Evolent Health (EVH) Risk Factors

Our success depends on providing high-quality products and services that health care providers use to improve clinical, financial and operational performance. If we cannot adapt to rapidly evolving industry standards, technology, including artificial intelligence, and increasingly sophisticated and varied partner needs, our existing technology could become undesirable or obsolete, which could harm our reputation. We must continue to invest significant resources in our personnel and technology, including artificial intelligence, in a timely and cost-effective manner in order to enhance our existing products and services and introduce new high-quality products and services that existing partners and potential new partners will want. Our operating results would also suffer if our innovations are not responsive to the needs of our existing partners or potential new partners, are not appropriately timed with market opportunity, are not effectively brought to market or significantly increase our operating costs. If our new or modified product and service innovations are not responsive to partner preferences, emerging industry standards or regulatory changes, are not appropriately timed with market opportunity or are not effectively brought to market, we may lose existing partners or be unable to obtain new partners and our results of operations may suffer. In addition, should any of our partners terminate their relationship with us after implementation has begun, we would not only lose our time, effort and resources invested in that implementation, but we would also have lost the opportunity to leverage those resources to build a relationship with other partners over that same period of time. In some cases, we price our services based on expectations of long-term relationships with our partners. When a partner terminates the relationship earlier than we had expected, we lose the resources invested in that relationship as well as the upside benefits we had anticipated. We also engage third-party vendors to develop, maintain and enhance the technology we use in our solutions, and our ability to develop and implement new technologies is therefore dependent on our ability to engage suitable vendors. We may also need to license software or technology from third parties in order to maintain, expand or modify our technology-enabled services platform. However, there is no guarantee we will be able to enter into such agreements on acceptable terms or at all. The functionality of our services platforms depends, in part, on our ability to integrate with third-party applications and data management systems that our partners use and from which they obtain data. These third parties may terminate their relationships with us, change the features of their applications and platforms, restrict our access to their applications and platforms or alter the terms governing use of their applications, data management systems and application programming interfaces and access to those applications and platforms in an adverse manner.

Our services involve the collection, storage and analysis of confidential information, including intellectual property and personal information of employees, health providers and others, as well as protected health information of our partners' patients. Because of the extreme sensitivity of this information, the security and privacy features of our computer, network, and communications systems infrastructure are very important. In certain cases, we provide such information to third parties, for example, to the service providers who provide hosting services for our technology platform, and we may be unable to control the use of such information or the security and privacy protections employed by such third parties. We may be required to expend significant capital and other resources to protect against security breaches and/or privacy incidents or to alleviate problems caused by security breaches and/or privacy incidents. Despite our implementation of security and privacy measures designed to help ensure data security and compliance with applicable laws and rules, our facilities and systems, and those of our third-party vendors, are vulnerable to threats. Furthermore, our increased use of mobile and cloud technologies, including as a result of the shift to work-from-home arrangements as a result of the COVID-19 pandemic, and the conflict between Russia and Ukraine, have heightened these cybersecurity and privacy risks, including risks from cyber-attacks such as phishing, spam emails, hacking, social engineering, and malicious software including harmful malware and ransomware. Threat actors regularly attempt to gain access to our information and infrastructure through various techniques. These threats include cyber-attacks, the use of harmful malware or ransomware, security breaches, acts of vandalism or theft (including by employees), computer viruses, misplaced or lost data, programming and/or human errors, power outages, protected health information leakage from implementing third-party technology to process and share data, hardware failures or other similar events. To date we have not experienced a cybersecurity incident that has resulted in any material impact on our business strategy, results of operations, financial condition or on our ability to service our partners or run our business. However, past and future incidents, including if we are unable to effectively resolve breaches in a timely manner, could result in damage to the market perception of the effectiveness of our security and privacy measures and we could lose sales and partners, which could have a material adverse effect on our business, operations, and financial results. A cyber-attack that bypasses our, or our third-party vendors', security systems successfully could require us to expend significant resources to remediate any damage, and prevent future occurrences, interrupt our operations, damage our reputation and our relationship with our partners, expose us or other third parties to a risk of loss or misuse of confidential information, reduce demand for our products and services or subject us to significant liability through litigation as well as regulatory action. Cyber-attacks continue to evolve in sophistication and volume and may remain undetected for an extended period. In addition, techniques used to obtain unauthorized access to information or to sabotage information technology systems change frequently. We have seen, and will continue to see, industry-wide vulnerabilities, such as the Log4j vulnerability reported in December 2021, which have and could in the future affect our or other