CORVEL CORP (CRVL) Risk Factors

Item 1A. Risk Factors.

Past financial performance is not necessarily a reliable indicator of future performance, and investors in our common stock should not use historical performance to anticipate results or future period trends. Investing in our common stock involves a high degree of risk. Investors should consider carefully the following risk factors, as well as the other information in this Annual Report and our other filings with the SEC, including our consolidated financial statements and the related notes, before deciding whether to invest or maintain an investment in shares of our common stock. If any of the following risks actually occurs, our business, financial condition, and results of operations would suffer. In this case, the trading price of our common stock would likely decline. The risks described below are not the only ones we face. Additional risks that we currently do not know about or that we currently believe to be immaterial may also impair our business operations.

Risks Related to Our Business and Industry

Our sequential revenue may not increase and may decline. As a result, we may fail to meet or exceed the expectations of investors or analysts which could cause our common stock price to decline.

Our sequential revenue growth may not increase and may decline in the future as a result of a variety of factors, many of which are outside of our control. If changes in our sequential revenue fall below the expectations of investors or analysts, the price of our common stock could decline substantially. Fluctuations or declines in sequential revenue growth may be due to a number of factors, including, but not limited to, those listed below and identified throughout this “Risk Factors” section: the decline in manufacturing employment, the decline in workers’ compensation claims, the decline in healthcare expenditures, the considerable price competition in a flat-to-declining workers’ compensation market, litigation, the increase in competition, and the changes and the potential changes in state workers’ compensation and automobile-managed care laws which can reduce demand for our services. These factors create an environment where revenue and margin growth is more difficult to attain and where revenue growth is less certain than historically experienced. Additionally, our technology and preferred provider network face competition from companies that have more resources available to them than we do. Also, some customers may handle their managed care services in-house and may reduce the amount of services which are outsourced to managed care companies such as us. These factors could cause the market price of our common stock to fluctuate substantially. There can be no assurance that our growth rate in the future, if any, will be at or near historical levels.

If we fail to grow our business internally or through strategic acquisitions we may be unable to execute our business plan, maintain high levels of service, or adequately address competitive challenges.

Our strategy is to continue internal growth and, as strategic opportunities arise in the workers’ compensation managed care industry, to consider acquisitions of, or relationships with, other companies in related lines of business. As a result, we are subject to certain growth-related risks, including the risk that we will be unable to retain personnel or acquire other resources necessary to service such growth adequately. Expenses arising from our efforts to increase our market penetration may have a negative impact on operating results. In addition, there can be no assurance that any suitable opportunities for strategic acquisitions or relationships will arise or, if they do arise, that the transactions contemplated could be completed. If such a transaction does occur, there can be no assurance that we will be able to integrate effectively any acquired business. In addition, any such transaction would be subject to various risks associated with the acquisition of businesses, including, but not limited to, the following:

•
an acquisition may (i) negatively impact our results of operations because it may require incurring large one-time charges, substantial debt or liabilities; (ii) require the amortization or write down of amounts related to deferred compensation, goodwill and other intangible assets; or (iii) cause adverse tax consequences, substantial depreciation or deferred compensation charges;

•
we may encounter difficulties in assimilating and integrating the business, technologies, products, services, personnel, or operations of companies that are acquired, particularly if key personnel of the acquired company decide not to work for us;

•
an acquisition may disrupt ongoing business, divert resources, increase expenses, and distract management;

•
the acquired businesses, products, services, or technologies may not generate sufficient revenue to offset acquisition costs;

•
we may have to issue equity or debt securities to complete an acquisition, which would dilute the position of stockholders and could adversely affect the market price of our common stock; and

•
the acquisitions may involve the entry into a geographic or business market in which we have little or no prior experience.

There can be no assurance that we will be able to identify or consummate any future acquisitions or other strategic relationships on favorable terms, or at all, or that any future acquisition or other strategic relationship will not have an adverse impact on our business or results of operations. If suitable opportunities arise, we may finance such transactions, as well as internal growth, through debt or

12

equity financing. There can be no assurance, however, that such debt or equity financing would be available to us on acceptable terms when, and if, suitable strategic opportunities arise.

If we are unable to increase our market share among national and regional insurance carriers and large, self-funded employers, our results may be adversely affected.

