US Physical Therapy (USPH) Risk Factors

Payments we receive from Medicare and Medicaid can be retroactively adjusted after examination during the claims settlement process or as a result of post-payment audits. Payors may disallow our requests for reimbursement, or recoup amounts previously reimbursed, based on determinations by the payors or their third-party audit contractors that certain costs are not reimbursable because either adequate or additional documentation was not provided or because certain services were not covered or deemed to not be medically necessary. Significant adjustments, recoupments or repayments of our Medicare or Medicaid revenue, and the costs associated with complying with investigative audits by regulatory and governmental authorities, could adversely affect our financial condition and results of operations. Additionally, from time to time we become aware, either based on information provided by third parties and/or the results of internal audits, of payments from payor sources that were either wholly or partially in excess of the amount that we should have been paid for the service provided. Overpayments may result from a variety of factors, including insufficient documentation supporting the services rendered or medical necessity of the services or other failures to document the satisfaction of the necessary conditions of payment. We are required by law in most instances to refund the full amount of the overpayment after becoming aware of it, and failure to do so within requisite time limits imposed by the law could lead to significant fines and penalties being imposed on us. Furthermore, our initial billing of and payments for services that are unsupported by the requisite documentation and satisfaction of any other conditions of payment, regardless of our awareness of the failure at the time of the billing or payment, could expose us to significant fines and penalties. We, and/or certain of our operating companies, could also be subject to exclusion from participation in the Medicare or Medicaid programs in some circumstances as well, in addition to any monetary or other fines, penalties or sanctions that we may incur under applicable federal and/or state law. Our repayment of any such amounts, as well as any fines, penalties or other sanctions that we may incur, could be significant and could have a material and adverse effect on our results of operations and financial condition. From time to time, we are also involved in various external governmental investigations, audits and reviews. Reviews, audits and investigations of this sort can lead to government actions, which can result in the assessment of damages, civil or criminal fines or penalties, or other sanctions, including restrictions or changes in the way we conduct business, loss of licensure or exclusion from participation in government programs. Failure to comply with applicable laws, regulations and rules could have a material and adverse effect on our results of operations and financial condition. Furthermore, becoming subject to these governmental investigations, audits and reviews can also require us to incur significant legal and document production expenses as we cooperate with the government authorities, regardless of whether the particular investigation, audit or review leads to the identification of underlying issues.

HIPAA required the HHS to adopt standards to protect the privacy and security of individually identifiable health-related information. The department released final regulations containing privacy standards in 2000 and published revisions to the final regulations in 2002. The privacy regulations extensively regulate the use and disclosure of individually identifiable health-related information. The regulations also provide patients with significant rights related to understanding and controlling how their health information is used or disclosed. The security regulations require healthcare providers to implement administrative, physical and technical practices to protect the security of individually identifiable health information that is maintained or transmitted electronically. HITECH, which was signed into law in 2009, enhanced the privacy, security and enforcement provisions of HIPAA by, among other things establishing security breach notification requirements, allowing enforcement of HIPAA by state attorneys general, and increasing penalties for HIPAA violations. Violations of HIPAA or HITECH could result in civil or criminal penalties. In addition to HIPAA, there are numerous federal and state laws and regulations addressing patient and consumer privacy concerns, including unauthorized access or theft of personal information. State statutes and regulations vary from state to state. Lawsuits, including class actions and action by state attorneys general, directed at companies that have experienced a privacy or security breach also can occur. We have established policies and procedures in an effort to ensure compliance with these privacy related requirements. However, if there is a breach, we may be subject to various penalties and damages and may be required to incur costs to mitigate the impact of the breach on affected individuals.

The competitive, economic or reimbursement conditions in our markets in which we operate may require us to reorganize or to close certain clinics. In the event a clinic is reorganized or closed, we may incur losses and closure costs. The closure costs and losses may include, but are not limited to, lease obligations, severance, and write-down or write-off of goodwill and other intangible assets.