parties' systems. We expect to continue to experience such vulnerabilities in the future. The costs of attempting to protect against cybersecurity risks and the costs of responding to cyber-attacks are significant. This could require us to expend significant resources to continue to modify or enhance our protective measures and to remediate any damage. While we maintain insurance covering certain security and privacy damages and claim expenses, we may not carry insurance or maintain coverage sufficient to compensate for all liability and such insurance may not be available for renewal on acceptable terms or at all, and in any event, insurance coverage would not address the reputational damage that could result from a security incident. New data security and privacy laws and regulations are being enacted rapidly. The scope and applicability of these laws are inconsistent, uncertain, and subject to evolving court and regulatory interpretation. As such, we may not be able to timely comply with such requirements, and such requirements may not be compatible with our current processes. For example, the FTC recently announced that it will begin enforcing the Health Breach Notification Rule, which it enforced three times last year. These enforcements included multi-year consent orders that imposed strict reporting and compliance obligations in addition to fines, in one case, in the amount of $1.5 million. Additionally, many states (including California, Utah, Colorado, Virginia, Connecticut, Washington, and several others) have passed laws that regulate how covered businesses collect, use, and disclose personal information. These laws impose data minimization and retention requirements and grant consumers broad rights with respect to their personal information, including opt out and deletion rights. Evaluating and updating our processes in light of these laws could be time consuming and expensive, and the failure to timely implement required changes could subject us to liability for noncompliance, including potential liability in the form of consumer class action lawsuits in certain states.

Health care laws and regulations are rapidly evolving and may change significantly in the future, including as a result of the Biden administration, which could adversely affect our financial condition and results of operations. We are subject to regulation by both CMS and state agencies in respect of certain services we provide relating to Medicaid and Medicare programs. Medicare is a federal program that provides hospital and medical insurance benefits to persons age 65 and over, as well as certain other individuals. Medicaid programs are jointly funded by federal and state governments and are administered by states under an approved plan that provides hospital and other health care benefits to qualifying individuals. As we increase our exposure to Medicare and Medicaid businesses through new and existing partners, we increase our exposure to changes in government policy with respect to and regulation of the Medicaid and Medicare programs in which we and our partners participate. Because some of our partners are participants in governmental programs, our solutions have in the past and may again in the future be subject to periodic surveys and audits by governmental entities or contractors for compliance with Medicare and other standards and requirements. As a result of surveys or audits, we may incur fines and penalties, and could be excluded from participating in one or more programs or institute other sanctions against us if we fail to comply with CMS regulations or Medicare and Medicaid contractual requirements. The regulations and requirements applicable to us and other participants in Medicaid and Medicare programs are complex and subject to change. In particular, prior authorization standards and requirements, including Medicaid and Medicare programs, have come under increased scrutiny at the state and federal level. Many states have proposed, and some have passed, bills which prescribe how providers and services which meet certain approval rates become exempt from prior authorization for a period of time. Medicare Advantage Organization ("MAOs") utilization management practices have been the focus of a 2022 report by the Department of Health and Human Services Office of Inspector General as well as new final rules by (CMS-4201-F and CMS-0057-F). CMS-4201-F, effective calendar year 2024, imposes several requirements on MAOs with respect to their use of prior authorization. CMS-0057-F further imposes stricter medical necessity decision timeframes on federal managed care programs, effective CY 2026, as well as complex technical interface requirements for Medicare and Medicaid which are to facilitate increased data sharing between managed care plans, enrollees and providers and streamline the prior authorization process. Congress and state and local legislatures and regulators may propose and adopt legislation or policy changes or implementations effecting additional fundamental changes with respect to Medicare and Medicaid programs. Such changes in the law, or new interpretations of existing laws, may have a significant impact on our methods and costs of doing business. Additionally, expansion of enforcement activity could adversely affect our business and financial condition. Going forward, we expect CMS, Congress, and state agencies to continue to closely scrutinize each component of the Medicare and Medicaid programs, as well as modify the terms and requirements of the programs. It is not possible to predict the outcome of this congressional or regulatory activity, either of which could adversely affect us. Similarly, we cannot predict whether pending or future federal or state legislation or court proceedings will change various aspects of the Medicaid and Medicare programs, nor can we predict the impact those changes will have on our business operations or financial results, but the effects could be materially adverse. In addition, CMS, Congress, state legislatures and third-party payers may continue to review and assess alternative health care delivery and payment systems and may in the future propose and adopt legislation or policy changes or implementations effecting additional fundamental changes in the health care delivery system, including with respect to Medicare, Medicaid, and exchange programs. Additionally, expansion of enforcement activity could adversely affect our business and financial condition. Going forward, we expect CMS and Congress to continue to closely scrutinize each component of the Medicare program as well as modify the terms and requirements of the program. It is not possible to