our revenue. Disclosure of any adverse audit results could also negatively affect our reputation and make it more difficult to attract members, physician partners and payors.

We are subject to federal and state taxes in the U.S. and other countries in which we conduct business, and such laws and rates vary by jurisdiction. Although we believe our tax practices and provisions are reasonable, the final determination of tax audits and any related litigation, changes in the taxation of our activities and proposed changes in tax laws and regulations could cause the ultimate settlement of our tax liabilities to be materially different from our historical tax practices, provisions and accruals. If we receive an adverse ruling as a result of an audit, or we unilaterally determine that we have misinterpreted provisions of the tax regulations to which we are subject, there could be a material effect on our tax provision, net income or cash flows in the period or periods for which that determination is made, which could materially impact our financial results. Further, any changes in the taxation of our activities, including certain proposed changes in U.S. tax laws, may increase our effective tax rate and adversely affect our financial position and results of operations. In addition, liabilities associated with taxes are often subject to an extended or indefinite statute of limitations period. Therefore, we may be subject to additional tax liability, including penalties and interest for a particular year for extended periods of time.

Numerous state, federal, and international laws and regulations govern the collection, dissemination, use, privacy, confidentiality, security, availability, integrity and other processing of PHI and, more broadly, personally identifiable information whether or not related to healthcare. These laws and regulations include HIPAA, as amended by the HITECH Act. HIPAA establishes a set of national privacy and security standards for the protection of PHI by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates with which such covered entities contract for services. Components of our business are considered "covered entities" under HIPAA and others are considered "business associates" of our healthcare partners and payors. HIPAA requires covered entities and business associates to develop and maintain policies and procedures with respect to PHI that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information. HIPAA also implemented the use of standard transaction code sets and standard identifiers that covered entities must use when submitting or receiving certain electronic healthcare transactions, including activities associated with the billing and collection of healthcare claims. In addition to federal regulations issued under HIPAA, several states have enacted their own data privacy and security statutes or regulations that govern the use and disclosure of a person's health information or records. Such state laws, if more stringent than HIPAA requirements, are not preempted by the federal requirements, and we are required to comply with them. See "Business-Healthcare and Other Applicable Regulatory Matters-Federal and State Privacy and Security Requirements" in Item 1. These and other laws and regulations affecting data security and data privacy, including international laws and regulations relevant to our business, are often uncertain, contradictory and subject to changing interpretations, and we expect new laws, rules and regulations regarding data privacy and information security to be proposed and enacted in the future. This complex, dynamic legal landscape creates significant compliance issues and potentially exposes us to expense, adverse publicity and liability. The regulatory framework for data privacy and security issues worldwide is evolving and is likely to remain in flux for the foreseeable future, so it is unclear how regulatory changes could impact our business or the costs of compliance, though the impacts and costs seem likely to increase. The general legal trend in the data privacy and security area is toward the broader adoption of more stringent laws and toward more aggressive enforcement. The data privacy and security measures we have implemented may not adequately protect us from the risks associated with the storage and transmission of customer information and PHI. The security measures that we, and our third-party vendors and subcontractors, have in place to promote compliance with data privacy and data security laws may not protect our facilities and systems from data security breaches, acts of vandalism or theft, computer viruses, misplaced or lost data, programming and human errors, or other similar events. In the event that new data security laws are implemented, we may not be able to timely comply with such requirements, or such requirements may not be compatible with our current safeguards. Changing our safeguards could be time-consuming and expensive, and failure to timely implement required changes could subject us to liability for non-compliance. Under HIPAA, certain of our entities are directly liable for any data privacy and data security breaches that occur in our capacity as a covered entity. Under the HITECH Act, as business associates, our RBEs may also be directly liable under certain circumstances for data privacy and data security breaches and failures of our subcontractors. We from time-to-time experience security and privacy issues that require assessment of our duties and obligations under HIPAA, and we cannot guarantee that we will not face security or privacy breaches in the future. Additionally, the investigation and remediation of privacy breaches may result in additional material direct or indirect costs. We incur substantial costs related to ordinary-course compliance with HIPAA and the HITECH Act. Such compliance could also require us to change our practices in a manner adverse to our business. Failure to comply with any applicable standards regarding patient privacy, or data privacy and data security more generally, may subject us to penalties, including significant civil monetary penalties and, in some circumstances, criminal penalties. In addition, any such failures may injure our reputation and adversely affect our ability to retain customers and attract new customers. Even an unsuccessful challenge by regulatory authorities could result in adverse publicity and could require a costly response. Additionally, on December 1, 2022, HHS OCR issued guidance on the use of tracking technologies on websites and mobile applications, indicating that certain information collected from websites and applications may implicate HIPAA. Although HIPAA does not itself provide a private right of action, it is commonly cited in consumer actions that allege improper use and disclosure of sensitive patient data: use of tracking technologies, such as cookies, web beacons, and pixels, by covered entities or their business associates has recently been subject to class action lawsuits alleging improper disclosure of patient information. Any of the foregoing consequences could have a material adverse impact on our business, financial condition, cash flows, and results of operations. Certain failures or non-compliance by our physician partners under these laws could result in their being required as covered entities to report to governmental authorities and patients, implement expensive corrections and pay civil penalties. For example, we note that in 2019, the Office of Civil Rights announced the creation of its Right of Access Initiative, intended to support individuals' right of timely access to their health records. Since the creation of the Right of Access Initiative, there has been substantial enforcement activity related to covered entities' alleged failures to provide individuals with timely access to their health records. To the extent the physician partners' non-compliance with HIPAA rules and regulations impacts members who are attributed to our RBEs (e.g., through the loss of PHI or failure to provide timely access to health records), or otherwise implicates our data processing or billing operations, we could suffer reputational harm or a material adverse effect on our business, financial condition, cash flows, and results of operations.

