Marpai (MRAI) Risk Analysis

Our success and ability to compete depend largely upon our intellectual property. To date, we have three patent applications pending in the U.S. We take reasonable steps to protect our intellectual property, especially when working with third parties. However, the steps we take to protect our intellectual property rights may be inadequate. For example, other parties, including our competitors, may independently develop similar technology, duplicate our services, or design around our intellectual property and, in such cases, we may not be able to assert our intellectual property rights against such parties. Further, our contractual arrangements may not effectively prevent disclosure of our confidential information or provide an adequate remedy in the event of unauthorized disclosure of our confidential information, and we may be unable to detect the unauthorized use of, or take appropriate steps to enforce, our intellectual property rights. We make business decisions about when to seek patent protection for a particular technology and when to rely upon trade secret protection, and the approach we select may ultimately prove to be inadequate. Even in cases where we seek patent protection, there is no assurance that the resulting patents will effectively protect every significant feature of our model, technology, or proprietary information, or provide us with any competitive advantages. Moreover, we cannot guarantee that any of our pending patent applications will issue or be approved. The United States Patent and Trademark Office and various foreign governmental patent agencies also require compliance with several procedural, documentary, fee payment, and other similar provisions during the patent application process and after a patent has issued. There are situations in which noncompliance can result in abandonment or lapse of the patent, or patent application, resulting in partial or complete loss of patent rights in the relevant jurisdiction. If this occurs, our competitors might be able to enter the market, which would have a material adverse effect on our business. Effective trademark, copyright, patent, and trade secret protection may not be available in every country in which we conduct business. Further, intellectual property law, including statutory and case law, particularly in the United States, is constantly developing, and any changes in the law could make it harder for us to enforce our rights. To protect our intellectual property rights, we may be required to spend significant resources to monitor and protect these rights. Litigation brought to protect and enforce our intellectual property rights could be costly, time-consuming, and distracting to management and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights. An adverse determination of any litigation proceedings could put our intellectual property at risk of being invalidated or interpreted narrowly and could put our related pending patent applications at risk of not being issued. Furthermore, because of the substantial amount of discovery required in connection with intellectual property litigation, there is a risk that some of our confidential or sensitive information could be compromised by disclosure in the event of litigation. In addition, during litigation, there could be public announcements of the results of hearings, motions or other interim proceedings or developments. If securities analysts or investors perceive these results to be negative, it could have a substantial adverse effect on the price of our common stock. Negative publicity related to a decision by us to initiate such enforcement actions against a client or former client, regardless of its accuracy, may adversely impact our other client relationships or prospective client relationships, harm our brand and business, and could cause the market price of our common stock to decline. Our failure to secure, protect, and enforce our intellectual property rights could adversely affect our brand and our business.

We use software modules licensed to us by third-party authors under "open-source" licenses in our Member guidance program. Some open-source licenses contain affirmative obligations or restrictive terms that could adversely impact our business, such as restrictions on commercialization or obligations to make available modified or derivative works of certain open-source code. If we were to combine our proprietary software with certain open-source software subject to these licenses in a certain manner, we could, under certain open-source licenses, be required to release or otherwise make available the source code to us proprietary software to the public. This would allow our competitors to create similar products with lower development effort and time and ultimately could result in a loss of sales for us. Although we employ practices designed to manage our compliance with open-source licenses and protect our proprietary source code, we may inadvertently use open-source software in a manner we do not intend and that could expose us to claims for breach of contract and intellectual property infringement. If we are held to have breached the terms of an open-source software license, we could be required to, among other things, seek licenses from third parties to continue offering our products on terms that are not economically feasible, pay damages to third parties, to re-engineer our products, to discontinue the sale of our products if re-engineering cannot be accomplished on a timely basis,or to make generally available, in source code form, a portion of our proprietary code, any of which could adversely affect our business, results of operations, and financial condition. The terms of many open-source licenses have not been interpreted by U.S. courts, and, as a result, there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to commercialize our member guidance program.