Our business strategy and future success depend in part on our ability to capture market share with our cost containment services as national and regional insurance carriers and large, self-funded employers look for ways to achieve cost savings. There can be no assurance that we will successfully market our services to these insurance carriers and employers or that they will not resort to other means to achieve cost savings. Additionally, our ability to capture additional market share may be adversely affected by the decision of potential customers to perform services internally instead of outsourcing the provision of such services to us. Furthermore, we may not be able to demonstrate sufficient cost savings to potential or current customers to induce them not to provide comparable services internally or to accelerate efforts to provide such services internally.

If competition increases, our growth and profits may decline.

The markets for our network services and patient management services are fragmented and competitive. Our competitors include national managed care providers, preferred provider networks, smaller independent providers, and insurance companies. Companies that offer one or more workers’ compensation managed care services on a national basis are our primary competitors. We also compete with many smaller vendors who generally provide unbundled services on a local level, particularly companies with an established relationship with a local insurance company adjuster. In addition, several large workers’ compensation insurance carriers offer managed care services for their customers, either by performance of the services in-house or by outsourcing to organizations like ours. If these carriers increase their performance of these services in-house, our business may be adversely affected. In addition, consolidation in the industry may result in carriers performing more of such services in-house.

If the referrals for our patient management services decline, our business, financial condition and results of operations would be materially adversely affected.

In some years, we have experienced a general decline in the revenue and operating performance of patient management services. We believe that the performance decline has been due to the following factors: the decrease of the number of workplace injuries that have become longer-term disability cases; increased regional and local competition from providers of managed care services; a possible reduction by insurers on the types of services provided by our patient management business; the closure of offices and continuing consolidation of our patient management operations; and employee turnover, including management personnel, in our patient management business. In the past, these factors have all contributed to the lowering of our long-term outlook for our patient management services. If some or all of these conditions continue, we believe that revenues from our patient management services could decrease.

Declines in workers’ compensation claims may materially harm our results of operations.

Historically, because the labor market has become less labor intensive and more service oriented, there are declining work-related injuries. Additionally, employers are being more proactive to prevent injuries. If declines in workers’ compensation costs occur in many states and persist over the long-term, it would have a material adverse impact on our business, financial condition and results of operations.

We provide an outsource service to payors of workers’ compensation benefits, automobile insurance claims, and group health insurance benefits. These payors include insurance companies, TPAs, municipalities, state funds, and self-insured, self-administered employers. If these payors reduce the amount of work they outsource, our results of operations would be materially adversely affected.

13

Healthcare providers are becoming increasingly resistant to the application of certain healthcare cost containment techniques; this may cause revenue from our cost containment operations to decrease.

Healthcare providers have become more active in their efforts to minimize the use of certain cost containment techniques and are engaging in litigation to avoid application of certain cost containment practices. Recent litigation between healthcare providers and insurers has challenged certain insurers’ claims adjudication and reimbursement decisions. These cases may affect the use by insurers of certain cost containment services that we provide and may result in a decrease in revenue from our cost containment business.

Our failure to compete successfully could make it difficult for us to add and retain customers and could reduce or impede the growth of our business.

We face competition from PPOs, TPAs, and other managed healthcare companies. We believe that as managed care techniques continue to gain acceptance in the workers’ compensation marketplace, our competitors will increasingly consist of nationally-focused workers’ compensation managed care service companies, insurance companies, HMOs and other significant providers of managed care products. Legislative reform in some states has been considered, but not enacted, to permit employers to designate health plans such as HMOs and PPOs to cover workers’ compensation claimants. Because many health plans have the ability to manage medical costs for workers’ compensation claimants, such legislation may intensify competition in the markets served by us. Many of our current and potential competitors are significantly larger and have greater financial and marketing resources than we do, and there can be no assurance that we will continue to maintain our existing customers, maintain our past level of operating performance, or be successful with any new products or in any new geographical markets we may enter.

If the utilization by healthcare payors of early intervention services continues to increase, the revenue from our later-stage network and healthcare management services could be negatively affected.