predict the outcome of this congressional or regulatory activity, either of which could adversely affect us. Similarly, we cannot predict whether pending or future federal or state legislation or court proceedings will change various aspects of the health care delivery system, including Medicaid and Medicare programs, nor can we predict the impact those changes will have on our business operations or financial results, but the effects could be materially adverse. Furthermore, in April 2020, Congress enacted the Families First Coronavirus Response Act, which requires Medicaid programs to keep individuals continuously enrolled through the end of the month in which the COVID-19 public health emergency (the "PHE") is terminated. The PHE was most recently re-extended on October 13, 2022 through January 11, 2023. On January 30, 2023, President Biden stated that the PHE would terminate on May 11, 2023. Since the PHE extension ended on May 11, 2023, and Medicaid redeterminations resumed, certain of our partners have experienced a decrease of enrolled lives, which may decrease the numbers of lives on our platform and which would impact the revenues derived from such partners. As another example of recent health care legislative changes, the Consolidated Appropriations Act (the "CAA"), enacted on December 27, 2020, contains provisions impacting group health plans, including protections for plan participants from surprise medical bills and ensuring health plan price transparency. The CAA prohibits plans from entering into services agreements that directly or indirectly restrict the plans from disclosing provider-specific costs and quality of care information. The CAA will also require certain service providers for health plans to comply with certain ERISA fee disclosure rules. In addition, effective January 1, 2022, the No Surprises Act (enacted as part of the CAA) provides protection against surprise medical bills by prohibiting plans and providers from balance billing patients for emergency care performed by out-of-network providers as well as non-emergency and ancillary services performed by out-of-network providers at in-network facilities, subject to certain notice and consent exceptions for non-emergency and ancillary services. The new law also grants additional patient protections, including requiring providers to send a good faith estimate of the expected charges for furnishing items or services to an insured patient's health plan (or directly to an uninsured patient) before such items or services are delivered (including items or services reasonably expected to be provided in conjunction with scheduled items or services or that are reasonably expected to be delivered by another provider). The No Surprises Act also provides a dispute resolution process in the event the actual charges for such items and services are substantially higher than the plan's estimate and will prohibit providers from charging patients an amount beyond the in-network cost sharing amount for services rendered by out-of-network providers, subject to certain exceptions. Several states have also enacted comprehensive surprise billing laws and the CAA defers to existing state requirements with respect to state-established payment amounts. We are unable to predict how these changes and other health care reform initiatives from new legislation, regulation, judicial action and/or executive action, including the CAA and No Surprises Act and state laws, will ultimately impact the health care industry and what the potential impact may be on our business, financial condition, operating results and prospects. In addition to these health care laws and regulations, we are subject to various other laws and regulations, including, among others, other aspects of state insurance laws, the Stark Law relating to self-referrals, the whistleblower provisions of the False Claims Act, anti-kickback laws, antitrust laws and the privacy and data protection laws. Investigating and prosecuting healthcare fraud, waste and abuse continues to be a top priority for state and federal law enforcement entities. The focus of these efforts has been directed at Medicare, Medicaid, Health Insurance Marketplace and commercial products. Compliance with these laws may require substantial resources. We are constantly looking for ways to improve our fraud, waste and abuse detection methods. The fraud, waste and abuse laws include In the United States, there are federal and state anti-kickback laws that generally prohibit the payment or receipt of kickbacks, bribes or other remuneration in exchange for the referral of patients or other health-related business. In addition to these health care laws and regulations, we are subject to various other laws and regulations, including, among others, other aspects of state insurance laws, the Stark Law relating to self-referrals, the whistleblower provisions of the False Claims Act, anti-kickback laws, antitrust laws and the privacy and data protection laws. The federal civil False Claims Act imposes liability on any person or entity who, among other things, knowingly presents, or causes to be presented, a false or fraudulent claim for payment by a federal health care program. The "qui tam" or "whistleblower" provisions of the False Claims Act allow a private individual to bring actions on behalf of the federal government alleging that the defendant has submitted a false claim to the federal government, and to share in any monetary recovery. Our activities relating to the way we sell and market our services, including our risk adjustment solution, may be subject to scrutiny under these laws. The Stark Law is relevant to our business because we frequently organize arrangements of various kinds under which (a) providers and hospitals jointly invest in and own ACOs, clinically integrated networks and other entities that engage in value-based contracting with third-party payers or (b) providers are paid by hospitals or hospital affiliates for care management, medical or other services related to value-based contracts. We evaluate when these investment and compensation arrangements create financial relationships under the Stark Law and design structures that are intended to satisfy exceptions under the Stark Law or Medicare Shared Savings Program waiver. We have identified instances of noncompliance in the past and cannot guarantee that we will not identify other instances in the future, or the outcome of any regulatory investigation into any non-compliance. If we were to become subject to litigation, liabilities or penalties under these or other laws or as part of a governmental review or audit, our business could be adversely affected.