Individuals and entities can be excluded from participating in the Medicare program for violating certain laws and regulations, or for other reasons such as the loss of a license in any state, even if the person retains other licensure. This means that the excluded person or entity is prohibited from receiving payments for such person's or entity's services rendered to Medicare or MA beneficiaries, and if the excluded person is a physician, all services ordered (not just provided) by such physician are also non-covered and non-payable. Entities that employ or contract with excluded individuals are prohibited from billing the Medicare program for the excluded individual's services and are subject to civil penalties if they do. We might inadvertently contract or do business with an excluded person or entity, such as a physician partner, contracted or employed physician, or any other contracted party, or with an excluded person who could become excluded in the future without our knowledge. If this occurs, we or our physician partnerships may be subject to substantial repayments and civil penalties. Physician partners are also expected to comply with these requirements. We do not directly control our physician partners, and accordingly any adverse effects on us regarding their noncompliance with these laws are uncertain and unpredictable.

Most of our contracts with our physician partners contain restrictive provisions that preclude our physician partners from providing specified services for the duration of our contracts. Such provisions could be the subject of investigations and enforcement actions by regulatory authorities and litigation by payors or physicians operating in the geographic areas where such contracts exist. Any such investigations, enforcement actions or litigation could require us to take actions that would adversely affect our business, financial condition, cash flows, and results of operations or could require us to pay substantial amounts of money. Additionally, defending against these lawsuits and proceedings may involve significant expense and diversion of management's attention and resources from other matters.

Our contracts with payors generally have terms of one to three years and are typically renewed for one-year periods unless terminated in accordance with the terms of such agreements. In the ordinary course of business, we engage in active discussions and renegotiations with our payors with respect of the services we collectively provide and the terms of our payor agreements. As our payors' businesses respond to market dynamics and financial pressures, and as our payors make strategic business decisions with respect of the lines of business they pursue and programs in which they participate, certain of our payors have sought, and we expect that in the future additional payors will, from time to time, seek to renegotiate or terminate their contracts with us. These negotiations could result in reductions to the economic terms and changes to the scope of services contemplated by our existing payor contracts and consequently could negatively impact our revenues, business and prospects and render our assumptions, estimates and reserves inaccurate. If any of our contracts with our payors is terminated, we may experience a reduction in the number of members attributed to our platform, which may result in a reduction of our revenues and may have a material adverse effect on our business. With respect to certain of our discontinued operations, we may recognize impairment charges for such terminations. If a payor does terminate or elects not to renew its relationship with us, our ability to retain members associated with that payor is limited. We and our physician partners must comply with the CMS Medicare Marketing Guidelines regarding communication and information provided to members, which limits the types of permissible communications that may be made to members. In addition, in Ohio, we are contractually prohibited from forming our own health plan, which effectively prohibits us from directly marketing to members in accordance with the CMS Medicare Marketing Guidelines. Additionally, if a payor with which we contract for these services loses its Medicare contract or CMS decides to discontinue its MA or commercial plans, decides to contract with another company to provide capitated care services to its members or decides to directly provide care, our contract with that payor could be at risk and we could lose revenue. Additionally, payors with whom we currently contract in a particular geography may not maintain their government-awarded contracts in future years. Moreover, our inability to maintain our agreements with payors, in particular with key payors such as Humana, Aetna and United Healthcare, with respect to their MA members or to negotiate favorable terms for those agreements in the future, could result in the loss of patients and could have a material adverse effect on our business, financial condition, cash flows, and results of operations.

