​

​

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

(Mark One)

​

☒    ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

​

For the fiscal year ended December 31, 2024

OR

​

☐    TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

​

For the transition period from ______ to ______

Commission File Number 001-41721

Waystar Holding Corp.

(Exact name of registrant as specified in its charter)

​

​

(844) 492-9782

Registrant’s telephone number, including area code

Securities registered pursuant to Section 12(b) of the Act:

​

​

Securities registered pursuant to Section 12(g) of the Act: None.

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes  ☐   No  ☒

Indicated by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes  ☐   No  ☒

Indicate by check mark whether the registrant: (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports); and (2) has been subject to such filing requirements for the past 90 days. Yes  ☒   No  ☐

Indicate by check mark whether the registrant has submitted electronically, if any, every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes  ☒   No  ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act:

​

​

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act.  ☐

Indicated by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report.  ☐

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements.  ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive officers during the relevant recovery period pursuant to §240.10D-1(b).  ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes  ☐  No  ☒

As of June 30, 2024, the aggregate market value of the registrant’s outstanding common stock held by non-affiliates was $1,010,020,722 based on the closing price of the registrant’s common stock on June 28, 2024, the last business day of the registrant’s most recently completed second fiscal quarter. For purpose of this calculation shares of common stock held by each executive officer and directors and certain significant stockholders have been excluded since those persons may under certain circumstances be deemed affiliates. This determination of affiliate status is not necessarily a conclusive determination for other purposes.

The registrant had 172,151,839 shares of common stock outstanding as of February 12, 2025.

DOCUMENTS INCORPORATED BY REFERENCE

Part III incorporates certain information by reference from the registrant’s definitive proxy statement for the 2025 annual meeting of shareholders, which will be filed no later than 120 days after the registrant’s fiscal year ended December 31, 2024.

​

​

​

​

Table of Contents

​

​

​

​

Glossary

The following definitions apply to these terms as used in this Annual Report on Form 10-K:

Numerical figures included in this report have been subject to rounding adjustments. Accordingly, numerical figures shown as totals in various tables may not be arithmetic aggregations of the figures that precede them.

​

Cautionary Statement Concerning Forward-Looking Statements and Summary of Risk Factors

This report contains forward-looking statements, within the meaning of the Private Securities Litigation Reform Act of 1995, that reflect our current views with respect to, among other things, our operations and financial performance. Forward-looking statements include all statements that are not historical facts. These forward-looking statements are included throughout this report and relate to matters such as our industry, business strategy, goals, and expectations concerning our market position, future operations, margins, profitability, capital expenditures, liquidity, and capital resources and other financial and operating information. We have used the words “anticipate,” “assume,” “believe,” “continue,” “could,” “estimate,” “expect,” “intend,” “may,” “plan,” “potential,” “predict,” “project,” “future,” “will,” “seek,” “foreseeable,” the negative version of these words or similar terms and phrases to identify forward-looking statements in this report.

The forward-looking statements contained in this report are based on management’s current expectations and are not guarantees of future performance. The forward-looking statements are subject to various risks, uncertainties, assumptions, or changes in circumstances that are difficult to predict or quantify. Our expectations, beliefs, and projections are expressed in good faith and we believe there is a reasonable basis for them. However, there can be no assurance that management’s expectations, beliefs, and projections will result or be achieved. Actual results may differ materially from these expectations due to changes in global, regional, or local economic, business, competitive, market, regulatory, and other factors, many of which are beyond our control. We believe that these factors include but are not limited to the following:

These factors should not be construed as exhaustive and should be read in conjunction with the other cautionary statements that are included in this report. Should one or more of these risks or uncertainties materialize, or should any of our assumptions prove incorrect, our actual results may vary in material respects from those projected in these forward-looking statements.

Any forward-looking statements made by us in this report speak only as of the date of this report and are expressly qualified in their entirety by the cautionary statements included in this report. Factors or events that could cause our actual results to differ may emerge from time to time, and it is not possible for us to predict all of them. You should not place undue reliance on our forward-looking statements. We undertake no obligation to publicly update or review any forward-looking statement, whether as a result of new information, future developments, or otherwise, except as may be required by any applicable securities laws.

​

​

Part I

Item 1.Business

Our Mission

Our mission is to simplify healthcare payments through our modern cloud-based software, enabling our healthcare clients to prioritize patient care and optimize their financial performance.

Overview

Waystar provides healthcare organizations with mission-critical cloud software that simplifies healthcare payments. Our enterprise-grade platform streamlines the complex and disparate processes our healthcare provider clients must manage to be reimbursed correctly, while improving the payments experience for providers, patients, and payers. We leverage internally developed AI as well as proprietary, advanced algorithms to automate payment-related workflow tasks and drive continuous improvement, which enhances claim and billing accuracy, enriches data integrity, and reduces labor costs for providers.

Put simply, our software helps providers get paid faster, accurately, and more efficiently, while ensuring patients receive a modern, transparent, and consumer-friendly financial experience.

The healthcare payment ecosystem is highly complex, beginning with pre-service patient onboarding and extending through post-service revenue collection, with dozens of interdependent steps in between. Within this multi-step workflow, the process for determining how much a provider should be reimbursed involves millions of permutations of variables, such as over 10,000 diagnosis codes that are constantly changing and unique payer contracts, each with individual rules, processes, and reimbursement requirements. The burden borne by providers of tracking and managing all of these variables, coupled with a constantly evolving regulatory framework, often results in incorrect payments or denials that require time-consuming appeals procedures to resolve. Historically, healthcare providers have relied upon a patchwork of manual processes and systems to navigate these complexities and support their payment functions. However, this legacy approach has resulted in workflow delays, lost revenue, and slower time to payment. Our purpose- built software platform addresses these challenges and optimizes healthcare payments across all stages of the patient journey. Our clients utilize our software to manage pre-encounter workflows such as eligibility checks and prior authorization approvals, as well as mid- and post-encounter workflows such as co-pay collection, claims submission and monitoring, and payer remittances. Our software helps to avoid or reduce billing errors throughout the healthcare payment workflow, from pre-encounter eligibility verification to determine patient insurance eligibility and benefits prior to rendering service, to mid- and post-encounter solutions such as our revenue capture suite which identifies and resolves missing charges and errors in claims submissions by providers, our claims management suite which helps ensure submissions in accordance with payer contracts, and our denial avoidance solution which offers a root cause reporting tool for denied claims to help reduce preventable denials in the future.

