Assure Holdings (IONM) Risk Factors

The health care industry is heavily regulated, and we are required to comply with extensive and complex laws and regulations at the federal, state and local government levels. A number of these laws specifically relate to the provision of Medicare and Medicaid billing. Anti-Kickback Statutes The federal Anti-Kickback Statute prohibits the knowing and willful offer, payment, solicitation or receipt of remuneration to induce the referral of a patient or the purchase, lease or order (or the arranging for or recommending of the purchase, lease or order) of health care items or services paid for by federal health care programs, including Medicare or Medicaid. A violation does not require proof that a person had actual knowledge of the statute or specific intent to violate the statute, and court decisions under the Anti-Kickback Statute have consistently held that the law is violated where one purpose of a payment is to induce or reward referrals. Violation of the federal anti-kickback statute could result in felony conviction, administrative penalties, civil liability (including penalties) under the False Claims Act and/or exclusion from federal health care programs. A number of states have enacted anti-kickback laws (including so-called "fee splitting" laws) that sometimes apply not only to state-sponsored health care programs but also to items or services that are paid for by private insurance and self-pay patients. State anti-kickback laws can vary considerably in their applicability and scope and sometimes have fewer statutory and regulatory exceptions than does the federal law. Enforcement of state anti-kickback laws varies widely and is often inconsistent and erratic. Our management carefully considers the importance of such anti-kickback laws when structuring company operations. That said, we cannot assure that the applicable regulatory authorities will not determine that some of our arrangements with hospitals, surgical facilities, physicians, or other referral sources violate the Anti-Kickback Statute or other applicable laws. An adverse determination could subject us to different liabilities, including criminal penalties, civil monetary penalties and exclusion from participation in Medicare, Medicaid or other health care programs, any of which could have a material adverse effect on our business, financial condition or results of operations. Physician Self- Referral ("Stark") Laws The federal Stark Law, 42 U.S.C. §1395nn, also known as the physician self-referral law, generally prohibits a physician from referring Medicare and Medicaid patients to an entity (including hospitals) providing "designated health services," if the physician has a "financial relationship" with the entity, unless an exception applies. Designated health services include, among other services, inpatient hospital services, outpatient prescription drug services, clinical laboratory services, certain diagnostic imaging services, and other services that our affiliated physicians may order for their patients. The prohibition applies regardless of the reasons for the financial relationship, unless an exception applies. The exceptions to the federal Stark Law are numerous and often complex. The penalties for violating the Stark Law include civil penalties of up to $15,000 for each violation and potential civil liability (including penalties) under the False Claims Act. Some states have enacted statutes and regulations concerning physician self-referrals (i.e., referrals by a physician to a health care entity in which the physician has an ownership interest). Such physician self-referrals laws may apply to the referral of patients regardless of payor source and/or type of health care service. These state laws may contain statutory and regulatory exceptions that are different from those of the federal law and that may vary from state to state. Enforcement of state physician self-referral laws varies widely and is often inconsistent and erratic. Our management carefully considers the importance of physician self-referral laws when structuring company operations. That said, we cannot assure that the applicable regulatory authorities will not determine that some of our arrangements with physicians violate the Federal Stark Law or other applicable laws. An adverse determination could subject us to different liabilities, including criminal penalties, civil monetary penalties and exclusion from participation in Medicare, Medicaid or other health care programs, any of which could have a material adverse effect on our business, financial condition or results of operations. False Claims Act The federal False Claims Act, 31 U.S.C. § 3729, imposes civil penalties for knowingly submitting or causing the submission of a false or fraudulent claim for payment to a government-sponsored program, such as Medicare and Medicaid. Violations of the False Claims Act present civil liability of treble damages plus a penalty of at least $11,803 per false claim. The False Claims Act has "whistleblower" or "qui tam" provisions that allow individuals to commence a civil action in the name of the government, and the whistleblower is entitled to share in any subsequent recovery (plus attorney's fees). Many states also have enacted civil statutes that largely mirror the federal False Claims Act, but allow states to impose penalties in a state court. The False Claims Act has been used by the federal government and qui tam plaintiffs to bring enforcement actions under so-called "fraud and abuse" laws like the federal Anti-Kickback Statute and the Stark Law. Such actions are not based on a contention