National Research (NRC) Risk Analysis

In connection with our client services, we and our third-party service providers receive, process, store and transmit sensitive business information and, in certain circumstances, personal medical information of our clients' patients, electronically over the internet. We or our third-party service providers may become the target of attempted cyber-attacks and other security threats and may be subject to breaches of the information technology systems we use. Experienced computer programmers and hackers may be able to penetrate our security controls and access, misappropriate or otherwise compromise protected personal information or proprietary or confidential information or that of third parties, create system disruptions or cause system shutdowns that could negatively affect our operations. They also may be able to develop and deploy viruses, worms, ransomware, and other malicious software programs that attack our systems or otherwise exploit any security vulnerabilities In addition, the risk of cyber-attacks has increased in connection with the military conflict between Russia and Ukraine and the resulting geopolitical conflict. In light of those and other geopolitical events, nation-state actors or their supporters may launch retaliatory cyber-attacks and may attempt to cause supply chain and other third-party service provider disruptions, or take other geopolitically motivated retaliatory actions that may disrupt our business operations, result in data compromise, or both. Nation-state actors have in the past carried out, and may in the future carry out, cyber-attacks to achieve their aims and goals, which may include espionage, information operations, monetary gain, ransomware, disruption, and destruction. In February 2022, the U.S. Cybersecurity and Infrastructure Security Agency issued a "Shields Up" alert for American organizations noting the potential for Russia's cyber-attacks on Ukrainian government and critical infrastructure organizations to impact organizations both within and beyond the United States, particularly in the wake of sanctions imposed by the United States and its allies, which is still in effect. These circumstances increase the likelihood of cyber-attacks and/or security breaches. We were the target of a cyber-attack in 2020, which resulted in temporary suspension of our services to clients. One of our third-party service providers was the target of a cyber-attack in December 2022, which resulted in a temporary suspension of certain services to our clients. In both instances no protected data was compromised or exfiltrated. We, and our service providers, will likely continue to be the target of other attempted cyber-attacks and security threats. Such cyber-attacks may subject us to litigation and regulatory risk, civil and criminal penalties, additional costs and diversion of management attention due to investigation, remediation efforts and engagement of third-party consultants and legal counsel in connection with such incidents, payment of "ransoms" to regain access to our systems and information, loss of clients, damage to client relationships, reduced revenue and profits, refunds of client charges and damage to our reputation, any of which could have a material adverse effect on our business, cash flows, financial condition and results of operations. While we have contingency plans and insurance coverage for potential liabilities of this nature, they may not be sufficient to cover all claims and liabilities and in some cases are subject to deductibles and layers of self-insured retention. Any system failure, inability to upgrade or update, or security breach (including cyber-attacks) related to our information technology systems may also impact third parties that we rely on in our business and could result in a hinderance to the services provided by the Company or such third parties, as the case may be, and may have a material adverse effect on our business. We cannot ensure that we or our third-party service providers will be able to identify, prevent or contain the effects of cyber-attacks or other cybersecurity risks that bypass our security measures or disrupt our information technology systems or business. We have security technologies, processes and procedures in place to protect against cybersecurity risks and security breaches. However, hardware, software or applications we develop or procure from third parties may contain defects in design, manufacturer defects or other problems that could unexpectedly compromise information security. In addition, because the techniques used to obtain unauthorized access, disable or degrade service or sabotage systems change frequently, are becoming increasingly sophisticated, and may not immediately produce signs of intrusion, we may be unable to anticipate these techniques, timely discover or counter them or implement adequate preventative measures. In addition, we use third-party technology, systems and services for a variety of reasons, including, without limitation, encryption and authentication technology, employee email, content delivery to clients, back-office support, and other functions that in some cases involve processing, storing and transmitting large amounts of data for our business. These third-party providers may also experience security breaches or interruptions to their information technology hardware and software infrastructure and communications systems that could adversely impact us. Under the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, or HITECH, implementing regulations promulgated by the U.S. Department of Health and Human Services, or "HHS," including what are referred to as the "Privacy Rule" and the "Security Rule" (collectively, "HIPAA"), we face potential liability related to the privacy of health information we obtain.  We are required through our contracts with our clients and by HIPAA to protect the privacy and security of certain health information and to make certain disclosures to our clients or to the public if this information is unlawfully accessed. Changes in privacy and information security laws and standards may require that we incur significant expense to ensure compliance due to increased technology investment and operational procedures. Noncompliance with any privacy or security laws and regulations, including, without limitation, HIPPA, or any security breach, cyber-attack or cybersecurity breach, and any incident involving the misappropriation, loss or other unauthorized disclosure or use of, or access to, sensitive or confidential information, whether by us or by one of our third-party service providers, could require us to expend significant resources to continue to modify or enhance our protective measures and to remediate any damage. In addition, this could negatively affect our operations, cause system disruptions, damage our reputation, cause client losses and contract breaches, and could also result in regulatory enforcement actions, material fines and penalties, litigation or other actions that could have a material adverse effect on our business, cash flows, financial condition and results of operations.  Even if cyber-attacks or other cybersecurity breaches do not result in noncompliance with privacy or security laws, the perception that such noncompliance may have occurred by our clients or in the news media may have an adverse impact on our stock price and could result in damage to our reputation or loss of clients, which could have a material adverse effect on our business, cash flows, financial condition and results of operations.