Our software is used daily by providers of all types and sizes across the continuum of care, including physician practices, clinics, surgical centers, and laboratories, as well as large hospitals and health systems. We currently serve over 30,000 clients of various sizes, representing over one million distinct providers practicing across a variety of care sites, including 16 of the top 20 U.S. News Best Hospitals. Our client base is highly diversified, and for the year ended December 31, 2024, our top 10 clients accounted for only 11.2% of our total revenue for such period. Our business model is designed such that as our clients grow to serve more patients, their claims and transactional volumes increase, resulting in corresponding growth in our business. In addition, our clients frequently adopt a greater number of our solutions over time and introduce our solutions across new sites of care. In 2024, we facilitated over six billion healthcare payments transactions, including over $1.8 trillion in gross claims volume. As of 2023, we facilitated healthcare payments transactions spanning approximately 50% of patients in the United States.

Our platform benefits from powerful network effects. Our cloud-based software is driven by a sophisticated, automated, and curated rules engine, employing AI to generate and incorporate real-time feedback from millions of network transactions processed through our platform each day. Every transaction we process provides additional data insights across providers, patients, and payers, which are embedded in updates that are deployed efficiently across our client base. This results in cumulative benefits to us over time - as we capture more data from each transaction we process, we leverage that data to continue to improve the Waystar platform through embedded machine learning, advanced algorithms, and other in-house AI technologies to deliver added value to our clients. In turn, the more value we create for our clients, the more likely it is that they will continue to use our products, allowing us to continue to capture more data that results in tangible improvements to our platform. As a result, our clients benefit from faster and more efficient performance from software that is evolving to meet ever-changing regulatory and payer requirements, enabling accurate and timely reimbursement.

Industry Background

Healthcare is one of the largest and most complex vertical end-markets within the U.S. economy, accounting for 17.6% of the U.S. gross domestic product as of 2023. According to CMS, total U.S. healthcare spending was $4.9 trillion in 2023. National health expenditures are expected to grow 5.6% annually reaching $7.6 trillion in 2032, or 19.7% of GDP. According to the Journal of the American Medical Association, the annual cost of wasteful spending in healthcare has ranged from $760 billion to $935 billion in recent years, or nearly one-quarter of total healthcare spending. Of this, $350 billion is administrative- related, which is inclusive of healthcare payments-related waste.

The Waystar platform is purpose-built to address the administrative headwinds faced by healthcare providers, including:

Our Market Opportunity

Over time, administrative workflows (e.g., human resources, information technology, accounting and finance, and customer service) that were traditionally insourced by healthcare providers have undergone a meaningful transformation. Seeking more effective solutions to address industry challenges, providers initially outsourced these functions to third-party specialized services vendors. However, with advances in technology infrastructure and cloud-based software, as well as increased interoperability between systems, providers are increasingly utilizing automated software solutions to further enhance efficiency. We believe the healthcare payments workflow is currently undergoing such an evolution, and that Waystar is well- positioned to benefit from providers gravitating towards more modern, software-oriented solutions.

We estimate that our TAM with respect to our current software solution set was $15 billion in 2022. To estimate our market opportunity, we categorized the United States healthcare provider market into tiers based on setting of care and size of practice. We then applied our average pricing by product, accounting for pricing differences at varying sized providers, and multiplied the average product price by the corresponding practice count per setting of care to determine our TAM. Based on a third-party study commissioned by the Company, we believe our TAM has the potential to increase to almost $20 billion in 2027, reflecting a 5% CAGR from 2022 to 2027, driven by growth within healthcare payments (notably, in prior authorizations, patient payments, and revenue cycle management analytics), increased outsourcing in revenue cycle management, as well as secular technology tailwinds such as greater utilization of AI. We expect to expand our TAM further over time as we develop new solutions and address adjacent workflows. We believe we have consistently grown in excess of the market since 2016 and expect we will continue to grow our market share in the future by virtue of our differentiated platform and capabilities. We believe the market share of our solutions within the hospital segment and ambulatory practice segment is approximately 4% and 8% (calculated as a percentage of our revenue as compared to our TAM estimates by setting of care), respectively, demonstrating the ample white space in which we can continue driving our growth.

The Waystar Platform

Our innovative cloud-based software platform is purpose-built to simplify our clients’ payment-related challenges. We believe our platform significantly outperforms those of our competitors, who lack either modern functionality or the ability to address the full end-to-end payments workflow.

The key components of our platform include:

Our platform provides the following benefits to our clients:

Our platform enables us to provide industry-leading technology at scale to more than 30,000 clients across more than six billion healthcare payment transactions worth over $1.8 trillion in annual gross claims. The quality and innovation of our technology has been widely recognized, as evidenced by our receipt of a MedTech Breakthrough Award for healthcare payments innovation, several Stevie Awards, including Company of the Year in healthcare, and numerous Best in KLAS awards.