An economic downturn, including the consequences of a pandemic, such as COVID-19, could have a detrimental effect on our revenues. Historically, state budget pressures have translated into reductions in state spending. Given that Medicaid outlays are a significant component of state budgets, we can expect continuing cost containment pressures on Medicaid outlays for our services in the states in which we operate. In addition, an economic downturn, coupled with sustained unemployment, may also impact the number of enrollees in managed care programs as well as the profitability of managed care companies, which could result in reduced reimbursement rates. The existing federal deficit, as well as deficit spending by federal and state governments as the result of adverse developments in the economy or other reasons, can lead to continuing pressure to reduce governmental expenditures for other purposes, including government-funded programs in which we participate, such as Medicare and Medicaid. Such actions in turn may adversely affect our results of operations.

We encounter competition from local, regional or national entities, some of which have superior resources or other competitive advantages. Intense competition may adversely affect our business, financial condition or results of operations. For a more complete description of this competitive environment, see "Business-Competition" in Item 1. An adverse effect on our business, financial condition or results of operations may require us to write down goodwill.

Substantially all of our revenues are derived from private and governmental third-party payors. In 2023, approximately 63.4% of our revenues were derived collectively from managed care plans, commercial health insurers, workers' compensation payors, and other private pay revenue sources while approximately 36.6% of our revenues were derived from Medicare and Medicaid. Initiatives undertaken by industry and government to contain healthcare costs affect the profitability of our clinics. These payors attempt to control healthcare costs by contracting with healthcare providers to obtain services on a discounted basis. We believe that this trend will continue and may limit reimbursement for healthcare services. If insurers or managed care companies from whom we receive substantial payments were to reduce the amounts they pay for services, our profit margins may decline, or we may lose patients if we choose not to renew our contracts with these insurers at lower rates. In addition, in certain geographical areas, our clinics must be approved as providers by key health maintenance organizations and preferred provider plans. Failure to obtain or maintain these approvals would adversely affect our financial results. In recent years, through legislative and regulatory actions, the federal government has made substantial changes to various payment systems under the Medicare program. See "Business-Sources of Revenue – Physical Therapy Services" in Item 1 for more information including changes to Medicare reimbursement. Additional reforms or other changes to these payment systems may be proposed or adopted, either by the U.S. Congress or by CMS, including bundled payments, outcomes-based payment methodologies and a shift away from traditional fee-for-service reimbursement. If revised regulations are adopted, the availability, methods and rates of Medicare reimbursements for services of the type furnished at our facilities could change. Some of these changes and proposed changes could adversely affect our business strategy, operations and financial results.

In the normal course of business, our information technology systems hold sensitive patient information including patient demographic data and other protected health information, which is subject to HIPAA and HITECH. We also contract with third-party vendors to maintain and store our patients' individually identifiable health information. Numerous state and federal laws and regulations address privacy and information security concerns resulting from our access to our patient's and employee's personal information. Our information technology systems and those of our vendors that process, maintain, and transmit such data are subject to computer viruses, cyber-attacks, or breaches. We adhere to policies and procedures designed to ensure compliance with HIPAA and other privacy and information security laws and require our third-party vendors to do so as well. If, however, we or our third-party vendors experience a breach, loss, or other compromise of unsecured protected health information or other personal information, such an event could result in significant civil and criminal penalties, lawsuits, reputational harm, and increased costs to us, any of which could have a material adverse effect on our financial condition and results of operations. Furthermore, while our information technology systems, and those of our third-party vendors, are maintained with safeguards protecting against cyber-attacks. A cyber-attack that bypasses our information technology security systems, or those of our third-party vendors, could result in a material adverse effect on our business, financial condition, results of operations, or cash flows. In addition, our future results could be adversely affected due to the theft, destruction, loss, misappropriation, or release of protected health information, other confidential data or proprietary business information, operational or business delays resulting from the disruption of information technology systems and subsequent mitigation activities, or regulatory action taken as a result of such incident. We provide our employees with training and regular reminders on important measures they can take to prevent breaches. We routinely identify attempts to gain unauthorized access to our systems. However, given the rapidly evolving nature and proliferation of cyber threats, there can be no assurance our training and network security measures or other controls will detect, prevent, or remediate security or data breaches in a timely manner or otherwise prevent unauthorized access to, damage to, or interruption of our systems and operations. Accordingly, we may be vulnerable to losses associated with the improper functioning, security breach, or unavailability of our information systems as well as any systems used in acquired operations.