Select Medical (SEM) Risk Analysis

HIPAA required the United States Department of Health and Human Services to adopt standards to protect the privacy and security of individually identifiable health information. The department released final regulations containing privacy standards in December 2000 and published revisions to the final regulations in August 2002. The privacy regulations extensively regulate the use and disclosure of individually identifiable health information. The regulations also provide patients with significant new rights related to understanding and controlling how their health information is used or disclosed. The security regulations require healthcare providers to implement administrative, physical and technical practices to protect the security of individually identifiable health information that is maintained or transmitted electronically. HITECH, which was signed into law in February 2009, enhanced the privacy, security, and enforcement provisions of HIPAA by, among other things, establishing security breach notification requirements, allowing enforcement of HIPAA by state attorneys general, and increasing penalties for HIPAA violations. Violations of HIPAA or HITECH could result in civil or criminal penalties. For example, HITECH permits HHS to conduct audits of HIPAA compliance and impose penalties even if we did not know or reasonably could not have known about the violation and increases civil monetary penalty amounts up to $50,000 per violation with a maximum of $1.5 million in a calendar year for violations of the same requirement. In addition to HIPAA, there are numerous federal and state laws and regulations addressing patient and consumer privacy concerns, including unauthorized access, or theft of patient's identifiable health information. State statutes and regulations vary from state to state. Lawsuits, including class actions and action by state attorneys general, directed at companies that have experienced a privacy or security breach also can occur. In the conduct of our business, we process, maintain, and transmit sensitive data, including our patient's individually identifiable health information. We have developed a comprehensive set of policies and procedures in our efforts to comply with HIPAA and other privacy laws. Our compliance officer, privacy officer, and information security officer are responsible for implementing and monitoring compliance with our privacy and security policies and procedures at our facilities. We believe that the cost of our compliance with HIPAA and other federal and state privacy laws will not have a material adverse effect on our business, financial condition, results of operations, or cash flows. However, there can be no assurance that a breach of privacy or security will not occur. If there is a breach, we may be subject to various lawsuits, penalties and damages and may be required to incur costs to mitigate the impact of the breach on affected individuals.

The healthcare business is highly competitive, and we compete with other hospitals, rehabilitation clinics, occupational health centers, and other healthcare providers for patients. If we are unable to compete effectively in the critical illness recovery hospital, rehabilitation hospital, outpatient rehabilitation, and occupational health services businesses, our ability to retain customers and physicians, or maintain or increase our revenue growth, price flexibility, control over medical cost trends, and marketing expenses may be compromised and our revenue and profitability may decline. Many of our critical illness recovery hospitals and our rehabilitation hospitals operate in geographic areas where we compete with at least one other facility that provides similar services. Our outpatient rehabilitation clinics face competition from a variety of local and national outpatient rehabilitation providers, including physician-owned physical therapy clinics, dedicated locally owned and managed outpatient rehabilitation clinics, and hospital or university owned or affiliated ventures, as well as national and regional providers in select areas. Other competing outpatient rehabilitation clinics in local areas we serve may have greater name recognition and longer operating histories than our clinics. The managers of these competing clinics may also have stronger relationships with physicians in their communities, which could give them a competitive advantage for patient referrals. Because the barriers to entry are not substantial and current customers have the flexibility to move easily to new healthcare service providers, we believe that new outpatient physical therapy competitors can emerge relatively quickly. Concentra's primary competitors have typically been independent physicians, hospital emergency departments, and hospital-owned or hospital-affiliated medical facilities. Because the barriers to entry in Concentra's geographic markets are not substantial and its current customers have the flexibility to move easily to new healthcare service providers, new competitors to Concentra can emerge relatively quickly. The markets for Concentra's consumer health business are also fragmented and competitive. If Concentra's competitors are better able to attract patients or expand services at their facilities than Concentra is, Concentra may experience an overall decline in revenue.

Concentra has strong and longstanding relationships with major employer customers, payors, workers' compensation provider networks and third-party employer services networks. Concentra's results may decline if we lose several significant employer customers, payor relationships, or ability to participate in networks. One or more of Concentra's significant employer customers, payors, or networks could be acquired. As employer customers, payor partners and networks make strategic business decisions in response to market conditions, financial pressure, competitive pricing pressures or other reasons, they may choose to discontinue their relationship with us. The loss of several significant employer customers, payor or network relationships could cause a material decline in Concentra's profitability and operating performance.

Negative press coverage, including about the industries in which we currently operate, can result in increased governmental and regulatory scrutiny and possibly adverse regulatory changes. Adverse publicity and increased governmental scrutiny can have a negative impact on our reputation with referral sources and patients and on the morale and performance of our employees, both of which could adversely affect our businesses and results of operations.

Public health threats, such as the ongoing effects of COVID-19 or any other pandemic, may have an impact on our business and results of operations, financial position, and cash flows. Prolonged volatility or significant disruption of global financial markets due in part to a public health threat could have a negative impact on our business and overall financial position. Other factors and uncertainties include, but are not limited to, adverse impacts on patient volumes and revenue, increased operational costs associated with operating during and after a pandemic; evolving macroeconomic factors, including general economic uncertainty, increased labor costs, and recessionary pressures; capital and other resources needed to respond to a pandemic; along with the severity and duration of a pandemic. These risks and their impacts are difficult to predict and could continue to otherwise disrupt and adversely affect our operations and our financial performance. Our critical illness recovery hospitals and rehabilitation hospitals may continue to experience constrained staffing levels and increased operating costs resulting from increased usage of contract clinical labor due to the overwhelming need for healthcare professionals, particularly in areas that are heavily impacted by the COVID-19 pandemic. As a result of the COVID-19 pandemic and its aftermath, our hospitals have experienced and continue to experience more variable demand for its services as well as increases in costs relating to less efficient operating procedures, increased cost of supplies, and increased salaries, wages and benefits.