The performance of early intervention services, including injury occupational healthcare, first notice of loss, and telephonic case management services, often result in a decrease in the average length of, and the total costs associated with, a healthcare claim. By successfully intervening at an early stage in a claim, the need for additional cost containment services for that claim often can be reduced or even eliminated. As healthcare payors continue to increase their utilization of early intervention services, the revenue from our later stage network and healthcare management services will decrease.

We face competition for staffing, which may increase our labor costs and reduce profitability.

We compete with other healthcare providers in recruiting qualified management and staff personnel for the day-to-day operations of our business, including nurses and other case management professionals. In some markets, the scarcity of nurses and other medical support personnel has become a significant operating issue to healthcare providers. This shortage may require us to enhance wages to recruit and retain qualified nurses and other healthcare professionals. Our failure to recruit and retain qualified management, nurses, and other healthcare professionals, or to control labor costs could have a material adverse effect on profitability.

We are subject to inflation risks which could increase our wages, benefits, and other costs which may result in decreased profitability.

We are impacted by inflationary increases in wages, benefits and other costs. Wage and benefit inflation, whether driven by competition for talent or ordinary course pay increases and other inflationary pressure, may increase our cost of providing services and reduce our profitability. If we are not able to pass increased wage and other costs resulting from inflation onto our clients or charge premium prices when justified by market demand, our profitability could decline.

Sustained increases in the cost of our employee benefits could materially reduce our profitability.

The cost of our current employees’ medical and other benefits substantially affects our profitability. In the past, we have occasionally experienced significant increases in these costs as a result of macro-economic factors beyond our control, including increases in healthcare costs. There can be no assurance that we will succeed in limiting future cost increases, and continued upward pressure in these costs could materially reduce our profitability.

The introduction of software products incorporating new technologies and the emergence of new industry standards could render our existing software products less competitive, obsolete, or unmarketable.

There can be no assurance that we will be successful in developing and marketing new software products that respond to technological changes or evolving industry standards. If we are unable, for technological or other reasons, to develop and introduce new software products cost-effectively, in a timely manner and in response to changing market conditions or customer requirements, our business, results of operations, and financial condition may be adversely affected.

14

Developing or implementing new or updated software products and services may take longer and cost more than expected. We rely on a combination of internal development, strategic relationships, licensing and acquisitions to develop our software products and services. The cost of developing new healthcare information services and technology solutions is inherently difficult to estimate. Our development and implementation of proposed software products and services may take longer than originally expected, require more testing than originally anticipated and require the acquisition of additional personnel and other resources. If we are unable to develop new or updated software products and services cost-effectively on a timely basis and implement them without significant disruptions to the existing systems and processes of our customers, we may lose potential sales and harm our relationships with current or potential customers.

We may not be able to develop or acquire necessary IT resources to support and grow our business, and disruptive technologies could impact the volume and pricing of our products, which could materially adversely affect our business, results of operations, and financial condition.

We have made substantial investments in software and related technologies that are critical to the core operations of our business. These IT resources will require future maintenance and enhancements, potentially at substantial costs. Additionally, these IT resources may become obsolete in the future and require replacement, potentially at substantial costs. We may not be able to develop, acquire replacement resources or identify new technology resources necessary to support and grow our business.

In addition, we could face changes in our markets due to disruptive technologies that could impact the volume and pricing of our products, or introduce changes to the claims management processes which could negatively impact our volume of case referrals. Our failure to address these risks, or to do so in a timely manner, or at a cost considered reasonable by us, could materially adversely affect our business, results of operations, and financial condition.

If we are unable to apply technology and data analytics effectively in driving value for our clients through technology-based solutions or gain internal efficiencies and maintain effective financial internal controls through the application of technology and related tools, our operating results, client relationships, growth and compliance programs could be adversely affected.

