GoHealth (GOCO) Risk Analysis

Numerous federal, state and international laws and regulations govern the collection, use, disclosure, storage, processing, transmission and destruction of personal information, including individually identifiable health information. These laws and regulations, including their interpretation by governmental agencies and regulators, are subject to frequent change. These regulations could have a negative impact on our business, for example: - HIPAA and its implementing regulations were enacted to ensure that employees can retain and at times transfer their health insurance when they change jobs, and to simplify healthcare administrative processes. The enactment of HIPAA also expanded protection of the privacy and security of protected health information and required the adoption of standards for the exchange of electronic health information. Among the standards that the Department of Health and Human Services has adopted pursuant to HIPAA are standards for electronic transactions and code sets, unique identifiers for providers, employers, health plans and individuals, security, electronic signatures, privacy and enforcement. Failure to comply with HIPAA could result in enforcement activity, fines, penalties and litigation that could have a material adverse effect on us;- The Health Information Technology for Economic and Clinical Health Act ("HITECH Act") sets forth health information security breach notification requirements and increased penalties for violation of HIPAA. The HITECH Act requires individual notification for all breaches, media notification of breaches of over 500 individuals and at least annual reporting of all breaches to the Department of Health and Human Services. The HITECH Act also replaced the prior penalty system with a four-tier system of sanctions for breaches ranging from the original $100 per violation and an annual maximum of $25,000 for the first tier to a fourth-tier minimum of $50,000 per violation and an annual maximum of $1.5 million per violation category. These penalties are required to be adjusted for inflation. Failure to comply with the HITECH Act could result in enforcement activity, fines, penalties and litigation that could have a material adverse effect on us;- Other federal and state laws restricting the use and protecting the privacy and security of individually identifiable information may apply, many of which are not preempted by HIPAA; and - Federal and state consumer protection laws are increasingly being applied by the FTC and states' attorneys general to regulate the collection, use, processing, destruction, storage and disclosure of individually identifiable information, through websites or otherwise, and to regulate the presentation of website content. We are required to comply with federal and state laws governing the transmission, security and privacy of personal information that we may obtain or have access to in connection with the provision of our services. Our facilities and systems, and those of our third-party vendors and subcontractors, are vulnerable to security breaches, acts of vandalism or theft, computer viruses, malware, ransomware, denial-of-service attacks, misplaced or lost data, programming and human errors or other similar events. Due to the enactment of the HITECH Act, we are not able to predict the extent of the impact such incidents may have on our business. Our failure to comply may result in criminal and civil liability especially because the potential for enforcement action against business associates is now greater. Enforcement actions against us could be costly and could interrupt regular operations or the availability of data, which may adversely affect our business. Under the HITECH Act, as a business associate we may also be directly or independently liable for privacy and security breaches and failures of our subcontractors. We have limited control over their actions and practices, and a breach of privacy or security of individually identifiable health information by a subcontractor or other entity operating on our behalf may result in an enforcement action, including criminal and civil liability, against us or litigation by a covered entity with whom we have a contractual relationship. In addition, numerous other federal and state laws protect the confidentiality of individually identifiable information as well as employee personal information, including state medical privacy laws, state social security number protection laws, and federal and state consumer protection laws. These various laws in many cases are not preempted by HIPAA and may be subject to varying interpretations by the courts and government agencies, creating complex compliance issues for us and our consumers and potentially exposing us to additional expense, adverse publicity and liability, any of which could adversely affect our business, operating results and financial condition. State and federal laws may apply to our collection, use, handling, processing, destruction, disclosure, and storage as well. For example, the CCPA, which became enforceable by the California Attorney General on July 1, 2020, affords consumers expanded privacy protections and control over the collection, use and sharing of their personal information. The CCPA was recently amended, and it is possible it will be amended again by other pending legislative initiatives or by popular referendum. The Attorney General of California is promulgating implementing CCPA regulations which are undergoing successive rounds of public comment and revision. The potential effects of this legislation, including whether and how the law will be applied to the consumer health-related data we collect through our service, are far-reaching and may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. The CCPA gives California residents expanded rights to access and require deletion of their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. The CCPA also provides for civil penalties for violations, as well as a private right of action for data breaches that may increase data breach litigation. The CCPA does contain an exemption for medical information governed by the California Confidentiality of Medical Information Act ("CMIA"), and for protected health information collected by a covered entity or business associate governed by the privacy, security and breach notification rule established pursuant to HIPAA and HITECH, but the precise application and scope of this exemption as well as how it would apply to our business is not yet clear. The CCPA also has encouraged "copycat" legislative proposals in other states across the country such as Nevada, Virginia, New Hampshire, Illinois and Nebraska. The NYDFS Cybersecurity Regulation for financial services companies, including insurance entities under NYDFS jurisdiction, requires entities to establish and maintain a cybersecurity program designed to protect private consumer data, and implement a risk assessment designed to perform core cybersecurity functions. The regulation specifically provides for: (i) controls relating to the governance framework for a cybersecurity program; (ii) risk-based minimum standards for technology systems for data protection; (iii) minimum standards for cyber breach responses, including notice to the NYDFS, of material events; and (iv) identification and documentation of material deficiencies, remediation plans and annual certification of regulatory compliance with the NYDFS. The Cybersecurity Regulation also requires implementation of continuous monitoring of information technology systems or periodic penetration testing and vulnerability assessments. Similarly, the Massachusetts data protection law and the New York Stop Hacks and Improve Data Security Act ("SHIELD Act") both require companies to implement a written information security program that contains appropriate administrative, technical, and physical safeguards as defined in the respective statute. In October 2017, the NAIC adopted the Insurance Data Security Model Law ("Cybersecurity Model Law"), which is intended to establish the standards for data security and for the investigation and notification of data breaches applicable to insurance licensees in states adopting such law. To date, the Cybersecurity Model Law has been adopted by Alabama, Connecticut, Delaware, Michigan, Mississippi, New Hampshire, Ohio and South Carolina, with several other states expected to adopt in the near future. The Cybersecurity Model Law could impose significant new regulatory burdens intended to protect the confidentiality, integrity and availability of information systems. The NAIC model law is functionally similar to the NYDFS rule. We are subject to these and other complex and evolving federal, state and local laws and regulations regarding privacy, data protection and other matters. Many of these laws and regulations are subject to change and uncertain interpretation. The U.S. federal and state governments and agencies may in the future enact new legislation and promulgate new regulations governing collection, use, disclosure, storage, processing, transmission and destruction of personal information and other data. Compliance with existing and emerging privacy and cybersecurity laws and regulations could result in increased compliance costs and/or lead to changes in business practices and policies. In addition, any failure or perceived failure by us to maintain posted privacy policies which are accurate, comprehensive and fully implemented, and any violation or perceived violation of our privacy-, data protection- or information security-related obligations to consumers, users or other third parties or any of our other legal obligations relating to privacy, data protection or information security may result in governmental investigations or enforcement actions, litigation, claims or public statements against us by consumer advocacy groups or others, and could result in significant liability, loss of relationships with key third parties including health plan partners, social media networks and other data providers, or cause our consumers to lose trust in us, which could have material impacts on our revenue and operations.