Our ability to provide timely and accurate performance measurement and improvement service to our clients is dependent, to a significant extent, upon the technology that we develop internally as well as the efficient and uninterrupted operation of our information technology and communication systems, and those of our external service providers. Investment in the enhancement of existing and development of new information technology processes is costly and affects our ability to successfully serve our clients. The failure or deficiency of the technology we develop and implement could negatively impact the willingness or ability for our clients to use our services and our ability to perform our services. Our failure to anticipate clients' expectations and needs, adapt to emerging technological trends, or design efficient and effective information technology platforms, could result in lower utilization, loss of customers, damage to customer relationships, reduced revenue and profits, refunds to customers and damage to our reputation. Although we have procedures to monitor the efficacy of our information technology platforms, the procedures may not prevent failures or deficiencies in the information technology platforms we develop and implement, we may not adapt quickly enough and may incur significant costs and delays that could harm our business. Additional costs will be incurred to further develop and improve our information technology platforms. In addition, changing technologies including AI and other emerging technologies may become significant to operational results in the future. Although we plan to continue to invest in research and development, including through acquisitions, in order to enhance our technology and new and existing solutions. However, if we are unable to successfully anticipate, develop, implement and utilize such emerging technologies as effectively as competitors or our customers are able to use AI as a replacement to our services, our results of operations may be negatively affected. Additionally, while AI and other technologies may offer substantial benefits, they may also introduce additional risks and raise ethical, technological, legal, regulatory, and other issues that may negatively affect the demand for our solutions. Our systems and those of our external service providers could be exposed to damage or interruption from fire, natural disasters, which may increase in frequency and severity due to climate change, energy loss, telecommunication failure, security breach and computer viruses. An operational failure or outage in our information technology and communication systems or those of our external service providers, could result in loss of customers, damage to customer relationships, reduced revenue and profits, refunds of customer charges and damage to our reputation and may result in additional expense to repair or replace damaged equipment and recover data loss resulting from the interruption. Although we have taken steps to prevent system failures and have back-up systems and procedures to prevent or reduce disruptions, such steps may not prevent an interruption of services and our disaster recovery planning may not account for all contingencies. Additionally, our insurance may not adequately compensate us for all losses or failures that may occur. Any one of the above situations could have a material adverse effect on our business, financial condition, results of operations and reputation.

Due to the nature of the services we offer, we are subject to significant commercial, trade and privacy regulations. We cannot predict the nature, scope or effect of future regulatory requirements to which our operations might be subject or the manner in which existing laws might be administered or interpreted, which could have a material and negative impact on our business and our results of operation. For example, recent years have seen an increase in the development or enforcement of legislation related to healthcare reform, privacy, trade compliance and anti-corruption. Additionally, some of the services we provide include information our clients need to fulfill regulatory reporting requirements. If our services result in errors or omissions in our clients' regulatory reporting, we may be subject to loss of clients, reputational harm or litigation, each potentially adversely impacting our business. Furthermore, although we maintain a variety of internal policies and controls designed to educate, discourage, prevent and detect violations of such laws, we cannot guarantee that such actions will be effective or sufficient or that individual employees will not engage in inappropriate behavior in breach of our policies. Such conduct, or even an allegation of misbehavior, could result in material adverse reputational harm, costly investigations, severe criminal or civil sanctions, or could disrupt our business, and could negatively affect our results of operations or financial condition.

Global conflicts or any expansion of such conflicts, could adversely affect our business and operations. From time-to-time we outsource certain software development services to third parties outside of the United States, including in the Ukraine. Historically, our contractors located in areas of conflict (including in the Ukraine) have been able to continue their work. However, those services could be more negatively impacted in the future. Civil unrest, political instability or uncertainty, military activities (including the conflicts in the Ukraine and the Middle East, and as a result of any escalation of tensions between China and Taiwan), utility service breakdowns or broad-based sanctions, should they continue for the long term or escalate, could interrupt our contractors' ability to provide services and require our associates to perform the services or replace the contractors which could have an adverse effect on our operations and financial performance, including higher volatility in foreign currency exchange rates, increased use of less cost-efficient resources and negative impacts to our business resulting from deteriorating general economic conditions. Further, we cannot predict the impact of the military actions and any heightened military conflict or geopolitical instability that may follow, including additional sanctions or countersanctions, heightened inflation, cyber disruptions or attacks, higher energy costs, and supply chain disruptions. In addition, the new administration has stated its intention to impose new or increased tariff rates on imported goods from a number of countries, including China, Canada, Mexico, and the EU. Such trade policies and tariff implementations, and any related retaliatory trade policies and tariff implementations by foreign government may result in increased costs and worsening economic conditions and could have an adverse impact on our results of operations.