Our future success depends, in part, on our ability to anticipate and respond effectively to the risk of, and conversely, the opportunity presented by digital disruption, “big data” and data analytics, and other developments in technology. These may include new applications or insurance-related services based on artificial intelligence, machine learning, robotics, blockchain, the metaverse or new approaches to data mining that impact the nature of how we generate revenue. We may be exposed to competitive risks related to the adoption and application of new technologies by established market participants or new entrants such as technology companies, start-up companies and others. These new entrants are focused on using technology and innovation, including artificial intelligence and blockchain, in an attempt to simplify and improve the client experience, increase efficiencies, alter business models and effect other potentially disruptive changes in the industries in which we operate. We must also develop and implement technology solutions and technical expertise among our employees that anticipate and keep pace with rapid and continuing changes in technology, industry standards, client preferences and internal control standards. We may not be successful in anticipating or responding to these developments on a timely and cost-effective basis and our ideas may not be accepted in the marketplace. Data produced by or contained in technology that uses artificial intelligence may contain a degree of inaccuracy and error. Additionally, the effort to gain technological expertise, make use of data analytics, and develop new technologies in our business requires us to incur significant expenses. Investments in technology systems and data analytics capabilities may not deliver the benefits or perform as expected, or may be replaced or become obsolete more quickly than expected, which could result in operational difficulties or additional costs. If we or our third-party vendors fail to effectively implement these new technologies, including, artificial intelligence, we could be subject to additional risks that we do not understand or cannot adequately mitigate, which could have a material adverse effect on our results of operations and financial condition. Further, if we cannot offer new technologies or data analytics solutions as quickly as our competitors, or if our competitors develop more cost-effective technologies, data analytics solutions or other product offerings, we could experience a material adverse effect on our operating results, client relationships, growth and compliance programs.

In some cases, we depend on key third-party vendors and partners to provide technology and other support for our strategic initiatives. If these third parties fail to perform their obligations or cease to work with us, our ability to execute on our strategic initiatives could be adversely affected.

The failure to attract and retain qualified or key personnel may prevent us from effectively developing, marketing, selling, integrating, and supporting our services.

We are dependent, to a substantial extent, upon the continuing efforts and abilities of certain key management personnel. In addition, we face competition for experienced employees with professional expertise in the workers’ compensation managed care area. The loss of key personnel, especially Michael Combs, our Chairman, Chief Executive Officer and President, or the inability to attract qualified employees, could have a material adverse effect on our business, financial condition, and results of operations.

15

If we lose several recurring customers in a short period, our results may be materially adversely affected.

Our results may decline if we lose several recurring customers during a short period. Most of our customer contracts permit either party to terminate without cause. If several customers terminate, or do not renew or extend their contracts with us, our results could be materially and adversely affected. Many organizations in the insurance industry have consolidated and this could result in the loss of one or more of our customers through a merger or acquisition. Additionally, we could lose customers due to competitive pricing pressures or other reasons.

We are subject to risks associated with acquisitions of intangible assets.

Our acquisition of other businesses may result in significant increases in our intangible assets and goodwill. We regularly evaluate whether events and circumstances have occurred indicating that any portion of our intangible assets and goodwill may not be recoverable. When factors indicate that intangible assets and goodwill should be evaluated for possible impairment, we may be required to reduce the carrying value of these assets. We cannot currently estimate the timing and amount of any such charges.

Natural and other disasters may adversely affect our business.

We may be vulnerable to damage from severe weather conditions or natural disasters, including hurricanes, fires, floods, earthquakes, power loss, communications failures, and similar events, including the effects of pandemics, war or acts of terrorism. If a disaster were to occur, our ability to operate our business could be seriously or completely impaired or destroyed. The insurance we maintain may not be adequate to cover our losses resulting from disasters or other business interruptions. If there is a resurgence in global pandemics, or if any other pandemic arises, it could materially adversely impact our business operations, financial position and results of operations in unpredictable ways that depend on highly-uncertain future developments, such as determining the effectiveness of current or future government actions to address the public health or economic impacts of the pandemic. Any of these risks might have a materially adverse effect on our business operations and our financial position or results of operations.

Risks Related to Cybersecurity and Our Information Systems

A cybersecurity attack or other disruption to our information technology systems could result in the loss, theft, misuse, unauthorized disclosure, or unauthorized access of customer or sensitive company information or could disrupt our operations, which could damage our relationships with customers or employees, expose us to litigation or regulatory proceedings, or harm our reputation, any of which could materially adversely affect our business, financial condition or results of operations.