Why Waystar Wins

Through decades of experience, we have honed our deep domain expertise, fostered long-standing client relationships, and built our library of rules and algorithms. We believe our modern, cloud-based platform combined with our subject matter expertise are extremely difficult to replicate and provide us with a meaningful competitive advantage. We believe these factors, together with the following additional strengths, position us well for continued success:

We believe our platform strengths and differentiation are most evident in our ability to win clients. We had an 83% win rate against our competitors for fiscal years 2022 through 2024 in situations where the client ultimately elected to switch vendors or purchase a new solution.

We believe that the strengths of our platform and solutions provide us with a significant competitive advantage. Following a recent cybersecurity incident involving one of our competitors, more than 30,000 providers, including a significant number of large health systems and ambulatory providers, began adopting our solutions, and we were able to implement our solutions for many of these new clients in as little as 48 hours. This also allowed us to establish direct connectivity with large, national health plans, who previously had exclusive portal connections with the competitor. We expect to build enduring relationships with these new clients, the vast majority of whom have signed contracts with initial terms of two to three years, with one- year automatic renewals.

Our Growth Strategy

We plan to capitalize on our market opportunity by executing on the following growth strategies:

Our Solutions

Our comprehensive solution set streamlines the complex and disparate processes relating to payments received by healthcare providers and addresses related pain points for providers, patients, and payers. Our solutions include:

Our Technology

The Waystar platform is built upon a modern, scalable, multi-tenant cloud-based architecture that delivers an exceptional client experience and allows us to process billions of transactions every year and support nearly 100,000 daily end-users. Our solutions are deeply integrated into our clients’ workflows, providing an elegant and intuitive user experience. The architecture, design, deployment, and management of our platform are centered on the following areas:

Search functionality, high-level vertical tabs for our solutions, and dropdown menus within each solution type deliver intuitive navigation for our clients. Comprehensive and customizable dashboards illustrate data using a variety of methods, enabling more efficient identification of outliers, trends, and other useful information.

We have built a comprehensive future-ready suite of enterprise-scale core system software, and we will continue to invest in our technology to further improve our platform infrastructure and capabilities. We are able to responsibly manage technical debt, allowing us to focus our investment on continuously innovating and advancing our platform for the benefit of our clients.

Our Go-to-Market Strategy

We have built a powerful go-to-market engine focused on acquiring new clients, driving expanded use of our platform for existing clients, and strengthening and growing our relationships with channel partners.

We sell our platform through our sales team comprised of over 100 representatives. Our sales teams are dedicated to either ambulatory providers or hospital and health system clients given the specific needs, call points, and sales cycles of those client types. Our sales approach to ambulatory provider clients consists of high velocity direct enterprise go-to market strategy, with a shorter sales cycle, whereas our direct enterprise go-to-market strategy for hospital and health systems clients typically has a longer sales cycle. The team is further specialized, with certain individuals focused on winning new clients and others focused on cross- selling into existing clients. We leverage data and analytics to manage the effectiveness of our sales force, as well as identify areas for potential improvement. Our client-centric sales model is fueled by frequent engagement with our clients. We have assigned dedicated client success managers to clients that have generated almost half our revenue since the beginning of 2021.

In addition to our direct sales force, we have a team focused on strengthening and expanding our channel partner and alliance relationships. We have established strong partnerships with the nation’s leading EHR and PM providers for integration and joint go-to-market efforts to providers. In addition, our strategic partners extend our sales presence and accelerate direct sales of our solutions by actively referring and promoting us to their client bases, enabling incremental touchpoints for our sales team who is ultimately responsible for marketing and selling to the client. We also partner with and sell to outsourced revenue cycle or billing service providers, who leverage our technology to help providers manage their administrative processes and payments.

Our go-to-market representatives are supported by a commercial operations team that is focused on developing strategic plans and driving team member development to enhance our effectiveness. Our go-to- market team also works with our product subject-matter experts, who help identify prospective client pain points and business challenges and help configure optimal solutions. Additionally, we have built a high- performance marketing function that has significantly elevated Waystar’s voice in the industry, expanding awareness of our brand over time.

Our Business Model

Over 99% of our revenue is either recurring subscription or based on highly predictable volumes. Our contracts with clients generally include a subscription fee component as well as a volume-based component, although some contracts include only one of these components. The subscription fee provides us with a fixed, recurring revenue stream while the volume-based component allows us to benefit from our clients’ growth. We generate greater revenue as our clients see more patients and greater utilization of their healthcare services. In addition, based on our contract structures, our proprietary data asset, our predictive analytics capabilities, and our deep understanding of the healthcare market, we believe we have visibility into and an ability to predict both subscription-based and volume-based revenue. For instance, 98% of revenue in 2024 was generated from clients already under contract as of the beginning of the year. Our client contracts are typically two or three years in length with automatic renewals for successive one-year terms that include standard price escalators. Client billing generally occurs monthly.

Our Clients

Our clients represent healthcare providers across all types of care settings, including physician practices, clinics, surgical centers, and laboratories, as well as large hospitals and health systems. Generally, 30% of our revenue comes from hospitals and health systems, while 70% comes from ambulatory and alternate sites of care. The over 30,000 clients we currently serve also vary significantly in size and represent over one million distinct providers in total, including 16 of the top 20 U.S. News Best Hospitals. As a result of our broadly applicable model, our client base is highly diversified, and for the year ended December 31, 2024, our top 10 clients accounted for only 11.2% of our total revenue. The number of clients from whom we generate over $100,000 of revenue has grown from 982 in the year ended December 31, 2022 to 1,203 in the year ended December 31, 2024, driven by large, new client wins and successful cross-selling and up-selling efforts.

Our clients have no obligation to renew their subscriptions for our platform solutions after the initial term expires, which is typically a two to three-year term. Our contracts generally provide for the automatic renewal for one-year subsequent terms, with the ability for our clients to terminate the contract with limited notice to us. However, we believe that due to the breadth, depth, and quality of our products, as well as the significant time and resources it takes to switch to a different healthcare payments provider, we will be able to retain our existing clients and upsell and cross-sell to them, as evidenced by our Net Revenue Retention Rate of 110.1% for the year ended December 31, 2024.