As described below, we are required to comply with numerous federal and state laws and regulations that regulate health information that we may obtain, process or access in connection with the provision of our services. These laws and regulations, including their interpretation by governmental agencies, are subject to frequent change and could have a negative impact on our business. - HIPAA protects the privacy and security of protected health information and requires covered organizations adopt standards for the exchange of electronic protected health information. Further, the privacy regulations under HIPAA also provide patients with rights related to understanding and controlling how their protected health information is used and disclosed. As a provider of services to entities subject to HIPAA, we are directly subject to certain provisions of the regulations as a "Business Associate". If we are unable to satisfy privacy and security obligations under HIPAA regulations, we could be found to have breached our contracts with our customers. Moreover, we may be subject to investigation by the U.S. Department of Health and Human Services Office for Civil Rights ("OCR") for potential HIPAA noncompliance. Penalties for HIPAA noncompliance includes civil and criminal penalties that could have a material adverse effect on us. In addition, OCR performs compliance audits of Business Associates in order to proactively enforce the HIPAA privacy and security standards. OCR has become an increasingly active regulator and has signaled its intention to continue this trend. OCR has the discretion to impose penalties without being required to attempt to resolve violations through informal means; further, OCR may require companies to enter into resolution agreements and corrective action plans which impose ongoing compliance requirements. OCR enforcement activity can result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal resources. - The HITECH Act, enacted as part of the American Recovery and Reinvestment Act of 2009, also known as the "Stimulus Bill," effective February 22, 2010, set forth health information security breach notification requirements and increased penalties for violation of HIPAA. The HITECH Act requires individual notification for all breaches, media notification of breaches for over 500 individuals and at least annual reporting of all breaches to the Department of Health and Human Services. Failure to comply with the HITECH Act could result in fines and penalties that could have a material adverse effect on us. - Numerous other federal and state laws that may apply to us restrict the use of and protect the privacy and security of personal information, as well as employee personal information. These include state medical privacy laws, state social security number protection laws and federal and state consumer protection laws. These various laws in many cases are not preempted by HIPAA and may be subject to varying interpretations by the courts and government agencies, creating complex compliance issues for us and our partners and potentially exposing us to additional expense, adverse publicity and liability, any of which could adversely affect our business. - Federal and state consumer protection laws are increasingly being applied by the FTC and states' attorneys general to regulate the collection, use, storage and disclosure of personal information, through websites or otherwise, and to regulate the presentation of website content. The FTC in particular is increasingly scrutinizing the collection, use, and disclosure of health information and any corresponding marketing and advertising efforts, as well as any other uses that attempt to monetize health information. There is ongoing concern from privacy advocates, regulators and others regarding data protection and privacy issues, and the number of jurisdictions with data protection and privacy laws have been increasing. Also, there are ongoing public policy discussions regarding whether the standards for de-identified, anonymous or pseudonymized health information are sufficient to adequately protect patient privacy. These discussions may lead to further restrictions on the use or disclosure of such information. There can be no assurance that these initiatives or future initiatives will not adversely affect our ability to access and use data or to develop or market current or future services. The security measures that we and our third-party vendors and subcontractors have in place to address privacy and data protection laws may not protect our facilities and systems from security breaches, acts of vandalism or theft, computer viruses, misplaced or lost data, programming and human errors or other similar events. As the cyber threat landscape continues to evolve, third-party threat actors have become increasingly sophisticated and adept at evading cybersecurity protections, and the frequency and scope of security incidents has increased. Under the HITECH Act, as a business associate we may also be liable for privacy and security breaches and failures of our subcontractors. Even though we provide for protections through our agreements with our subcontractors, we still have limited control over their actions and practices. A breach of privacy or security of protected health information by a subcontractor may result in an enforcement action, including criminal and civil liability, against us. Enforcement actions against us could be costly and could interrupt regular operations, which may adversely affect our business.