We rely on information technology to support our business activities. Our business involves the storage and transmission of a significant amount of personal, confidential, or sensitive information, including the personal information of our customers and employees, and our financial, operational and strategic information. As with many businesses, we are subject to numerous data privacy and security risks. These risks may prevent us from maintaining the confidentiality and integrity of this information, result in the disruption of our business and online systems, and require us to expend significant resources to attempt to secure and protect such information and respond to incidents, any of which could materially adversely affect our business, financial condition or results of operations. The loss, theft, misuse, unauthorized disclosure, or unauthorized access of such sensitive information could lead to significant reputational or competitive harm, result in litigation or regulatory proceedings, or cause us to incur substantial liabilities, fines, penalties or expenses.

Cybersecurity incidents affecting the systems on which we rely may result from circumvention of security measures, denial-of-service attacks or other cyber-attacks, hacking, “phishing” attacks, computer viruses, ransomware, malware, employee or insider error, malfeasance, social engineering, physical breaches or other actions. According to media reports, the frequency, intensity, and sophistication of cyber-attacks, ransomware attacks, and other data security incidents has significantly increased worldwide in recent years, including as a result of the increasing sophistication in the development and use of artificial intelligence tools. As with many other businesses, we have experienced, and are continually at risk of being subject to, attacks that result in cybersecurity incidents caused by computer viruses, unauthorized parties gaining access to our information technology systems, and other similar threats. In some cases, cybersecurity incidents could cause reputational harm, loss of customers, loss and/or delay of revenue, loss of proprietary data, loss of licenses, regulatory actions and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard customers’ information, financial losses, or a drop in our stock price. If we acquire any businesses, the process of integrating the information systems of the businesses we acquire is complex and exposes us to additional risks as we might not adequately identify weaknesses in the acquired company’s information systems, which could expose us to unexpected liabilities or make our own systems more vulnerable to attack. We have invested in and continue to expend significant resources on information technology and information security tools, measures, processes, initiatives, policies and employee training designed to protect our information technology systems, as well as the personal, confidential or sensitive information stored on or transmitted through those systems, and to ensure an effective response to any cyber-attack or security incident, however, such measures cannot provide absolute security and may fail to operate as intended or be circumvented. These expenditures could also have an adverse impact on our financial condition and results of operations, and divert

16

management’s attention from pursuing our strategic objectives. In addition, the cost and operational consequences of implementing, maintaining and further enhancing our system’s protective measures could increase significantly as cybersecurity threats increase. There can be no assurance that the security measures we employ will effectively prevent cybersecurity incidents or otherwise prevent malicious actors from obtaining access to our systems and information.

As these threats evolve, cybersecurity incidents could be more difficult to detect, prevent, and remediate. Cybersecurity-attacks or data handling incidents could remain undetected for some period of time, which could not only result in significant harm to our systems, but also lead to unauthorized access to the information stored on and transmitted by our systems. Further, despite our security efforts and training, our employees may purposefully or inadvertently cause cybersecurity incidents. Any occurrence of cybersecurity incidents, whether caused by employees or third parties, could have the potential to adversely impact our relationships with our customers or restrict our ability to meet our customers’ expectations.

Additionally, as artificial intelligence technologies continue to develop and become more accessible, malicious actors are increasingly leveraging such technologies to carry out advanced cyber-attacks. These artificial intelligence tools can be used to automate and scale attacks, generate phishing or social engineering schemes, employ deepfakes, identity system vulnerabilities, or evade transitional detection methods. Consequently, the use of artificial intelligence by malicious actors may result in an increase in the frequency, speed, and severity of cybersecurity threats targeting our systems, networks, and employees.

If a cyber-attack or other data incident results in the loss, theft, misuse, unauthorized disclosure, or unauthorized access of personal, confidential, or sensitive information belonging to our customers or employees, it could put us at a competitive disadvantage, result in the deterioration of our customers’ confidence in our services, cause our customers to reconsider their relationship with us, impose more onerous contractual provisions, cause us to lose our regulatory licenses, or subject us to potential litigation, liability, fines and penalties. For example, we could become subject to regulatory or other actions pursuant to privacy laws. This could result in costly investigations and litigation, civil or criminal penalties, operational changes, and negative publicity that could adversely affect our reputation, as well as our results of operations and financial condition.