In the United States and some foreign jurisdictions, there have been, and continue to be, several legislative and regulatory changes and proposed changes regarding the healthcare system that could create unexpected liabilities for us, cause us to incur additional costs, and restrict our operations. Among policy makers and payors in the United States and elsewhere, there is significant interest in promoting changes in healthcare systems with the stated goals of containing healthcare costs, improving quality and/or expanding access. Many healthcare laws are complex, and their application to specific services and relationships may not be clear. In particular, many existing healthcare laws and regulations, when enacted, did not anticipate the data analytics and improvement services that we provide, and these laws and regulations may be applied to our product and service offerings in ways that we do not anticipate, particularly as we develop and release new and more sophisticated solutions. Certain changes to laws impacting our industry, or perceived intentions to do so, could affect our business and the results of operations. Some of the risks we face from healthcare regulation are described below: False Claims Laws. There are numerous federal and state laws that prohibit submission of false information, or the failure to disclose information, in connection with submission (or causing the submission) and payment of claims for reimbursement. For example, the federal civil False Claims Act prohibits, among other things, individuals or entities from knowingly presenting, or causing to be presented, to the U.S. federal government, claims for payment or approval that are false or fraudulent, or knowingly making, using or causing to be made or used, a false record or statement material to a false or fraudulent claim. In addition, the government may assert that a claim including items and services resulting from a violation of the U.S. federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the civil False Claims Act. If our advisory services to clients are associated with action by clients that is determined or alleged to be in violation of these laws and regulations, it is possible that an enforcement agency would also try to hold us accountable. Any determination by a court or regulatory agency that we have violated these laws could subject us to significant civil or criminal penalties, invalidate all or portions of some of our client contracts, require us to change or terminate some portions of our business, require us to refund portions of us services fees, subject us to additional reporting requirements and oversight under a corporate integrity agreement or similar agreement to resolve allegations of noncompliance with these laws, cause us to be disqualified from serving clients doing business with government payers, and have an adverse effect on our business. Our Clients' failure to comply with these laws and regulations in connection with our services could result in substantial liability (including, but not limited to, criminal liability), adversely affect - demand for our services, and force us to expend significant capital, research and development, and other resources to address the failure. - Health Data Privacy Laws. There are numerous federal and state laws related to health information privacy. In particular, the federal Health Insurance Portability and Accountability Act of 1996, as amended by the HITECH and their implementing regulations, which we collectively refer to as "HIPAA," include privacy standards that protect individual privacy by limiting the uses and disclosures of PHI and implementing data security standards that require covered entities to implement administrative, physical, and technological safeguards to ensure the confidentiality, integrity, availability, and security of PHI in electronic form. In addition to enforcement actions initiated by regulatory bodies under HIPAA, violations or breaches caused by us or our contractors may result in related claims against us by clients, which may be predicated upon underlying contractual responsibilities, and by Members, which may be predicated upon tort law or state privacy claims, as HIPAA does not contain a private right of action. HIPAA also specifies formats that must be used in certain electronic transactions, such as admission and discharge messages and limits the fees that may be charged for certain transactions, including claim payment transactions. By processing and maintaining PHI on behalf of our covered entity clients, we are a HIPAA business associate and mandated by HIPAA to enter into written agreements with our covered entity clients?-?known as Business Associate Agreements ("BAAs")?-?that require us to safeguard PHI. BAAs typically include;- a description of our permitted uses of PHI;- a covenant not to disclose that information except as permitted under the BAAs and to require that our subcontractors, if any, are subject to the substantially similar restrictions;- assurances that reasonable and appropriate administrative, physical, and technical safeguards are in place to prevent misuse of PHI;- an obligation to report to our client any use or disclosure of PHI other than as provided for in the BAAs;- a prohibition against our use or disclosure of PHI if a similar use or disclosure by our client would violate the HIPAA standards;- the ability of our clients to terminate the underlying support agreement if we breach a material term of the BAAs and are unable to cure the breach;- the requirement to return or destroy all PHI at the end of our services agreement; and - access by the Department of Health and Human Services ("HHS") to our internal practices, books, and records to validate that we are safeguarding PHI. In addition, we are also required to maintain BAAs, which contain similar provisions, with our subcontractors that access or otherwise process PHI on our behalf. We may not be able to adequately address the business risks created by HIPAA implementation, and meet the requirements imposed by HIPAA. Furthermore, we are unable to predict what changes to HIPAA or other laws or regulations might be made in the future or how those changes could affect our business or the costs of compliance. For example, in 2018, the HHS Office for Civil Rights published a Request for Information in the Federal Register seeking comments on several areas in which HHS is considering making both minor and