The market for our solutions is fragmented, competitive and characterized by rapidly evolving technology standards, customer needs and the frequent introduction of new products and services. Our competitors range from smaller niche companies to large, well-financed and technologically-sophisticated entities. We compete on the basis of several factors, including breadth, depth and quality of product and service offerings, ability to deliver clinical, financial and operational performance improvement through the use of products and services, quality and reliability of services, ease of use and convenience, brand recognition and the ability to integrate services with existing technology. Some of our competitors are more established, benefit from greater brand recognition, have larger client bases and have substantially greater financial, technical and marketing resources. The entrance or expansion of these larger companies in the managed healthcare industry (including our customers who have in-sourced or who may choose to in-source healthcare services) could increase the competitive pressures we face and could limit our ability to maintain or increase our rates. If this happens, our profitability could be adversely affected. In addition, if we do not adequately respond to these competitive pressures, it could cause us to be unable to maintain our current contracts or obtain new contracts. Other competitors have proprietary technology that differentiates their product and service offerings from ours. Our competitors are constantly developing products and services that may become more efficient or appealing to our existing partners and potential partners. Additionally, some health care information technology providers have begun to incorporate enhanced analytical tools and functionality into their core product and service offerings used by health care providers. As a result of these competitive advantages, our competitors and potential competitors may be able to respond more quickly to market forces, take advantage of acquisitions and other opportunities more readily, undertake more extensive marketing campaigns for their brands, products and services, more successfully utilize developing technology, including data analytics, artificial intelligence, and machine learning, and make more attractive offers to our existing partners and potential partners. We also compete on the basis of price. We are subject to pricing pressures as a result of, among other things, competition within the industry, consolidation of health care industry participants, practices of managed care organizations, government action and financial stress experienced by our partners. If our pricing experiences significant downward pressure, our business will be less profitable and our results of operations will be adversely affected. We cannot be certain that we will be able to retain our current partners or expand our partner base in this competitive environment. If we do not retain current partners or expand our partner base, or if we have to renegotiate existing contracts, our business, financial condition and results of operations will be harmed. Moreover, we expect that competition will continue to increase as a result of consolidation in both the health care information technology and health care industries. If one or more of our competitors or potential competitors were to merge or partner with another of our competitors, the change in the competitive landscape could also adversely affect our ability to compete effectively and could harm our business, financial condition and results of operations.

We believe that maintaining and enhancing our reputation and brand recognition is critical to our relationships with existing partners and to our ability to attract new partners. The promotion of our brands may require us to make substantial investments and we anticipate that, as our market becomes increasingly competitive, these marketing initiatives may become increasingly difficult and expensive. Our marketing activities may not be successful or yield increased revenue, and to the extent that these activities yield increased revenue, the increased revenue may not offset the expenses we incur and our results of operations could be harmed. In addition, any factor that diminishes our reputation or that of our management, including failing to meet the expectations of our partners, or any adverse publicity or litigation involving or surrounding the Company or one of our joint venture partners, investors or strategic alliance partners could make it substantially more difficult for us to attract new partners. Similarly, because our existing partners often act as references for us with prospective new partners, any existing partner that questions the quality of our work or that of our employees could impair our ability to secure additional new partners. Therefore, financial adversity of our partners' affiliated health plans may adversely affect our reputation. In addition, negative publicity resulting from any adverse government payer audit could injure our reputation. If we do not successfully maintain and enhance our reputation and brand recognition, our business may not grow and we could lose our relationships with partners, which would harm our business, results of operations and financial condition.