A cyber-attack or other data security incident could result in the significant and protracted disruption of our business such that:

•
critical business systems become inoperable or require a significant amount of time or cost to restore;

•
key personnel are unable to perform their duties or communicate with employees, customers or other third-parties;

•
it results in the loss, theft, misuse, unauthorized disclosure, or unauthorized access of customer or Company information;

•
we are prevented from accessing information necessary to conduct our business;

•
we are required to make unanticipated investments in equipment, technology or security measures;

•
our customers lose the ability to access our websites and online systems; or

•
we become subject to other unanticipated liabilities, costs, or claims.

Any of the foregoing could have a material adverse effect on our business, financial condition and results of operations, and result in harm to our reputation. While we maintain insurance coverage that may, subject to policy terms and conditions, cover certain aspects of the losses and costs associated with cyber-attacks and data incidents, such insurance coverage may be insufficient to cover all losses and would not, in any event, remedy damage to our reputation. In addition, we may face difficulties in recovering any losses from our provider and any losses we recover may be lower than we initially expect.

A breach of security may cause our customers to curtail or stop using our services.

We rely on industry standard security systems, confidentiality procedures, and employee nondisclosure agreements to maintain the privacy and security of our and our customers’ proprietary information. Intentional or unintentional incidents, like unauthorized access by third parties to our information systems, the infection of our systems or software with malware, and misappropriation of our proprietary information could expose us to a risk of information loss, litigation, and other possible liabilities which may have a material adverse effect on our business, financial condition, and results of operations. If cybersecurity incidents occur because of third-party actions, employee errors, malfeasance, or otherwise, or if design flaws in our software are exposed and exploited, and, as a result, a third party obtains unauthorized access to any customer data, our relationships with our customers and our reputation could be significantly damaged, our business may suffer, and we could incur significant liability. Cybersecurity threats are rapidly evolving and those threats and the means for obtaining access to our systems are becoming increasingly sophisticated. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures. The rapid evolution and growing adoption of

17

artificial intelligence technologies may heighten our cybersecurity risks, including through the use of artificial intelligence by malicious actors seeking to identify and exploit vulnerabilities.

An interruption in our ability to access critical data may cause customers to cancel their service and/or may reduce our ability to effectively compete.

Certain aspects of our business are dependent upon our ability to store, retrieve, process, and manage data and to maintain and upgrade our data processing capabilities. An interruption of data processing capabilities for any extended length of time, loss of stored data, programming errors or other system failures could impair our ability to perform for our customers on a timely basis and cause customers to cancel their service and could have a material adverse effect on our business, financial condition, and results of operations.

In addition, we expect that a considerable amount of our future growth will depend on our ability to process and manage claims data more efficiently and to provide more meaningful healthcare information to customers and payors of healthcare. There can be no assurance that our current data processing capabilities will be adequate for our future growth, that we will be able to efficiently upgrade our systems to meet future demands, or that we will be able to develop, license or otherwise acquire software to address these market demands as well or as timely as our competitors.

If we are unable to leverage our information systems to enhance our outcome-driven service model, our results may be adversely affected.

To leverage our knowledge of workplace injuries, treatment protocols, outcomes data, and complex regulatory provisions related to the workers’ compensation market, we must continue to implement and enhance information systems that can analyze our data related to the workers’ compensation industry. We frequently upgrade existing operating systems and are updating other information systems that we rely upon in providing our services and financial reporting. We have detailed implementation schedules for these projects that require extensive involvement from our operational, technological, and financial personnel. Delays or other problems we might encounter in implementing these projects could adversely affect our ability to deliver streamlined patient care and outcome reporting to our customers.

Risks Related to Potential Litigation

Exposure to possible litigation and legal liability may adversely affect our business, financial condition, and results of operations.

We, through our utilization management services, make recommendations concerning the appropriateness of providers’ medical treatment plans for patients throughout the country, and as a result, could be exposed to claims for adverse medical consequences. We do not grant or deny claims for payment of benefits and we do not believe that we engage in the practice of medicine or the delivery of medical services. There can be no assurance, however, that we will not be subject to claims or litigation related to the authorization or denial of claims for payment of benefits or allegations that we engage in the practice of medicine or the delivery of medical services.

In addition, there can be no assurance that we will not be subject to other litigation that may adversely affect our business, financial condition or results of operations, including but not limited to being joined in litigation brought against our customers in the managed care industry. We maintain professional liability insurance and such other coverages as we believe are reasonable in light of our experience to date. If such insurance is insufficient or unavailable in the future at reasonable cost to protect us from liability, our business, financial condition, or results of operations could be adversely affected.