Our People, Values, and Culture

As of December 31, 2024, we employed over 1,500 full-time team members, all of which are located in the United States. As of December 31, 2024, none of our team members were covered by a collective bargaining agreement or represented by a labor organization, and we have not experienced a labor-related work stoppage. We believe we have good relationships with our team members, as evidenced by our 2024 Fortune Great Place to Work Survey, where 83% of participating team members indicated that they would recommend working at Waystar to friends and family.

Our Values and Culture

Our values, which are foundational to the Waystar culture, include the following:

We have won numerous workplace awards, including being recognized as a Fortune Great Place to Work and as one of the Top Places to Work by Becker’s Hospital Review for two consecutive years. We are proud of our strong company culture and investment in long-term career growth for our people, which is evidenced by the long tenure of many of our team members with our organization. We believe it is important to put our team members first, and we provide all of our team members competitive health benefits, 401(k) investment options, and paid family leave, and conduct mental health and other workshops for our team members. We also provide our team members with paid leave for volunteer time, as we believe it is important for Waystar and its team members to give back to the community. We regularly celebrate individuals and team members who exemplify Waystar’s values. We believe this helps us reinforce our values and creates a performance-focused culture that enables us to continue to attract, retain, and develop talent, which is critical to our long-term success.

Training, Development, Leadership, and Engagement

To engage and incentivize our workforce, we provide a wide range of training and development opportunities to support and motivate our team members to operate at their best and succeed. These opportunities include, but are not limited to, Front Line Leadership training for people leaders, Emerging Leader Training for potential leaders, and an annual Leadership Summit for our top leaders. All team members participate in annual training that reinforces our values, certifies team members on key business processes, and helps to promote a workplace of respect, safety, and engagement.

The continued engagement of our talented and committed team is critical to our business. Each year, we gauge our team members’ level of engagement and satisfaction by conducting an employee engagement survey with the assistance of a third-party. As a part of this process, we solicit feedback from team members on training and development opportunities, benefits, well-being, and our ethical culture. We also ask for feedback about their people leader’s effectiveness and ability to foster a more inclusive and diverse workplace.

Inclusion and Diversity

At Waystar, we aspire to create an environment where every team member, with their unique background, feels a sense of belonging. We believe that we rise by lifting others up and provide a safe, inclusive work environment where every team member can be their whole, authentic self-no matter their age, race, sexual orientation, gender, or unique background. We have an Inclusion & Diversity Council that oversees various events and initiatives, including various mentorship programs that provide underrepresented students with salaried internships. We also have a “Waystar Day” every quarter that focuses on different initiatives such as kindness, diversity and inclusion, and volunteering, as well as education assistance opportunities in furtherance of self-advancement and development. In addition, we have five Affinity Groups (BIPOC, Families, LGBTQIA+, Military, and Women) which seek to foster a sense of shared community and empowerment for employees who share a common social identity, such as gender, race, ethnicity, and sexual orientation. Team members can voluntarily join an Affinity Group to network, discuss and exchange ideas, and enhance their professional development.

Research and Development

We believe that our research and development function and our cloud-based product portfolio provides us with a competitive advantage that enables us to innovate faster and more efficiently, while simultaneously delivering better solutions for our clients. Our research and development team is responsible for the design, development, testing, and enhancement of our products and software. As of December 31, 2024, we had approximately more than 280 team members dedicated to product and research and development. For the years ended December 31, 2024, 2023, and 2022 our research and development expense was $48.8 million, $35.3 million, and $32.8 million, respectively.

Competition

We operate in a highly fragmented and competitive market that is characterized by rapidly evolving technology standards, evolving regulatory requirements, and frequent changes in client needs and introduction of new products and solutions. However, we believe we have a competitive advantage based on the breadth, depth, and quality of our solutions, our innovative cloud-based software platform, our deep domain expertise developed over two decades of industry experience, the differentiated client service we provide, and the ROI we deliver.

Our current principal competitors include, but are not limited to:

We believe the principal competitive factors in our market include the following:

We believe that we compete favorably with respect to each of these factors. However, we believe that our ability to remain competitive will depend on the continued success of our disciplined investments in research and development and sales and marketing programs. See Part I, Item 1A, “Risk Factors—Risks Related to our Business and our Industry—We operate in a highly competitive industry.”

Intellectual Property

We rely on a combination of trademark, patent, trade secret, copyright, and other intellectual property laws, as well as contractual provisions, including in employment, confidentiality, and inventions assignment agreements to protect our intellectual property, intangible assets, and associated proprietary rights. Our intellectual property, particularly our know-how is material to the conduct of our business. The success of our business depends in part on our ability to use our trademarks, service marks, and other intellectual property in the operation of our business and platform. In the United States, we have 19 trademark registrations, 15 issued patents, and 26 copyright registrations. In addition, we have registered the www.waystar.com domain name, which we use in connection with our platform.

We have procedures in place to monitor for potential infringement of our intellectual property, and it is our policy to take appropriate action to enforce our intellectual property, taking into account the strength of our claim, likelihood of success, cost, and overall business priorities. See Part I, Item 1A, “Risk Factors—Risks Related to Information Technology Systems, Cybersecurity, Data Privacy, and Intellectual Property.”

Security and Compliance

Security and compliance are our top priorities. We maintain a comprehensive security program designed to safeguard the confidentiality, integrity, and availability of our clients’ data. In particular, we deploy physical, administrative, and technical controls to protect the security and privacy of patient information.