that claims for payment were factually false or inaccurate. Instead, such actions are based on the theory that accurate claims are deemed to be false/fraudulent if there has been noncompliance with some other material law or regulation. The existence of the False Claims Act, under which so-called qui tam plaintiffs can allege liability for a wide range of regulatory noncompliance, increases the potential for such actions to be brought and has increased the potential financial exposure for such actions. These actions are costly and time-consuming to defend. Our management carefully considers the importance of compliance with all applicable laws and when structuring company operations. Our management is aware of and actively works to minimize risk related to potential qui tam plaintiffs. That said, we cannot assure that the applicable enforcement authorities or qui tam plaintiffs will not allege violations of the False Claims Act or analogous state false claims laws. A finding of liability under the False Claims Act could have a material adverse effect on our business, financial condition or results of operations. State Licensure and Accreditation States have a wide variety of health care laws and regulations that potentially affect our operations and the operations of our partners. For example: (1) many states have implemented laws and regulations related to so-called "tele-health," but whether those laws apply to our operations, and the obligations they impose, vary significantly; (2) some states have so-called corporate practice of medicine prohibitions, and such prohibitions are used to indirectly regulate ownership of heath care companies and/or management companies; and (3) some states have "surprise billing" or out-of-network billing laws that impose a variety of obligations on health care providers and health plans. The failure to comply with all state regulatory obligations could be used by health plans to deny payment or to recoup funds, and any noncompliance could subject us to penalties or limitations that could have a material adverse effect on our business, financial condition or results of operations. In addition, our partners' health care facilities and professionals are subject to professional and private licensing, certification and accreditation requirements. These include, but are not limited to, requirements imposed by Medicare, Medicaid, state licensing authorities, voluntary accrediting organizations and third-party private payors. Receipt and renewal of such licenses, certifications and accreditations are often based on inspections, surveys, audits, investigations or other reviews, some of which may require affirmative compliance actions by us that could be burdensome and expensive. The applicable standards may change in the future. There can be no assurance that we will be able to maintain all necessary licenses or certifications in good standing or that they will not be required to incur substantial costs in doing so. The failure to maintain all necessary licenses, certifications and accreditations in good standing, or the expenditure of substantial funds to maintain them, could have an adverse effect on our business. Health Information Privacy and Security Standards The privacy and data security regulations under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended, contain detailed requirements concerning (1) the use and disclosure of individually identifiable patient health information ("PHI"); (2) computer and data security standards regarding the protection of electronic PHI including storage, utilization, access to and transmission; and (3) notification to individuals and the federal government in the event of a breach of unsecured PHI. HIPAA covered entities and business associates must implement certain administrative, physical, and technical security standards to protect the integrity, confidentiality and availability of certain electronic health information received, maintained, or transmitted. Violations of the HIPAA privacy and security rules may result in civil and criminal penalties. In the event of a breach, a HIPAA covered entity must promptly notify affected individuals of a breach. All breaches must also be reported to the federal government. Where a breach affects more than 500 individuals, additional reporting obligations apply. In addition to federal enforcement, State attorneys general may bring civil actions on behalf of state residents for violations of the HIPAA privacy and security rules, obtain damages on behalf of state residents, and enjoin further violations. Many states also have laws that protect the privacy and security of confidential, personal information, which may be similar to or even more stringent than HIPAA. Some of these state laws may impose fines and penalties on violators and may afford private rights of action to individuals who believe their personal information has been misused. We expect increased federal and state privacy and security enforcement efforts. Our management carefully considers the importance of compliance with patient privacy and data security regulations when structuring company operations. Our management is aware of and actively works to minimize risk related to patient privacy and data security. That said, we cannot assure that a breach will not occur or that the applicable enforcement authorities will not allege violations of HIPAA's patient privacy and data security regulations. A breach or an allegation of noncompliance with HIPAA's patient privacy and data security regulations could have a material adverse effect on our business, financial condition or results of operations.