We believe that maintaining and enhancing our brand identity is critical to our relationships with our existing health plan partners and to our ability to attract new consumers, marketing partners and health plan partners. We also intend to grow our brand awareness among consumers, marketing partners and health plan partners in order to further expand our marketplace and attract new consumers, marketing partners and health plan partners. The promotion of our brand in these and other ways may require us to make substantial investments and we anticipate that, as our market becomes increasingly competitive, these branding initiatives may become increasingly difficult and expensive. Our brand promotion activities may not be successful or yield increased revenue, and to the extent that these activities yield increased revenue, the increased revenue may not offset the expenses we incur and our operating results could be harmed. If we do not successfully maintain and enhance our brand, our business may not grow and we could lose our relationships with health plan partners, marketing partners or consumers, which would harm our business, operating results and financial condition. We may be adversely affected by negative publicity relating to brand and activities. For instance, if our brand receives negative publicity, the number of consumers visiting our platforms or Benefits Center could decrease, and our cost of acquiring consumers could increase as a result of a reduction in the number of consumers coming from our direct consumer acquisition channel. Additionally, there is at least one other third party business which uses the "GoHealth" name, but is not affiliated with our business. While we agreed with the third party that our "GoHealth" marks can coexist with the third party's use of "GoHealth" in their business without creating a likelihood of consumer confusion, we entered into a co-existence agreement with the third party that, among other things, places certain restrictions on both their use of "GoHealth," as well as ours, in order to further mitigate any risk of confusion. Nevertheless, if our business is mistakenly confused with their business or another business, the value of our brand could be adversely impacted, which could harm our business, operating results and financial condition.

Our business strategy includes expanding our existing products and services. We are investing in new opportunities to broaden our business scope to penetrate new markets and opportunities. However, we may not be able to execute on all of these investments. We may be limited by current or future laws, regulations and guidelines, health plan partners may not embrace these investments, and consumers may not appreciate these products and services. In addition, these investments often rely upon appropriate and effective relationships with third parties and we may not find suitable partners. Failure to develop new and successful product and service offerings may hinder our growth potential and adversely affect our business, operating results and financial condition.