We operate a cloud-based platform that offers reliability, performance, security, and privacy for our clients. We have infrastructure in place with co-located data centers, and within Microsoft Azure, Amazon Web Service, and Google Cloud Platform environments, to securely manage and maintain our clients’ patient information.

We use external security auditors and industry-leading vendors, such as CrowdStrike and CYE to ensure we have the controls and procedures in place to protect our clients’ sensitive information. We have industry certifications, including HITRUST, PCI-DSS Level 1 Service Provider, SSAE 18 SOC 2, and validated PCI Point-to-Point Encryption. As a PCI-DSS Level 1 Service Provider, we are committed to upholding industry security standards to cardholder data. We received our HITRUST CSF certification in 2021.

We are committed to protecting the information and privacy of our clients and their patients. We are both a “covered entity” when we provide our clearinghouse services and a “business associate” as defined under HIPAA or subcontractor to a business associate to healthcare providers or revenue cycle management companies. We sign business associate agreements (“BAA”) that govern our uses and disclosures of protected health information (“PHI”) to our own business associates and on behalf of our covered entity clients that engage us to provide our software solutions. Such BAAs must, among other things, provide adequate written assurances as to how we will use and disclose PHI; that we will implement reasonable administrative, physical, and technical safeguards to protect such PHI from misuse; that we will enter into similar agreements with our agents and subcontractors that have access to the information; that we will report security incidents and other inappropriate uses or disclosures of PHI; and that we will assist the client with certain of its duties under HIPAA.

Regulation

Our business is subject to extensive, complex, and rapidly changing federal and state laws, regulations, and industry standards. These laws and regulations can vary significantly from jurisdiction to jurisdiction, and interpretation and enforcement of existing laws and regulations by governmental and regulatory authorities may change periodically. We cannot be assured that a review of our business by courts or governmental or regulatory authorities will not result in determinations that could adversely affect our operations or that the healthcare regulatory environment will not change in a way that restricts our operations. Federal and state legislatures also may enact various legislative proposals that could materially impact certain aspects of our business.

Federal and State Health Information Privacy and Security Laws

There are numerous U.S. federal and state laws and regulations related to the privacy and security of personal information, including individually identifiable health information. In particular, HIPAA established privacy and security standards that limit the use and disclosure of PHI, and required the implementation of administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of individually identifiable health information in both paper and electronic form. HIPAA also required the U.S. Department of Health and Human Services (“HHS”) to adopt national standards establishing electronic transaction standards that all healthcare providers must use when submitting or receiving certain healthcare transactions electronically. For example, claims for reimbursement that are transmitted electronically to payors must comply with specific formatting standards, and these standards apply whether the payor is a government or a private entity. We are contractually required to structure and provide our solutions in a way that supports our clients’ HIPAA compliance obligations to use prescribed electronic formats.

HIPAA requires us to enter into written agreements with covered entities, business associates, and subcontractors with respect to uses and disclosures of PHI. Covered entities, such as us and our clients, may be subject to penalties for, among other activities, failing to enter into a BAA where required by law or as a result of a business associate violating HIPAA, if the business associate is found to be an agent of the covered entity and acting within the scope of the agency. Business associates are also directly subject to liability under HIPAA. In instances where we act as a business associate to a covered entity, there is the potential for additional liability beyond our status as a covered entity. Violations of HIPAA may result in significant civil and criminal penalties, as well as monitoring or resolution agreements. A single breach incident can result in violations of multiple standards.

We must also comply with HIPAA’s breach notification rule and equivalent state breach notification laws. Under the breach notification rule, covered entities must notify affected individuals without unreasonable delay in the case of a breach of unsecured PHI, which compromises the privacy or security of the PHI, but no later than 60 days after discovery of the breach by a covered entity or its agents. Many state laws and regulations require affected individuals to be notified in the event of a data breach involving PHI within a shorter timeframe. Under HIPAA, all impermissible uses or disclosures of unsecured PHI are presumed to be breaches unless an exception to the definition of breach applies or the covered entity or business associate establishes that there is a low probability the PHI has been compromised based on a risk assessment of at least four regulatory factors. In addition, notification must be provided to HHS and the local media in cases where a breach affects 500 or more individuals. Breaches affecting fewer than 500 individuals must be reported to HHS on an annual basis. There can be no assurance that we will not be the subject of an investigation (arising out of a reportable breach incident, audit, or otherwise) alleging non-compliance with HIPAA in our maintenance of PHI. Violations of HIPAA by providers like us, including, but not limited to, failing to implement appropriate administrative, physical, and technical safeguards, have resulted in enforcement actions and in some cases triggered settlement payments or civil monetary penalties.

State attorneys general also have the right to prosecute HIPAA violations committed against residents of their states. While HIPAA does not create a private right of action that would allow individuals to sue in civil court for a HIPAA violation, its standards have been used as the basis for the duty of care in state civil suits, such as those for negligence or recklessness in misusing personal information. In addition, the HITECH Act mandated that HHS conduct periodic compliance audits of HIPAA covered entities and their business associates for compliance. It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the civil monetary penalty fine paid by the violator.

In the past year, HHS has also issued new final and proposed regulations and guidance on cybersecurity of electronic PHI (“ePHI”) uses and disclosures of substance use information, reproductive health information, and online tracking technologies that access individually identifiable health information. For example, in April 2024, a new HHS final rule amending substance use confidentiality regulations (42 C.F.R. Part 2 or Part 2) took effect. The final rule included changes to better facilitate care coordination, updates to the fine structure for Part 2 violations to align with the civil and criminal enforcement authorities that apply to HIPAA violations, and increases in penalties for Part 2 violations to a $50,000 maximum penalty for failure to comply with the Part 2 requirements and a $250,000 maximum penalty for the wrongful disclosure of individually identifiable health information.