significant modifications to the HIPAA privacy and security standards to, among other things, improve care coordination. We are unable to predict what, if any, impact the changes in such standards will have on our compliance costs or our product and service offerings. We will also require large sets of de-identified information to enable us to continue to develop AI algorithms that enhance our product and service offerings. If we are unable to secure these rights in Client BAAs or because of any future changes to HIPAA or other applicable laws, we may face limitations on the use of PHI and our ability to use de-identified information that could negatively affect the scope of our product and service offering as well as impair our ability to provide upgrades and enhancements to our services. We outsource important aspects of the storage and transmission of client and member information, and thus rely on third parties to manage functions that have material cyber-security risks. We attempt to address these risks by requiring outsourcing subcontractors who handle client information to sign BAAs contractually requiring those subcontractors to adequately safeguard PHI in a similar manner that applies to us and in some cases by requiring such outsourcing subcontractors to undergo third-party security examinations as well as to protect the confidentiality of other sensitive client information. In addition, we periodically hire third-party security experts to assess and test our security measures. However, we cannot be assured that these contractual measures and other safeguards will adequately protect us from the risks associated with the storage and transmission of client proprietary information and PHI. Centers for Medicare and Medicaid Services ("CMS") takes the position that an electronic fund transfer ("EFT") payment to a health care provider is a "standard transaction" under HIPAA. As a "standard transaction", these provider payments may be subject to certain limitations on the fees that may be charged for an EFT payment transaction with a health care provider. We outsource important aspects of our EFT payments to health care providers and thus rely on third parties to manage the EFT transactions and assure that the fees charged comply with HIPAA. The application of HIPAA to EFT payments is complex, and their application to specific value-added services for health care providers may not be clear. Our failure to accurately anticipate the application of HIPAA's fee restrictions on certain standard transactions could create significant liability for us, resulting in negative publicity, and material adverse effect on our business and operating results. In addition to the HIPAA privacy and security standards, most states have enacted patient confidentiality laws that protect against the disclosure of confidential medical and other personally identifiable information ("PII") and many states have adopted or are considering new privacy laws, including legislation that would mandate new privacy safeguards, security standards, and data security breach notification requirements. Such state laws, if more stringent than HIPAA requirements, are not preempted by the federal requirements, and we are required to comply with them. In addition, the Federal Trade Commission, and analogous state agencies, may apply consumer protection laws to the context of data privacy. For example, the Federal Trade Commission has sanctioned companies for unfair trade practices when they failed to implement adequate security protection measures for sensitive personal information, or when they provided inadequate disclosures to consumers about the expansive scope of data mined from consumer activity. Failure by us to comply with any of the federal and state standards regarding patient privacy and/or privacy more generally may subject us to penalties, including significant civil monetary penalties and, in some circumstances, criminal penalties. In addition, such failure may injure our reputation and adversely affect our ability to retain clients and attract new clients. Even an unsuccessful challenge by regulatory authorities of our activities could result in adverse publicity and could require a costly response from us. - Anti-Kickback and Anti-Bribery Laws. There are federal and state laws that prohibit payment for patient referrals, patient brokering, remuneration of Members, or billing based on referrals between individuals or entities that have various financial, ownership, or other business relationships with healthcare providers. In particular, the federal Anti-Kickback law prohibits offering, paying, soliciting, or receiving anything of value, directly or indirectly, for the referral of members covered by Medicare, Medicaid, and other federal healthcare programs or the leasing, purchasing, ordering, or arranging for or recommending the lease, purchase, or order of any item, good, facility, or service covered by these programs. A person or entity does not need to have actual knowledge of the statute or specific intent to violate it to have committed a violation. Some enforcement activities focus on below or above market payments for federally reimbursable health care items or services as evidence of the intent to provide a kickback. Many states also have similar anti-kickback laws, some of which are applicable to all patients and that are not necessarily limited to items or services for which payment is made by a federal healthcare program. In addition, the federal physician self-referral prohibition -?the Stark Law?