InfuSystem Holdings (INFU) Risk Analysis

We also rely on our technology infrastructure to interact with customers and suppliers, fulfill orders and bill, collect and make payments, ship products, provide support to customers, fulfill contractual obligations and otherwise conduct business. Cyber incidents can result from deliberate attacks or unintentional events. These incidents can include, but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption. The result of these incidents could include, but are not limited to, disrupted operations, misstated financial data, liability for stolen assets or information, increased cybersecurity protection costs, litigation and reputational damage adversely affecting customer or investor confidence. We have implemented systems and processes to focus on identification, prevention, mitigation and resolution. However, these measures cannot provide absolute security, and our systems may be vulnerable to cybersecurity breaches such as viruses, hacking, and similar disruptions from unauthorized intrusions. Cyber-attacks continue to increase in frequency, sophistication and intensity, and are becoming increasingly difficult to detect. Such attacks are often carried out by motivated and highly skilled actors, who are increasingly well-resourced. Geopolitical events have also increased cybersecurity risks on a global basis. We rely on third party service providers to supply and support certain aspects of our information technology systems. These vendors could become vulnerable to cyber-attacks, malicious intrusions, breakdowns, interference or other significant disruptions, and their systems may contain defects in design or manufacture or other problems that could result in system disruption or compromise the information security of our own systems. Any failure of our systems or third-party systems may compromise our sensitive information and/or personally identifiable information of our employees or patient health information subject to data privacy law protections. While we have secured cyber insurance to potentially cover certain risks associated with cyber incidents, there can be no assurance the insurance will be sufficient to cover any such liability. The SEC has adopted new rules that require us to provide greater disclosure regarding cybersecurity risk management, strategy and governance, as well as disclosure of material cybersecurity incidents. We cannot predict or estimate the amount of additional costs we will incur in order to comply with these rules or the timing of such costs. These rules may also require us to report a cybersecurity incident before we have been able to fully assess its impact or remediate the underlying issue. Efforts to comply with such reporting requirements could divert management's attention from our incident response and could potentially reveal system vulnerabilities to threat actors. Failure to timely report incidents under these or other similar rules could also result in monetary fines, sanctions or subject us to other forms of liability.

From time to time and in the ordinary course of our business, we may become involved in various legal and regulatory proceedings. All such proceedings are inherently unpredictable and, regardless of the merits of the claims, litigation and regulatory proceedings may be expensive, time-consuming and disruptive to our operations and distracting to management. If resolved against us, such proceedings could result in excessive verdicts, injunctive relief or other equitable relief that may affect how we operate our business. Similarly, if we settle such proceedings, it may affect how we operate our business. Future court decisions, alternative dispute resolution awards, business expansion or legislative activity may increase our exposure to litigation and regulatory investigations. In some cases, substantial non-economic remedies or punitive damages may be sought. Although we maintain liability insurance coverage, there can be no assurance that such coverage will cover any particular verdict, judgment or settlement that may be entered against us, that such coverage will prove to be adequate or that such coverage will continue to remain available on acceptable terms, if at all. If we incur liability that exceeds our insurance coverage or that is not within the scope of the coverage in proceedings brought against us, it could have a material adverse effect on our business, results of operations and financial condition.

Our core services are exempt from sales tax or its equivalent in many states. However, there are several states that consider pump rentals, sales and services taxable regardless of method of payment. We are collecting sales tax or its equivalent in numerous jurisdictions. A successful assertion by one or more states or localities requiring us to collect taxes where we currently do not, could result in substantial tax liabilities, including for past sales, as well as penalties and interest.

Our business, like that of most businesses in the healthcare and medical device industry, involves the receipt, storage, and transmission of customer information and payment and reimbursement information, as well as confidential information about third-party payers, our employees, our suppliers, and our Company. State, federal and foreign laws, such as HIPAA, Section 5 of the FTC Act, or the California Consumer Privacy Act, as amended, and other similar state laws regulate the confidentiality of personal information, including sensitive information and the circumstances under which such information may be released. These measures may govern the disclosure and use of personal and patient medical record information and may require users of such information to implement specified security measures. Unauthorized access may trigger notification requirements, encourage actions by regulatory bodies, result in adverse publicity and lead to litigation. If we fail to monitor,maintain or protect our information technology systems and data integrity or fail to anticipate, plan for or manage significant disruptions to these systems, we could lose customers, be subject to fraud, breach our agreements with or duties toward customers, physicians, other parties, be subjected to regulatory sanctions or penalties, incur expenses or lose revenues, sustain damage to our reputation, or suffer other adverse consequences. Unauthorized tampering, adulteration or interference with our products may also create issues with product functionality that could result in a loss of data, risk to patient safety, and product recalls or field actions. Any of these events could have a material adverse effect on our business, reputation or financial condition. We rely on information technology systems (including technology from third-party providers) to process, transmit, and store electronic information in our operations, including sensitive personal information and proprietary or confidential information. Our information systems are vulnerable to an increasing threat of continually evolving cybersecurity risks. Unauthorized parties may attempt to gain access to our systems or information through fraud or other means of deceiving our employees or third-party service providers. Hardware, software, or applications we develop or obtain from third parties may contain defects in design or manufacture or other problems that could unexpectedly compromise information and device security. The methods used to obtain unauthorized access, disable or degrade service, or sabotage systems are also constantly changing and evolving, and may be difficult to anticipate or detect for long periods of time. We have implemented and regularly review and update processes and procedures to protect against unauthorized access to or use of secured data and to prevent data loss. However, the ever-evolving threats mean we must continually evaluate and adapt our systems and processes, and our efforts may not be adequate to safeguard against all data security breaches, misuse of data, or sabotage of our systems. Any future significant compromise or breach of our data security, whether external or internal, or misuse of customer, third-party payer, employee, supplier, or Company data, could result in significant costs, lost sales, fines, lawsuits, and damage to our reputation. In addition, as the regulatory environment related to information security, data collection and use, and privacy becomes increasingly rigorous, with new and constantly changing requirements applicable to our business, compliance with those requirements could also result in additional costs. Specifically, as a result of the broad scale release and availability of AI technologies such as generative AI, there is a global trend towards more regulation to ensure the ethical use, privacy, and security of AI and the data that it processes. Compliance with such laws will likely be an increasing and substantial cost in the future.

Our success is substantially dependent on the continued services of our executive officers and other key personnel who generally have extensive experience in our industry. Our future success also will depend in large part upon our ability to identify, attract and retain other highly qualified executive officers, managerial, finance, technical, clinical, customer service and sales and marketing personnel. Competition for these individuals is intense, more so in the current labor market. The loss of the services of any executive officer or other key employee, or our failure to attract and retain other qualified and experienced personnel on acceptable terms, could have a material and adverse effect on our business, financial condition, results of operations and cash flows.