Our success depends largely upon the continued services of our key executive officers and recruitment of additional highly-skilled employees. From time to time, there may be changes in our senior management team resulting from the hiring or departure of executives, which could disrupt our business. Hiring executives with needed skills or the replacement of one or more of our executive officers or other key employees would likely involve significant time and costs and may significantly delay or prevent the achievement of our business objectives. In addition, competition for qualified talent in our industry is intense, particularly in the last several years. The market to build, retain and replace talent has become even more highly competitive, and many of the companies with which we compete for personnel have greater financial and other resources than we do. We have faced and may continue to face difficulties attracting, hiring and retaining highly-skilled personnel with appropriate qualifications and may not be able to fill positions. To attract top talent, we have had to offer, and believe we will need to continue to offer, competitive compensation and benefits packages before we can validate the productivity of those employees. We have increased, and expect to continue to increase, our employee compensation levels in response to our competition, as necessary. In addition, the pressures of inflation have increased our costs of labor and may continue to do so. In addition, we believe our corporate culture has been a key contributor to our success to date. With many of our employees working remotely, we may find it difficult to maintain important aspects of our culture, which could negatively affect our ability to retain and recruit personnel who are essential to our future success and could ultimately have a negative impact on our business and our ability to execute on our strategy. In order to successfully expand our business, we must effectively recruit, integrate and motivate new and retain existing employees, while maintaining the beneficial aspects of our corporate culture. All of our employees are "at-will" employees, and their employment can be terminated by us or them at any time, for any reason and without notice. We may not be able to hire new employees quickly enough to meet our needs. If we fail to effectively manage our hiring needs and successfully integrate new employees, our efficiency and ability to meet our forecasts and our employee morale, productivity and retention could suffer, and our business and results of operations could be harmed. In addition, volatility or lack of performance in our stock price may affect our ability to attract replacements should key personnel depart.

As a non–manufacturing service business, we have to date been less impacted from laws and regulations related to sustainability concerns or other environmental, social responsibility or governance ("ESG") laws, regulations, or policies. However, we may need to incur ESG related costs indirectly in response to our customers or shareholders. Increasingly our customers and shareholders expect that we meet environmental, social responsibility, sustainability or other business policies or standards, which may be more restrictive than current laws and regulations, before they commence, or continue, doing business with us or investing in our common stock. Our compliance with these policies and related requirements could be costly, and our failure to comply could adversely affect our business relationships or reputation.

The broader U.S. economy experienced higher than expected inflationary pressures throughout 2022 related to continued supply chain disruptions, labor shortages and geopolitical instability. Inflation levels remained at elevated level through 2023. Increasing inflationary pressures may have a negative effect on our profit margins and earnings due to associated costs increases, including as a result of their impact on our customers' and other third parties' ability to pay. Additionally, we face an increasingly competitive labor market due to sustained labor shortages in part from the COVID-19 pandemic and are subject to inflationary pressures on employee wages and salaries which may increase labor costs. Failure to retain highly skilled employees due to wage inflation could have a material adverse impact on our business, results of operations or financial condition. See the risk factor captioned "If we lose key members of our management team or employees or are unable to attract and retain the employees we need, our compensation costs will increase and our business and operating results will be adversely affected." While we are unable to predict the direction of the economy or if inflation will increase or revert to normal levels, if inflation levels remain elevated for a sustained period of time, our margins, profitability and results of operations could be adversely affected.

An epidemic, pandemic or similar serious public health issue, and the measures undertaken by governmental authorities to address it, could significantly disrupt or prevent us from operating our business in the ordinary course for an extended period, and thereby, and/or along with any associated economic and/or social instability or distress, adversely affect our business and the business of our partners. The extent to which an epidemic, pandemic or similar serious public health issue could impact our business, results of operations, financial condition and liquidity or the business of our partners will depend on numerous evolving factors, known and unknown, that we cannot predict, including the duration and scope of the epidemic, pandemic or similar public health issue; government, business and individual actions that taken in response; the impact of the public health issue on national and global economic activity; disruption of the financial and labor markets, including the possibility of a national or global economic recession or depression; limitations on operations requiring employees to perform their duties in-person; and disruptions in the healthcare markets, including state Medicaid agencies. Additionally, the increased number of employees who work remotely during a public health emergency or outbreak could introduce additional operational risk, such as an increased vulnerability to cyber-attacks, and harm productivity and collaboration. In addition, the risks and uncertainties described elsewhere in this "Risk Factors" section may be exacerbated by an epidemic, pandemic or similar serious public health issue.