-?is very complex in its application and prohibits physicians (and certain other healthcare professionals) from making a referral for a designated health service to a provider in which the referring healthcare professional (or spouse or any immediate family member) has a financial or ownership interest, unless an enumerated exception applies. The Stark Law also prohibits the billing for services rendered resulting from an impermissible referral. Many states also have similar anti-referral laws that are not necessarily limited to items or services for which payment is made by a federal healthcare program and may include patient disclosure requirements. Moreover, both federal and state laws prohibit bribery and similar behavior. Any determination by a state or federal regulatory agency that we or any of our clients, vendors, or partners violate or have violated any of these laws could subject us to significant civil or criminal penalties, require us to change or terminate some portions of our business, require us to refund portions of our services fees, subject us to additional reporting requirements and oversight under a corporate integrity agreement or similar agreement to resolve allegations of noncompliance with these laws, cause us to be disqualified from serving clients doing business with government payers, and have an adverse effect on our business. Even an unsuccessful challenge by regulatory authorities of our activities could result in adverse publicity and could require a costly response from us. - Corporate Practice of Medicine Laws and Fee-Splitting Laws. Many states have enacted laws prohibiting physicians from practicing medicine in partnership with non-physicians, such as business corporations. In addition, many states prohibit certain licensed professionals, such as physicians, from splitting professional fees with non-licensees. As we do not engage in the practice of medicine, we do not contract with providers to render medical care, and we do not split fees with any medical professionals, we do not believe these laws restrict our business. Our activities involve only monitoring and analyzing historical claims data, including our Members' interactions with licensed healthcare professionals, and recommending the most suitable healthcare providers and/or sources of treatment. We do not provide medical prognosis or healthcare. In accordance with various states' corporate practice of medicine laws and states' laws and regulations which define the practice of medicine, our call center staff are prohibited from providing Members with any evaluation of any medical condition, diagnosis, prescription, care and/or treatment. Rather, our call center staff can only provide Members with general and publicly available information that is non-specific to the Members' medical conditions and statistical information about the prevalence of medical conditions within certain populations or under certain circumstances. Our call center staff do not discuss Members' individual medical conditions and are prohibited from asking Members for any additional PHI as such term is defined under HIPAA. Our call center staff have been trained and instructed to always inform Members that they are not licensed medical professionals, are not providing medical advice, and that Members should reach out to their medical provider for any medical advice. - Medical professional regulation. The practice of most healthcare professions requires licensing under applicable state law. In addition, the laws in some states prohibit business entities from practicing medicine. In the future, we may contract with physicians, nurses, and nurse practitioners, who will assist our clients with the clients' care coordination, care management, population health management, and patient safety activities that do not constitute the practice of medicine. We do not intend to provide medical care, treatment, or advice. However, any determination that we are acting in the capacity of a healthcare provider and acted improperly as a healthcare provider may result in additional compliance requirements, expense, and liability to us, and require us to change or terminate some portions of our business, including the use of licensed professionals to conduct the foregoing activities. - Medical Device Laws. The U.S. Food and Drug Administration ("FDA") may regulate medical or health-related software, including machine learning functionality and predictive algorithms, if such software falls within the definition of a "device" under the federal Food, Drug, and Cosmetic Act ("FDCA"). However, the FDA exercises enforcement discretion for certain low-risk software, as described in its guidance documents for Mobile Medical Applications, General Wellness: Policy for Low-Risk Devices, and Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices. In addition, in December of 2016, President Obama signed into law the 21st Century Cures Act, which included exemptions for certain medical-related software, including software used for administrative support functions at a healthcare facility, software intended for maintaining or encouraging a healthy lifestyle, electronic health record ("EHR software"), software for transferring, storing, or displaying medical device data or in vitro diagnostic data, and certain clinical decision support software. The FDA has also issued draft guidance documents to clarify how it intends to interpret and apply the new exemptions under the 21st Century Cures Act. Although we believe that our software products are currently not subject to active FDA regulation, we continue to follow the FDA's developments in this area. There is a risk that the FDA could disagree with our determination or that the FDA could develop new final guidance documents that would subject our Product to active FDA oversight. If the FDA determines that any of our current or future analytics applications are regulated as medical devices, we would become subject to various requirements under the FDCA and the FDA's implementing regulations. Depending on the functionality and FDA classification of our analytics applications, we may be required to: - register and list our AI products with the FDA;- notify the FDA and demonstrate substantial equivalence to other products on the market before marketing our analytics applications;- submit a de novo request to the FDA to down-classify our analytics applications prior to marketing; or - obtain FDA approval by demonstrating safety and effectiveness before marketing our analytics applications. The FDA can impose extensive requirements governing pre- and post-market conditions, such as service investigation and others relating to approval, labeling, and manufacturing. In addition, the FDA can impose extensive requirements governing software development controls and quality assurance processes. The AI algorithm has undergone testing to follow the Quality System regulation (that includes camp's) (good manufacturing practices) and quality controls in the design, development, AI training and testing. Marpai AI algorithms have been validated by our R&D team to determine generalizability, accuracy and reliability and are monitored carefully. Additionally, the algorithms were trained on large, diverse patient datasets to ensure they are not biased and that they perform as assumed across diverse sets