Rates of reimbursement for work-related injury or illness visits in Concentra's occupational health services business are established through a legislative or regulatory process within each state that Concentra serves. Currently, Concentra has operations in 36 states and the District of Columbia, which have fee schedules pursuant to which all healthcare providers are uniformly reimbursed. The fee schedules are determined by each state and generally prescribe the maximum amounts that may be reimbursed for a designated procedure. In the states without fee schedules, healthcare providers are generally reimbursed based on usual, customary and reasonable rates charged in the particular state in which the services are provided. Given that Concentra does not control these processes, it may be subject to financial risks if individual jurisdictions reduce rates or do not routinely raise rates of reimbursement in a manner that keeps pace with the inflation of Concentra's costs of service. Additionally, in Concentra's employer services business, while we can directly set the price for these services, the market rates for this portion of Concentra's business are substantially lower than the fees we receive for workers' compensation services. The average rate of reimbursement per visit could increase at rates lower than the rate of inflation in our costs and could cause us to have decreases in the rate of profitability we receive for services that are provided. In addition to the risks we face in Concentra's occupational health services business, we also face competitive and market pressures in Concentra's onsite health clinics that may constrain our ability to raise our pricing for services in a manner that is commensurate with the increases in our costs.

In the normal course of business, our information technology systems hold sensitive patient information including patient demographic data, eligibility for various medical plans including Medicare and Medicaid, and protected health information, which is subject to HIPAA and HITECH. Additionally, we utilize those same systems to perform our day-to-day activities, such as receiving referrals, assigning medical teams to patients, documenting medical information, maintaining an accurate record of all transactions, processing payments, and maintaining our employee's personal information. We also contract with third-party vendors to maintain and store our patient's individually identifiable health information. Numerous state and federal laws and regulations address privacy and information security concerns resulting from our access to our patients' and employees' personal information. Our information technology systems and those of our vendors that process, maintain, and transmit such data are subject to computer viruses, cyber attacks, or breaches. We adhere to policies and procedures reasonably designed to promote compliance with HIPAA and other applicable privacy and information security laws. Employees are required to complete annual training regarding these laws. Additionally, we perform security risk assessments of third-party vendors and continuously monitor compliance with HIPAA and other applicable privacy laws. Failure to maintain the security and functionality of our information systems and related software, or to defend a cybersecurity attack or other attempt to gain unauthorized access to our or third-party's systems, facilities, or patient health information could expose us to a number of adverse consequences, including but not limited to disruptions in our operations, regulatory and other civil and criminal penalties, reputational harm, investigations and enforcement actions (including, but not limited to, those arising from the SEC, Federal Trade Commission, the OIG or state attorneys general), fines, litigation with those affected by the data breach, loss of customers, disputes with payors, and increased operating expense, which either individually or in the aggregate could have a material adverse effect on our business, financial position, results of operations, and liquidity. Although we maintain cyber liability insurance to protect us from losses related to cyber attacks and breaches, not every risk or liability can be insured, and for risks that are insurable, our policy limits and terms of coverage may not be sufficient to cover all actual losses or liabilities incurred. Furthermore, while our information technology systems are maintained with safeguards protecting against cyber attacks, including intrusion protection, firewalls, and malware detection, these safeguards do not ensure that a significant cyber attack could not occur. A cyber attack that bypasses our information technology security systems, or those of our third-party vendors, could cause the loss of protected health information, or other data subject to privacy laws, the loss of proprietary business information, or a material disruption to our or a third-party vendor's information technology business systems resulting in a material adverse effect on our business, financial condition, results of operations, or cash flows. In addition, our future results could be adversely affected due to the theft, destruction, loss, misappropriation, or release of protected health information, other confidential data or proprietary business information, operational or business delays resulting from the disruption of information technology systems and subsequent clean-up and mitigation activities, negative publicity resulting in reputation or brand damage with clients, members, or industry peers, or regulatory action taken as a result of such incident. We provide our employees with training at least annually on important measures they can take to prevent breaches and other cyber threats. We routinely identify attempts to gain unauthorized access to our systems. However, given the rapidly evolving nature and proliferation of cyber threats, there can be no assurance our training and security measures or other controls will detect, prevent, or remediate security or data breaches in a timely manner or otherwise prevent unauthorized access to, damage to, or interruption of our systems and operations. For example, it has been widely reported that many well-organized international interests, in certain cases with the backing of sovereign governments, are targeting the theft of patient information through the use of advance persistent threats. Similarly, in recent years, several hospitals have reported being the victim of ransomware attacks in which they lost access to their systems, including clinical systems, during the course of the attacks. While we are not aware of having experienced a material cyber breach or attack to date, we are likely to face attempted attacks in the future. Accordingly, we may be vulnerable to losses associated with the improper functioning, security breach, or unavailability of our information systems as well as any systems used in acquired operations. Our acquisitions require transitions and integration of various information technology systems, and we regularly upgrade and expand our information technology systems' capabilities. If we experience difficulties with the transition and integration of these systems or are unable to implement, maintain, or expand our systems properly, we could suffer from, among other things, operational disruptions, regulatory problems, working capital disruptions, and increases in administrative expenses. While we make significant efforts to address any information security issues and vulnerabilities with respect to the companies we acquire, we may still inherit risks of security breaches or other compromises when we integrate these companies within our business.