Our services involve the collection and storage of confidential and personal information of consumers and employees, including protected health information subject to HIPAA and other individually identifiable health information, and the transmission of this information to their chosen health plan partner and to the government. Information security risks have generally increased in recent years because of the proliferation of new technologies and the increased sophistication and activities of perpetrators of cyber-attacks. Hackers and data thieves are increasingly sophisticated and operating large-scale and complex automated attacks, including on companies within the healthcare industry. As cyber threats continue to evolve, we are required to expend additional resources to further enhance our information security measures, develop additional protocols and/or to investigate and remediate any information security vulnerabilities. Because our services involve the collection, processing, use, storage and transmission of confidential and personal information of consumers and employees, including protected health information subject to HIPAA and other individually identifiable health information, we are subject to various laws, regulations, industry standards and contractual requirements regarding the collection, maintenance, protection, use, transmission, disclosure and disposal of personal information. We also hold a significant amount of personal information relating to our current and former employees. We cannot guarantee that our facilities and systems, and those of our third-party service providers, will be free from security breaches, cyber-attacks, acts of vandalism, computer viruses, malware, ransomware, denial-of-service attacks, misplaced or lost data, programming and/or human errors or other similar events, and we are required to expend significant amounts and other resources to protect against security breaches or to alleviate problems caused by security breaches and other threats to our information technology systems. Techniques used to obtain unauthorized access or to sabotage systems change frequently, and as a result, we may be unable to anticipate these techniques or to implement adequate preventative measures. Additionally, our third-party service providers who process information on our behalf may cause security breaches for which we are responsible. Any compromise or perceived compromise of the security of our systems or the systems of one or more of our vendors or service providers could damage our reputation, cause the termination of relationships with government-run health insurance exchanges, health plan partners and/or our consumers, result in disruption or interruption to our business operations, marketing partners and health plan partners, reduce demand for our services and subject us to significant liability and expense as well as regulatory action and lawsuits, which would harm our business, operating results and financial condition. We may not carry insurance or maintain coverage sufficient to compensate for all liability and in any event, insurance coverage would not address the reputational damage that could result from a security incident or any regulatory actions or litigation that may result.

Our business has been and may continue to be affected by a number of factors that are beyond our control, such as general geopolitical, economic and business conditions, pandemics, and conditions in the financial markets. A severe or prolonged economic downturn could adversely affect consumers' financial condition and the demand for insurance products. We are also exposed to risks associated with the potential financial instability of our health plan partners and consumers, many of whom may be adversely affected by volatile conditions in the financial markets or an economic slowdown. As a result of uncertainties with respect to financial institutions and the global credit markets and other macroeconomic challenges currently or potentially affecting the economy of the U.S. and other parts of the world, consumers may experience serious cash flow problems and other financial difficulties, decreasing demand for the products of our health plan partners. In addition, events in the U.S. or foreign markets, such as the U.K.'s exit from the European Union, the worldwide effects from the COVID-19 pandemic and political and social unrest in various countries around the world, can impact the global economy and capital markets. Our health plan partners may modify, delay, or cancel plans to offer new products or may make changes in the mix of products purchased that are unfavorable to us. Additionally, if health plan partners are not successful in generating sufficient revenue or are precluded from securing financing, their businesses will suffer, which may materially and adversely affect our business, operating results and financial condition. In addition, we are susceptible to risks associated with the potential financial instability of the vendors on which we rely to provide services or to whom we delegate certain functions. The same conditions that may affect health plan partners and consumers also could adversely affect our vendors, causing them to significantly and quickly increase their prices or reduce their output. Our business depends on our ability to perform, in an efficient and uninterrupted fashion, our necessary business functions, and any interruption in the services provided by third parties could also adversely affect our business, operating results and financial condition.

We have attempted to control our operating expenses by utilizing lower cost labor in foreign countries such as Slovakia and Honduras and we may in the future expand our reliance on offshore labor to other countries. As of December 31, 2023, 61 of our employees were based in Slovakia. Our employees in Slovakia help develop, test and maintain our Marketplace technology. Additionally, we outsource certain of our call center operations to companies outside the U.S. Countries outside of the U.S. may be subject to relatively higher degrees of political and social instability and may lack the infrastructure to withstand political unrest or natural disasters. The occurrence of natural disasters, pandemics or political or economic instability in these countries could interfere with work performed by these labor sources or could result in our having to replace or reduce these labor sources. Our vendors in other countries could potentially shut down suddenly for any reason, including financial problems or personnel issues. Such disruptions could decrease efficiency, increase our costs and have an adverse effect on our business or results of operations. For example, following Russia's military invasion of Ukraine in February 2022, NATO deployed additional military forces to Eastern Europe, and the U.S., European Union, and other nations announced various sanctions against Russia. The invasion of Ukraine and the retaliatory measures that have been taken, and could be taken in the future, by the U.S., NATO, and other countries have created global security concerns that could result in a regional conflict and otherwise have a lasting impact on regional and global economies, any or all of which could adversely affect our business. The practice of utilizing labor based in foreign countries has come under increased scrutiny in the U.S. Governmental authorities, including CMS, could seek to impose financial costs or restrictions on foreign companies providing services to consumers or companies in the U.S. Governmental authorities may attempt to prohibit or otherwise discourage us from sourcing services from offshore labor. In addition, health plan partners may require us to use labor based in the U.S. for regulatory or other reasons. To the extent that we are required to use labor based in the U.S., we may face increased costs as a result of higher-priced U.S.-based labor. The Foreign Corrupt Practices Act ("FCPA"), and other applicable anti-corruption laws and regulations prohibit certain types of payments by our employees, vendors and agents. Any violation of the applicable anti-corruption laws or regulations by us, our subsidiaries or our local agents could expose us to significant penalties, fines, settlements, costs and consent orders that may curtail or restrict our business as it is currently conducted and could have an adverse effect on our business, financial condition or results of operations.