Changes to U.S. tax laws (which changes may have retroactive application) could adversely affect us or holders of our common stock. In recent years, many changes to U.S. federal income tax laws have been proposed and made, and additional changes to U.S. federal income tax laws are likely to continue to occur in the future. The U.S. Congress is currently considering numerous items of legislation which may be enacted prospectively or with retroactive effect, which legislation could adversely impact our financial performance and the value of shares of our common stock. Additionally, states in which we operate or own assets may impose new or increased taxes. If enacted, most of the proposals would be effective for the current or later years. The proposed legislation remains subject to change, and its impact on us or our investors is uncertain. In addition, the Inflation Reduction Act of 2022 includes provisions that will impact the U.S. federal income taxation of corporations. Among other items, this legislation includes provisions that will impose a minimum tax on the book income of certain large corporations and an excise tax on certain corporate stock repurchases that would be imposed on the corporation repurchasing such stock. It is unclear how this legislation will be implemented by the U.S. Department of Treasury and we cannot predict how this legislation or any future changes in tax laws might affect us or investors in our common stock.

The health care industry is heavily regulated, and we are required to comply with extensive and complex laws and regulations at the federal, state and local government levels relating to among other things: - Insurance: the collapse or insolvency of our insurance carriers; further increases in premiums and deductibles; increases in the number of liability claims against us or the cost of settling or trying cases related to those claims; an inability to obtain one or more types of insurance on acceptable terms, if at all; insurance carriers deny coverage of our claims; or our insurance coverage is not adequate. - Billing and Collections: billing and coding for services, including documentation of care, appropriate treatment of overpayments and credit balances, and the submission of false statements or claims; relationships and arrangements with physicians and other referral sources and referral recipients, including self-referral restrictions, and prohibitions on kickbacks and other non-permitted forms of remuneration and prohibitions on the payment of inducements to Medicare and Medicaid beneficiaries in order to influence their selection of a provider. - Governmental Regulation: licensure, certification, enrollment in government programs and certificate of need approval, including requirements affecting the operation, establishment and addition of services and facilities; the necessity, appropriateness, and adequacy of medical care, equipment, and personnel and conditions of coverage and payment for services; quality of care and data reporting; restrictions on ownership of surgery centers; operating policies and procedures; qualifications, training and supervision of medical and support personnel; and fee-splitting and the corporate practice of medicine;- Patient Care: screening of individuals who have emergency medical conditions; workplace health and safety; consumer protection; anti-competitive conduct; and confidentiality, maintenance, data breach, identity theft and security issues associated with health-related and other personal information and medical records. Because of the breadth of these laws and the narrowness of available exceptions and safe harbors, it is possible that some of our business activities could be subject to challenge under one or more of these laws. For example, failure to bill properly for services or return overpayments and violations of other statutes, such as the federal Anti-Kickback Statute or the federal Stark Law, may be the basis for actions under similar state laws. Under HIPAA, criminal penalties may be imposed for health care fraud offenses involving not just federal health care programs but also private health benefit programs. Enforcement actions under some statutes may be brought by the government as well as by a private person under a qui tam or "whistleblower" lawsuit. Federal enforcement officials have numerous enforcement mechanisms to combat fraud and abuse, including bringing civil actions under the Civil Monetary Penalty Law, which has a lesser burden of proof than criminal statutes. If we fail to comply with applicable laws and regulations, we could suffer civil or criminal penalties, including fines, damages, recoupment of overpayments, loss of licenses needed to operate, and loss of enrollment and approvals necessary to participate in Medicare, Medicaid and other government sponsored and third-party health care programs. Federal enforcement officials have the ability to exclude from Medicare and Medicaid any investors, officers and managing employees associated with business entities that have committed health care fraud. Many of these laws and regulations have not been fully interpreted by regulatory authorities or the courts, and their provisions are sometimes open to a variety of interpretations. Different interpretations or enforcement of existing or new laws and regulations could subject our current practices to allegations of impropriety or illegality, or require us to make changes in our operations, facilities, equipment, personnel, services, capital expenditure programs or operating expenses to comply with the evolving rules. Any enforcement action against us, even if we successfully defend against it, could cause us to incur significant legal expenses and divert our management's attention from the operation of our business. The laws and regulations governing the provision of health care services are frequently subject to change and may change significantly in the future. We cannot assure you that current or future legislative initiatives, government regulation or judicial or regulatory interpretations thereof will not have a material adverse effect on us. We cannot assure you that a review of our business by judicial, regulatory or accreditation authorities will not subject us to fines or penalties, require us to expend significant amounts, reduce the demand for our services or otherwise adversely affect our operations.