Many healthcare industry participants, including physician groups and payors, are consolidating to create larger and more integrated healthcare delivery systems with greater bargaining power, given their market share. We expect regulatory and economic conditions to result in additional consolidation. Physician groups or payors that have consolidated and are not already part of our network may try to use their increased bargaining power to negotiate better terms upon which to join our network. Consolidation may also result in the acquisition or future development by our partners or unaffiliated third parties of products and services that compete with us. Finally, consolidation may result in physician groups merging with, or being acquired by, each other or by health plans or other types of providers such as hospitals, and such groups may not have a need for our services which could reduce our market opportunity. Any of these potential results of consolidation could have a material adverse effect on our business, financial condition, cash flows, and results of operations.

As we enter into new geographies, potential physician partners will typically provide care to members affiliated with one or more MA payors, in a structure other than a Total Care Model. Our ability to successfully operate in a market is dependent upon our ability to enter into contractual relationships with MA payors which have an existing presence in that market under a global risk structure. MA payors may take the position that it is not in their strategic or financial interests to enter into a contract with us, or they may have already established exclusive relationships with other value-based care providers or affiliates in a geography and, therefore, elect to not enter into a similar arrangement with us. Therefore, we may be unsuccessful in executing contractual relationships with MA payors, or such contracts may be established at financial terms which result in lower revenues or higher costs than we project or that are necessary to generate profits in a given geography. To the extent we are unsuccessful in establishing contractual relationships with MA payors in new geographies, or such relationships are established at less favorable terms than we project, we may not be able to successfully launch into a given geography, or the membership or revenue levels we are able to attain will be lower than our projections.

Our business depends on our ability to identify and develop successful geographies and relationships with physician partners and payors, and to successfully execute upon our growth initiatives to increase the profitability of our physician partners. In order to pursue our strategy successfully, we must effectively implement our platform, partnership and network model, including identifying suitable candidates and successfully building relationships with and managing integration of new physician partners and payors. We contract with a limited number of physician partners and rely on physician partners within each geography. Our growth initiatives in our existing geographies depend, in part, on our physician partners' ability to grow their practices through the addition of PCPs to increase their capacity to service Medicare patients, and to effectively meet increased patient demand. Our physician partners may encounter difficulties in recruiting additional PCPs to their practices due to many factors, including significant competition in their geographies. Accordingly, the loss or dissatisfaction of any physician partners, our inability to recruit and integrate physician partners into our model, or the failure of our physician partners to recruit additional PCPs or manage and scale capacity to timely meet patient demand, could substantially harm our brand and reputation, impact our competitiveness, inhibit widespread adoption of our platform, partnership and network model and impair our ability to attract new physician partners and maintain existing physician partnerships, both in new geographies and in geographies in which we currently operate, which could have a material adverse effect on our business, financial condition, cash flows, and results of operations. Further, our growth strategy depends, in part, on securing and integrating new high-caliber physician partners and expanding into new geographies in which we have little or no operating experience. Integration and other risks can be more pronounced for larger and more complicated relationships or relationships outside of our core business space, or if multiple relationships are pursued simultaneously. Additionally, new geographies may be characterized by stakeholder preferences for, and experience with, a Total Care Model, rates of MA enrollment, MA reimbursement rates, payor concentration and rates of unnecessary variability in and utilization of medical care that differ from those in the geographies where our existing operations are located. Likewise, new geographies into which we seek to expand may have laws and regulations that differ from those applicable to our current operations. As a young and rapidly growing company, we may be unfamiliar with the regulatory requirements in each geography that we enter, and we may be forced to incur significant expenditures to ensure compliance with requirements to which we may become subject. If we are unable or unwilling to incur such costs, our growth in new geographies may be less successful than in our current geographies. Further, our growth to date has significantly increased the demands on our management, operational and financial systems, infrastructure and other resources. We must continue to improve our existing systems for operational and financial management, including our reporting systems, procedures and controls and management and mitigation of enterprise and operational risks. These improvements could require significant capital expenditures and place increasing demands on our management. We may not be successful in managing or expanding our operations, maintaining adequate financial and operating systems and controls, executing upon our growth initiatives and achieving required operational scale to support our growth. If we do not successfully manage these processes, our business, financial condition, cash flows, and results of operations could be harmed.