If lawsuits against us are successful, we may incur significant liabilities.

We provide to insurers and other payors of healthcare costs managed care programs that utilize preferred provider organizations and computerized bill review programs. Healthcare providers have brought, against us and our customers, individual and class action lawsuits challenging such programs. If such lawsuits are successful, we may incur significant liabilities.

We make recommendations about the appropriateness of providers’ proposed medical treatment plans for patients throughout the country. As a result, we could be subject to claims arising from any adverse medical consequences. Although plaintiffs have not, to date, subjected us to any claims or litigation relating to the granting or denial of claims for payment of benefits or allegations that we engage in the practice of medicine or the delivery of medical services, we cannot assure you that plaintiffs will not make such claims in future litigation. We also cannot assure you that our insurance will provide sufficient coverage or that insurance companies will make insurance available at a reasonable cost to protect us from significant future liability.

18

The increased costs of professional and general liability insurance may have an adverse effect on our profitability.

The cost of commercial professional and general liability insurance coverage has risen significantly for us in the past several years, and this trend may continue. In addition, if we were to suffer a material loss, our costs may increase over and above the general increases in the industry. If the costs associated with insuring our business continue to increase, it may adversely affect our business. We believe our current level of insurance coverage is adequate for a company of our size engaged in our business. Additionally, we may have difficulty getting carriers to pay under coverage in certain circumstances.

Risks Related to Our Regulatory Environment

Changes in government regulations could increase our costs of operations and/or reduce the demand for our services.

Many states, including a number of those in which we transact business, have licensing and other regulatory requirements applicable to our business. Approximately half of the states have enacted laws that require licensing of businesses which provide medical review services such as ours. Some of these laws apply to medical review of care covered by workers’ compensation. These laws typically establish minimum standards for qualifications of personnel, confidentiality, internal quality control, and dispute resolution procedures. These regulatory programs may result in increased costs of operation for us, which may have an adverse impact upon our ability to compete with other available alternatives for healthcare cost control. In addition, new laws regulating the operation of managed care provider networks have been adopted by a number of states. These laws may apply to managed care provider networks we have contracts with or to provider networks which we may organize. To the extent we are governed by these regulations, we may be subject to additional licensing requirements, financial and operational oversight and procedural standards for beneficiaries and providers.

Regulation in the healthcare and workers’ compensation fields is constantly evolving. We are unable to predict what additional government initiatives, if any, affecting our business may be promulgated in the future. Our business may be adversely affected by failure to comply with existing laws and regulations, failure to obtain necessary licenses and government approvals, or failure to adapt to new or modified regulatory requirements. Proposals for healthcare legislative reforms are regularly considered at the federal and state levels. To the extent that such proposals affect workers’ compensation, such proposals may adversely affect our business, financial condition, and results of operations.

In addition, changes in workers’ compensation, automobile insurance, and group healthcare laws or regulations may reduce demand for our services, which would require us to develop new or modified services to meet the demands of the marketplace, or reduce the fees that we may charge for our services.

Increasing regulatory focus on privacy issues and expanding privacy laws could impact our business models and expose us to increased liability.

U.S. privacy and data security laws apply to our various businesses. Governments, privacy advocates and class action attorneys are increasingly scrutinizing how companies collect, process, use, store, share and transmit personal data. Globally, new laws, such as the General Data Protection Regulation in Europe, the California Consumer Privacy Act in California, and industry self-regulatory codes have been enacted and more are being considered that may affect our ability to respond to customer requests under the laws, and to implement our business models effectively. These requirements, among others, may force us to bear the burden of more onerous obligations in our contracts. Any perception of our practices, products or services as a violation of individual privacy rights may subject us to public criticism, class action lawsuits, reputational harm, or investigations or claims by regulators, industry groups or other third parties, all of which could disrupt our business and expose us to increased liability. Additionally, we store information on behalf of our customers and if our customers fail to comply with contractual obligations or applicable laws, it could result in litigation or reputational harm to us.

19

Increased regulatory scrutiny on use of “big data” techniques, machine learning, and artificial intelligence could impact our business and expose us to increased liability.