In December 2024, HHS Office for Civil Rights (“OCR”) issued a notice of proposed rulemaking to better protect the confidentiality, integrity, and availability of ePHI. The proposed rule would, among other requirements, remove the distinction between “required” and “addressable” implementation specifications and make all implementation specifications required with specific, limited exceptions; require written documentation of all HIPAA Security Rule policies, procedures, plans, and analyses; require regulated entities to conduct compliance audits at least once every twelve months to ensure their compliance with the HIPAA Security Rule requirements; require encryption of ePHI at rest and in transit; require the use of multi-factor authentication, with limited exceptions; and require network segmentation and separate technical controls. The proposed rule remains subject to public comment until March 2025.

In April 2024, HHS OCR issued a final rule that amended HIPAA privacy regulations to prohibit the disclosure of PHI related to lawful reproductive health care in certain circumstances. The final rule prohibits the use or disclosure of PHI when PHI is sought for certain investigations or to impose liability on individuals, health care providers, or others who seek, obtain, provide, or facilitate reproductive health care that is lawful under the circumstances in which such health care is provided. It also requires a health care provider, health plan, clearinghouse, or their business associates, to obtain a signed attestation that certain requests for PHI potentially related to reproductive health care are not made for these prohibited purposes. The final rule took effect on June 25, 2024.

Additionally, in a 2023 guidance document, HHS OCR took the position that entities regulated under HIPAA are not permitted to use tracking technologies in a manner that would result in an impermissible disclosure of PHI. Such tracking technologies have been used to collect and analyze information about user behavior and enhance the user experience. In March 2024, HHS OCR updated its 2023 guidance on the use of online tracking technologies on webpages and applications by HIPAA covered entities and business associates to address the disclosure of individually identifiable health information through unauthenticated, public-facing webpages. There have been several class action lawsuits asserting that HIPAA covered entities and business associates improperly used or disclosed PHI through tracking technologies.

Other Data Privacy Laws, Regulations, and Industry Standards

In addition, because our business and platform involve the Processing of personal information and other confidential and regulated information, we are also subject to numerous additional laws, regulations, and industry standards. For example, the California Consumer Privacy Act of 2018 (“CCPA”), which was subsequently amended by the California Privacy Rights and Enforcement Act of 2020 (“CPRA”), originally took effect in 2020, and provides California residents expanded privacy rights and protections, and provides for civil penalties for certain violations. Many additional jurisdictions around the world, including many additional U.S. states, have adopted or are proposing to adopt laws and regulations relating to privacy, data protection, and data security, and we may become subject to additional requirements and obligations as we expand the scope of our business and operations. Further, we are also subject to industry standards such as PCI-DSS as a result of the credit card payments initiated by patients and provider staff members. For a discussion of the risks and uncertainties affecting our business related to compliance with data privacy laws and regulations, please see Part I, Item 1A, “Risk Factors—Risks Related to Information Technology Systems, Cybersecurity, Data Privacy, and Intellectual Property.”

Healthcare Fraud and Abuse Provisions

A number of federal and state laws, generally referred to as fraud and abuse laws, apply to healthcare providers, physicians and others that make, offer, seek or receive referrals or payments for products or services that may be paid for through any federal or state healthcare program and in some instances any private program. Given the breadth of these laws and regulations, they may affect our business, either directly or because they apply to our clients.

The federal Anti-Kickback Statute (the “AKS”) is broadly worded and prohibits, among other things, knowingly and willfully offering, paying, soliciting, or receiving remuneration, directly or indirectly, in cash or in kind, in return for or to induce (1) the referral of an individual covered by federal healthcare programs, such as Medicare and Medicaid, to a person for the furnishing or arranging for the furnishing of any item or service for which payment may be made in whole or in part under a federal healthcare program, or (2) the purchasing, leasing, or ordering, or arranging for or recommending the purchasing, leasing, or ordering of any good, facility, service, or item for which payment may be made in whole or in part under a federal healthcare program. Court decisions have held that the AKS can be violated even if only “one purpose” of remuneration is to induce or reward referrals or other business generated between the parties. Further, a person or entity does not need to have actual knowledge of this statute or specific intent to violate it in order to have committed a violation. Violations of the AKS include imprisonment for up to ten years, exclusion from participation in federal healthcare programs, including Medicare and Medicaid, potential liability under the federal civil False Claims Act, 31 U.S.C. § 3729 et seq. (the “FCA”) (as discussed below), and significant civil and criminal fines and monetary penalties, plus a civil assessment of up to three times the total payments between the parties to the arrangement. Larger fines can be imposed upon corporations under the provisions of the U.S. Sentencing Guidelines and the Alternate Fines Statute. Individuals and entities convicted of violating the AKS are subject to mandatory exclusion from participation in Medicare, Medicaid, and other federal healthcare programs for a minimum of five years in the case of criminal conviction.

In addition to a few statutory exceptions, the HHS, Office of Inspector General has promulgated safe harbor regulations that outline categories of activities that are deemed not to be in violation of the AKS, provided all applicable criteria are met. The failure of a financial relationship to meet all of the applicable safe harbor criteria does not necessarily mean that particular arrangement violates the AKS, but instead will be reviewed on a case-by-case basis in light of the parties’ intent and the arrangement’s potential for abuse. Arrangements that do not satisfy a safe harbor may be subject to greater scrutiny by enforcement agencies.

Under HIPAA, there are additional provisions regarding healthcare fraud and false statements relating to healthcare matters, which if not complied with, could have an impact on our business. The healthcare fraud provision prohibits knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program, including private payors. Similar to the AKS, a person or entity no longer needs to have actual knowledge of the healthcare fraud provision or specific intent to violate it in order to have committed a violation. The false statements provision prohibits knowingly and willfully falsifying, concealing, or covering up a material fact or making any materially false, fictitious, or fraudulent statement in connection with the delivery of or payment for healthcare benefits, items, or services. Violations of these provisions are felonies and may result in fines or imprisonment, or, in the case of the healthcare fraud provision, exclusion from government programs.