As a health care provider, we are subject to professional liability claims both directly and indirectly through the malpractice of members of our medical staff. We are responsible for the standard of care provided in Procedure Facilities by staff working in those facilities. We have legal responsibility for the physical environment and appropriate operation of our equipment used during surgical procedures. In addition, we are subject to various liability for the negligence of its credentialed medical staff under circumstances where we either knew or should have known of a problem leading to a patient injury. The physicians credentialed at Procedure Facilities are involved in the delivery of health care services to the public and are exposed to the risk of professional liability claims. Although we neither control the practice of medicine by physicians nor have responsibility for compliance with certain regulatory and other requirements directly applicable to physicians and their services, as a result of the relationship between us and the physicians providing services to patients in Procedure Facilities, we or our subsidiaries may become subject to medical malpractice claims under various legal theories. Claims of this nature, if successful, could result in damage awards to the claimants in excess of the limits of available insurance coverage. Insurance against losses related to claims of this type can be expensive and varies widely from state to state. We maintain and require the physicians on the medical staff of Procedure Facilities to maintain liability insurance in amounts and coverages believed to be adequate, presently $1 million per claim to an aggregate of $3 million per year. Most malpractice liability insurance policies do not extend coverage for punitive damages. While extremely rare in the medical area, punitive damages are those damages assessed by a jury with the intent to "punish" a tortfeasor rather than pay for a material loss resulting from the alleged injury. We cannot assure you that we will not incur liability for punitive damage awards even where adequate insurance limits are maintained. We also believe that there has been, and will continue to be, an increase in governmental investigations of physician-owned facilities, particularly in the area of Medicare/Medicaid false claims, as well as an increase in enforcement actions resulting from these investigations. Investigation activity by private third-party payors has also increased with, in some cases, intervention by the states' attorneys general. Also possible are potential non-covered claims, or "qui tam" or "whistleblower" suits. Any adverse determination in a legal proceeding or governmental investigation, whether currently asserted or arising in the future, could have a material adverse effect on our financial condition.

In April 2022, the U.S. Department of Justice ("DOJ") issued Civil Investigative Demands to the Company which seek information with respect to a civil investigation under the Anti-kickback Statute and the False Claims Act. We voluntarily contacted the DOJ offering to provide any materials needed in the investigation and to answer any questions. While our policy during the relevant time was to not seek payments from federal health care programs, the third-party billing company we used at that time submitted some claims to Medicare Advantage plans administered by commercial insurance companies. We have worked diligently to ensure that payments from Medicare Advantage plans have been returned to the commercial insurance companies and we believe we have returned substantially all such payments that we have discovered to date, totaling approximately $450,000. The DOJ has not made any allegations in the investigation, and we are currently unable to predict the eventual scope, ultimate timing, or outcome of this investigation. During February 2024, a Settlement Agreement ("Agreement") was executed between Assure and the United States Department of Justice ("DOJ"). In exchange for a payment of approximately $1 million, the Agreement releases Assure from any civil or administrative monetary claim the United States has for the Covered Conduct under the False Claims Act, 31 U.S.C. §§ 3729-3733; the Civil Monetary Penalties Law, 42 U.S.C. § 1320a-7a; the Program Fraud Civil Remedies Act, 31 U.S.C. §§ 3801-3812; or the common law theories of payment by mistake, unjust enrichment, and fraud. Payments are in equal monthly installments over the next 12 months.

Political, economic, and regulatory influences continue to change the health care industry in the United States. The ability of hospitals to pay fees for our products partially depends on the extent to which reimbursement for the costs of such materials and related treatments will continue to be available from private health coverage insurers and other similar organizations. We may have difficulty gaining market acceptance for the products we sell if third-party payors do not provide adequate coverage and reimbursement to hospitals. Major third- party payors of hospitals, such as private health care insurers, periodically revise their payment methodologies based, in part, upon changes in government sponsored health care programs. We cannot predict these periodic revisions with certainty, and such revisions may result in stricter standards for reimbursement of hospital charges for certain specified products, potentially adversely impacting our business, results of operations, and financial conditions.

Our success, in large part, is dependent upon referrals to our physicians from other physicians, systems, health plans and others in the communities in which we operate, and upon our medical staff's ability to maintain good relations with these referral sources. Physicians who use Procedure Facilities and those who refer patients are not our employees and, in many cases, most physicians have admitting privileges at other hospitals and (subject to any applicable non-competition arrangements) may refer patients to other providers. If we are unable to successfully cultivate and maintain strong relationships with our physicians and their referral sources, the number of managed cases performed at Procedure Facilities may decrease and cause revenues to decline. This could adversely affect our business, results of operations and financial condition.