There has also been increased regulatory scrutiny of the use of “big data” techniques, machine learning, and artificial intelligence. It is likely that we will be subject to new regulations that could materially adversely affect our operations or ability to write business profitably in one or more jurisdictions. The legal and regulatory framework governing artificial intelligence is evolving rapidly and remains highly uncertain. Federal and state agencies are actively proposing or implementing new regulations and guidelines targeting artificial intelligence. With many of these artificial intelligence regulations still in the early stages of development, it is difficult to predict the impact they will have on our business. These regulations may require changes to our implementation of artificial intelligence technology, increase compliance costs, or increase the risk of non-compliance. Any failure to comply with applicable laws or regulations related to artificial intelligence could expose us to investigations, enforcement actions, lawsuits, fines, or other penalties, which could have a material adverse effect on our business, results of operation and financial condition. In addition, regulators have recently requested information from insurers on their use of algorithms, artificial intelligence and machine learning. We have internal policies governing the use of artificial intelligence by our employees designed to protect the Company from breaches of data privacy, liability and regulatory enforcement risk; however, if our employees violate these policies, it could expose us to such risks. Our exposure to these risks also could increase if our vendors, suppliers, or other third-party providers employ artificial intelligence in relation to the products or services they provide to us, as we have limited control over such use in third-party products or services. These risks include, among others, the input of confidential information, including material non-public information, in contravention of our policies or contractual restrictions to which any of the foregoing are subject, or in violation of applicable laws or regulations, including those relating to data protection. We cannot predict what, if any, regulatory actions may be taken with regard to “big data,” but any limitations could have a material impact on our business, business processes, financial condition, and results of operations.

The costs of compliance with sustainability or other environmental, social responsibility or governance laws, regulations, or policies, including investor and client-driven policies and standards, could adversely affect our business.

As a non–manufacturing service business, we have to date been less impacted from laws and regulations related to sustainability concerns or other environmental, social responsibility or governance (“ESG”) laws, regulations, or policies. However, we may need to incur ESG-related costs in response to our customers or shareholders. Increasingly our customers and shareholders expect that we meet environmental, social responsibility, sustainability or other business policies or standards, which may be more restrictive than current laws and regulations, before our customers commence, or continue, doing business with us or before shareholders invest in our common stock. Our compliance with these policies and related requirements could be costly, and our failure to comply could adversely affect our business relationships or reputation.

Risks Related to Ownership of Our Common Stock

The market price and trading volume of our common stock may be volatile, which could result in rapid and substantial losses for our stockholders.

The market price of our common stock may be highly volatile and could be subject to wide fluctuations. In addition, the trading volume in our common stock may fluctuate and cause significant price variations to occur. The stock market has in the past experienced price and volume fluctuations that have particularly affected companies in the healthcare and managed care markets resulting in changes in the market price of the stock of many companies, which may not have been directly related to the operating performance of those companies. There can be no assurance that the market price of our common stock will not fluctuate or decline significantly in the future.

We cannot assure our stockholders that our stock repurchase program will enhance long-term stockholder value and stock repurchases, if any, could increase the volatility of the price of our common stock and will diminish our cash reserves.

In 1996, the Board of Directors authorized a stock repurchase program and, since then, has periodically increased the number of shares authorized for repurchase under the program. The most recent increase occurred in November 2022 and brought the number of shares authorized for repurchase over the life of the program to 117,000,000 shares. There is no expiration date for the repurchase program. The timing and actual number of shares repurchased, if any, will depend on a variety of factors including the timing of open trading windows, trading price, corporate and regulatory requirements, and market conditions. The stock repurchase program does not obligate us to acquire any amount of common stock and may be suspended or discontinued at any time without notice. Repurchases pursuant to our stock repurchase program could affect our stock price, increase the volatility of the price of our common stock and reduce the market liquidity for our common stock. Additionally, repurchases under our stock repurchase program will diminish our cash reserves, which could strain our liquidity, impact our ability to pursue future strategic opportunities and acquisitions, and result in lower overall returns on our cash balances. There can be no assurance that any further stock repurchases will enhance stockholder value because the market price of our common stock may decline below the levels at which we repurchased shares of common stock. Although our stock repurchase program is intended to enhance long-term stockholder value, there is no guarantee we will be successful in achieving this objective.

20