Additionally, the Civil Monetary Penalties Law, 42 U.S.C. § 1320a-7a, authorizes the imposition of civil monetary penalties, assessments, and exclusion against an individual or entity based on a variety of prohibited conduct, including, but not limited to:

Violations of applicable fraud and abuse laws could result in substantial civil monetary penalties that may be imposed under the federal Civil Monetary Penalties Law and may vary depending on the underlying violation. In addition, an assessment of not more than three times the total amount claimed for each item or service may also apply and a violator may be subject to exclusion from federal and state healthcare programs. In addition, should an individual providing services under our client contracts become excluded, we may be in violation of our agreements with clients and required to refund amounts attributable to services performed or sufficiently linked to an excluded individual.

False and Fraudulent Claims Laws

There are numerous federal and state laws that forbid (i) submitting a false claim, (ii) causing the submission of a false claim, (iii) retaining a known overpayment, or (iv) engaging in similar types of conduct. The FCA, among other things, prohibits an individual or entity from knowingly presenting or causing to be presented a false or fraudulent claim for payment to the government, including but not limited to the Medicare and Medicaid programs and related managed care programs. Many states have their own false claims laws prohibiting similar conduct to the extent the claim seeks payment from state funds, including Medicaid, and states are becoming increasingly active in using such laws to police false bills, false requests for payment, and other activities. The standard for “knowledge” under the FCA includes “reckless disregard” or “deliberate ignorance” of the truth or falsity of the information. There are a number of other potential bases for liability under the FCA, including knowingly and improperly avoiding an obligation to repay money to the government (often called the “reverse false claims” provision). The government has used the FCA to bring civil claims for Medicare and other government program fraud based on allegations including but not limited to those involving coding issues (including up-coding), the submission of false cost or other reports, and billing for services at a higher payment rate than appropriate. Violations of other laws, such as the AKS and the Stark Law, can serve as a basis for liability under the FCA.

The Patient Protection and Affordable Care Act, as amended, provides that claims for payment that are tainted by a violation of the AKS (which could include, for example, illegal incentives, or remuneration) are false for purposes of the FCA. In addition, amendments to the FCA and Social Security Act impose severe penalties for the knowing and improper retention of overpayments from government payors. The FCA may be enforced by the federal government directly or by a private qui tam plaintiff (a “relator”) on the government’s behalf. In the latter circumstance, the government is required to investigate the allegations brought by the relator, and then must decide whether or not to intervene. Even if the government declines to intervene, the relator may continue to proceed with the lawsuit on the government’s behalf. When a relator brings a qui tam action under the FCA, the defendant often will not be made aware of the lawsuit until the government commences its own investigation or makes a determination whether or not it will intervene.

If a defendant is found liable under the FCA, the defendant is subject to penalties for each separate false claim, plus up to three times the amount of damages caused by each false claim, which can be as much as the amounts received directly or indirectly from the government for each such false claim. These penalties are adjusted annually. A successful qui tam relator is entitled to receive a share of any settlement of judgment. In addition to civil enforcement under the FCA, the federal government can use several criminal statutes to prosecute persons who are alleged to have submitted false or fraudulent claims for payment to the federal government. It is difficult to predict how future enforcement initiatives may impact our business.

Stark Law and Similar State Laws

The Ethics in Patient Referrals Act, known as the Stark Law, prohibits certain types of referral arrangements between physicians and healthcare entities and thus potentially applies to our clients. The law prohibits a physician who has (or whose immediate family member has) a financial relationship with a provider from making referrals to that entity for “designated health services” if payment for the services may be made under Medicare or Medicaid. If such a financial relationship exists, referrals are prohibited unless a statutory or regulatory exception is available. Further, an entity that furnishes designated health services pursuant to a prohibited referral may not present or cause to be presented a claim or bill for such services to the Medicare program or to any other individual or entity. Violations of the Stark Law can result in civil monetary penalties and exclusion from federal healthcare programs and form the basis for liability under the FCA. Laws in many states similarly forbid billing based on referrals between individuals and entities that have various financial, ownership, or other business relationships. Any such violations by, and penalties and exclusions imposed upon, our clients could adversely affect their financial condition and, in turn, could adversely affect our own financial condition.

State Fraud and Abuse Laws

Many states, including certain states in which we conduct our business, have adopted fraud and abuse laws similar to the federal laws described above. These laws are enforced by state courts and regulatory authorities, each with broad discretion, and the scope of these laws and the interpretations of them vary by jurisdiction. Some state fraud and abuse laws apply to items and services reimbursed by any third party payor, including commercial insurers. For example, several states have anti-kickback and self-referral prohibitions, which may apply regardless of whether the payor for such claims is Medicare or Medicaid and which may affect our ability to enter into financial relationships with certain entities or individuals. A determination of liability under state fraud and abuse laws could result in fines, penalties, and restrictions on our ability to operate in these jurisdictions, administrative sanctions, exclusions from governmental healthcare programs, refund requirements, and disciplinary action by the applicable governmental authority, and could have a material adverse effect on our business, financial condition, results of operations, cash flows, and reputation.