We believe that value-based purchasing initiatives of both governmental and private payors tying financial incentives to quality and efficiency of care will increasingly affect the results of operations of Procedure Facilities and may negatively impact our revenues if we are unable to meet expected quality standards. We may be affected by the Patient Protection and Affordable Care Act ("ACA"), which contains several provisions intended to promote value-based purchasing in federal health care programs. Medicare now requires providers to report certain quality measures in order to receive full reimbursement increases for inpatient and outpatient procedures that were previously awarded automatically. In addition, hospitals that meet or exceed certain quality performance standards will receive increased reimbursement payments, while hospitals that have "excess readmissions" for specified conditions will receive reduced reimbursement. There is a trend among private payors toward value-based purchasing of health care services, as well. Many large commercial health insurance payors require hospitals to report quality data, and several of these payors will not reimburse hospitals for certain preventable adverse events. We expect value based purchasing programs, including programs that condition reimbursement on patient outcome measures, to become more common, to involve a higher percentage of reimbursement amounts and to spread to reimbursement for ancillary services. Although we are unable to predict how this trend will affect our future results of operations, it could negatively impact our revenues if we are unable to meet quality standards established by both governmental and private payors.

One of the complexities of our business is navigating the increasingly hostile environment for entities that are not participants in the health insurance companies' ("Third-Party Payors") provider networks (also referred to as an out-of-network provider or facility). Third-Party Payors negotiate discounted fees with providers and facilities in return for access to the patient populations which those Third-Party Payors cover. The providers and facilities that contractually agree to these rates become part of the Third-Party Payor's "network". We are currently out-of-network as to most Third-Party Payors. There are several risks associated with not participating in Third-Party Payor networks. First, not all Third- Party Payors offer coverage to their patients for services rendered by non-participants in that Third-Party Payor's network. Further, it is typically the case that patients with so-called "out-of-network benefits" will be obliged to pay higher co-pays, higher deductibles, and a larger percentage of co-insurance payments. In addition, because the out-of-network coverage often mandates payment at a "usual and customary rate", the determination of the amounts payable by the Third-Party Payor can fluctuate. Health care providers and facilities that choose not to participate in a Third-Party Payor's network often face longer times for their claims to be processed and paid. Further, many Third-Party Payors aggressively audit claims from out-of-network providers and facilities and continuously change their benefit policies in various ways that restrict the ability of beneficiaries to access out of network benefits, and to restrict out-of-network providers from treating their beneficiaries. Consequently, it may become necessary for us to change our out- of-network strategy and join Third-Party Payor networks. This may require us to negotiate and maintain numerous contracts with various Third-Party Payors. In either case, our performance is greatly dependent upon decisions that Third-Party Payors make regarding their out-of-network benefits and alternatively, our ability to negotiate profitable contracts with Third-Party Payors. If it becomes necessary for us to convert entirely to in-network, there is no guarantee that we will be able to successfully negotiate these contracts. Further, we may experience difficulty in establishing and maintaining relationships with health maintenance organizations, preferred provider organizations, and other Third-Party Payors. Out-of-network reimbursement rates are typically higher than in network reimbursement rates, so our revenue would likely decline if we move to an in-network provider strategy and fail to increase our volume of business sufficiently to offset reduced in-network reimbursement rates. These factors could adversely affect our revenues and our business. Historically, all privately insured cases were billed on an out-of-network basis. Over the past three years, the Company has shifted some of the business to direct and indirect contracts with the payors and related parties. However, as of December 31, 2023, virtually all of our privately insured cases remain out of network basis, without any reimbursement rate protection or consistent in-network patient enrollments typically seen from an in-network agreement. Accordingly, we are susceptible to changes in reimbursement policies and procedures by Third-Party Payors and patients' preference of using their out-of-network benefits which could have an adverse effect on our business, results of operations and financial condition.

Approximately 83% of our accrued revenue for the year ended December 31, 2023 relates to 30 third-party payors. The loss or disruption of any one of these payors could have an adverse effect on our business, results of operations and financial condition. Additionally, about 79% of our cash collections during the year ended December 31, 2023 was concentrated among these same third-party payors. Greater diversification of payors is dependent on expansion into new markets.