of patients and settings. The regulatory landscape is evolving, and the FDA is in the process of issuing a comprehensive guidance on AI software which may change how our product is regulated. Many states have licensing and other regulatory requirements requiring licensing of businesses which provide medical review services. These laws typically establish minimum standards for qualifications of personnel, confidentiality, internal quality control, and dispute resolution procedures. To the extent we are governed by these regulations, these regulatory programs may result in increased costs of operation for us, which may have an adverse impact upon our ability to compete with other available alternatives for healthcare cost control. In addition, new laws regulating the operation of managed care provider networks have been adopted by several states. These laws may apply to managed care provider networks we have contracts with. To the extent we are governed by these regulations, we may be subject to additional licensing requirements, financial and operational oversight and procedural standards for beneficiaries and providers. These laws and regulations may change rapidly, and it is frequently unclear how they apply to our business. Any failure of our products or services to comply with these laws and regulations could result in substantial civil or criminal liability and could, among other things, adversely affect demand for our services, force us to expend significant capital, research and development, and other resources to address the failure, invalidate all or portions of some of our contracts with our clients, require us to change or terminate some portions of our business, require us to refund portions of our revenue, cause us to be disqualified from serving clients doing business with government payers, and give our clients the right to terminate our contracts with them, any one of which could have an adverse effect on our business. Additionally, the introduction of new services may require us to comply with additional, yet undetermined, laws and regulations. The security measures that we and our third-party vendors and subcontractors have in place to ensure compliance with privacy and data protection laws may not protect our facilities and systems from security breaches, acts of vandalism or theft, computer viruses, misplaced or lost data, programming and human errors, or other similar events. Under the HITECH Act, as a business associate, we may also be liable for privacy and security breaches and failures of our subcontractors, in addition to those that may be caused by us. Even though we provide for appropriate protections through our agreements with our subcontractors, we still have limited control over their actions and practices. A breach of privacy or security of individually identifiable health information by a subcontractor may result in an enforcement action, including criminal and civil liability, against us. We are not able to predict the extent of the impact such incidents may have on our business. Our failure to comply may result in criminal and civil liability because the potential for enforcement action against business associates is now greater. Enforcement actions against us could be costly and could interrupt regular operations, which may adversely affect our business. While we have not received any notices of violation of the applicable privacy and data protection laws and believe we are in compliance with such laws, there can be no assurances that we will not receive such notices in the future or suffer a breach. Any failure or perceived failure by us to comply with federal or state laws or regulations, industry standards, or other legal obligations, or any actual or suspected security incident, whether or not resulting in unauthorized access to, or acquisition, release, or transfer of personally identifiable information or other data, may result in governmental enforcement actions and prosecutions, private litigation, fines, and penalties or adverse publicity and could cause our clients to lose trust in us, which could have an adverse effect on our reputation and business. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new products and features could be limited. Any of these developments could harm our business, financial condition, and results of operations. Privacy and data security concerns, whether valid or not valid, may inhibit market adoption of our platform.

Our member guidance program is hosted from and use computing infrastructure provided by third parties, including Amazon Web Services, and other computing infrastructure service providers. Our computing infrastructure service providers have no obligation to renew their agreements with us on commercially reasonable terms or at all. If we are unable to renew these agreements on commercially reasonable terms, or if one of our computing infrastructure service providers is acquired, we may be required to transition to a new provider and we may incur significant costs and possible service interruption in connection with doing so. Problems faced by our computing infrastructure service providers, including those operated by Amazon Web Services, could adversely affect the experience of our Clients. Amazon Web Services has also had and may in the future experience significant service outages. Additionally, if our computing infrastructure service providers are unable to keep up with our growing needs for capacity, this could have an adverse effect on our business. For example, a rapid expansion of our business could affect our service levels or cause our third-party hosted systems to fail. Our agreements with third-party computing infrastructure service providers may not entitle us to service level credits that correspond with those we offer to our Clients. Any changes in third-party service levels at our computing infrastructure service providers, or any related disruptions or performance problems with our product and service offering, could adversely affect our reputation and may damage our clients' stored files, result in lengthy interruptions in our services, or result in potential losses of client data. Interruptions in our services might reduce our revenue, cause us to issue refunds to clients for prepaid and unused subscriptions, subject us to service level credit claims and potential liability, allow our clients to terminate their contracts with us, or adversely affect our renewal rates.