Corporate Practice of Medicine; Fee Splitting

We enter into contracts with healthcare providers pursuant to which we provide them with software solutions, and may be subject to regulatory oversight, including corporate practice of medicine and fee- splitting prohibitions. Some states have enacted laws and regulations prohibiting business corporations from practicing medicine and limiting the extent to which physicians and certain other healthcare professionals may be employed by non-physicians or business corporations. These laws are intended to prevent interference in the medical decision-making process by anyone who is not a licensed physician. In addition, various state laws also generally prohibit the sharing or splitting professional services income or fees with lay entities or persons. Activities other than those directly related to the delivery of healthcare may be considered an element of the practice of medicine in many states. The scope and enforcement of such corporate practice of medicine and fee-splitting laws varies from state to state. Violations of these laws could require us to restructure our operations and arrangements and may result in penalties or other adverse action.

Some of these requirements may apply to us even if we do not have a physical presence in the state, based solely on our agreements with healthcare providers licensed in the state. Governmental or regulatory authorities or other parties may assert that we are engaged in the corporate practice of medicine or that our contractual arrangements with healthcare providers constitute unlawful fee splitting. In this event, failure to comply could lead to adverse judicial or administrative action against us and/or our healthcare provider clients, civil or criminal penalties, receipt of cease and desist orders from state regulators, the need to make changes to our contracts, and other materially adverse consequences.

Government Regulation of Reimbursement

Our clients are subject to regulation by a number of governmental agencies, including those that administer the Medicare and Medicaid programs. Accordingly, our clients are sensitive to legislative and regulatory changes in, and limitations on, the government healthcare programs and changes in reimbursement policies, processes, and payment rates. Our clients may also be impacted by recent or future federal government cost-cutting and efficiency measures and any actual or potential reduction in the federal workforce that administers federal healthcare programs. During recent years, there have been numerous federal legislative and administrative actions that have affected government programs, including adjustments that have reduced or increased payments to physicians and other healthcare providers. It is possible that the federal or state governments will implement additional reductions, increases or changes in reimbursement or that there will be substantial changes to federal healthcare programs or other government programs or spending that adversely affect our clients, or our cost of providing our solutions. Any such changes could adversely affect our own financial condition by reducing the reimbursement rates of our clients or otherwise materially impacting our clients.

Consumer Protection Laws

We may also be subject to both federal and state regulatory agencies who have the authority to investigate consumer complaints relating to a variety of consumer protection laws, including but not limited to the Fair Debt Collections Practices Act (the “FDCPA”), the Telephone Consumer Protection Act (the “TCPA”), the Controlling the Assault of Non- Solicited Pornography and Marketing Act of 2003 (the “CAN-SPAM Act”), and any state equivalent(s) of the foregoing. Our business practices involve assisting clients in collecting non-defaulted amounts owed by patients for current and prior services activities, which may subject us to the FDCPA. The FDCPA restricts the methods we may use to contact and seek payment from patients regarding past due accounts. Many states impose additional requirements on debt collection practices, and some of those requirements may be more stringent than the federal requirements. Moreover, regulations governing debt collection are subject to changing interpretations that may be inconsistent among different jurisdictions. Such laws and regulations, if deemed to apply to us, are continually evolving and any enforcement actions under such laws could result in fines, penalties, litigation, and increased expenses associated with compliance.

Indemnification and Insurance

Our business exposes us to potential liability including, but not limited to, potential liability for breach of contract or negligence claims by our clients, non-compliance with applicable laws and regulations, and employment-related claims. In certain circumstances, we may also be liable for the acts or omissions of others, such as our vendors or suppliers. On occasion, we enter into standard indemnification arrangements in the ordinary course of business. Pursuant to these arrangements, we indemnify, hold harmless, and agree to reimburse the indemnified parties for losses suffered or incurred by the indemnified party, in connection with any trade secret, copyright, patent, or other intellectual property infringement claim by any third-party with respect to its technology. The terms of these indemnification agreements are generally perpetual. Maximum potential future payments we could be required to make under these agreements is not determinable because it involves claims that may be made against us in the future but have not yet been made. We have not incurred costs to defend lawsuits or settle claims related to these indemnification agreements.

We attempt to manage our potential liability to third-parties through contractual protection (such as indemnification and limitation of liability provisions) in our contracts with clients and others, and through insurance. The contractual indemnification provisions vary in scope and may not protect us against all potential liabilities, such as liability arising out of our gross negligence or willful misconduct. In addition, in the event that we seek to enforce such an indemnification provision, the indemnifying party may not have sufficient resources to fully satisfy its indemnification obligations or may otherwise not comply with its contractual obligations.

We may require our clients and other counterparties to maintain adequate insurance, and we currently maintain errors, omissions, and professional liability insurance coverage with limits we believe to be appropriate. The coverage provided by such insurance may not be adequate for all claims made and such claims may be contested by applicable insurance carriers.

Corporate and Available Information

We were originally incorporated in Delaware on August 13, 2019 and subsequently changed our name to Waystar Holding Corp. on August 11, 2023. Our principal offices are located at 1550 Digital Drive, #300, Lehi, Utah 84043 and 9901 Linn Station Road, Louisville, Kentucky 40223. Our telephone number is (844) 492-9782. We maintain a website at waystar.com. We completed our initial public offering (“IPO”) in June 2024 and our common stock is listed on the Nasdaq Global Select Market (“Nasdaq”) under the symbol “WAY”.

Waystar’s Annual Report on Form 10-K reports, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and all amendments to those reports filed with or furnished to the SEC pursuant to Section 13(a) or 15(d) of the Exchange Act, are publicly available free of charge on the Investor Relations section of our website at investors.waystar.com or at www.sec.gov as soon as reasonably practicable after these materials are filed with or furnished to the SEC. We also make available through the Investor Relations Section of our website other reports filed with or furnished to the SEC under the Exchange Act, including our proxy statements and reports filed by officers and directors under Section 16(a) of the Exchange Act, as well as our Code of Conduct, Corporate Governance Guidelines and Board committee charters.

Investors and others should note that we routinely announce financial and other material information using our Investor Relations website, SEC filings, press releases, public conference calls and webcasts. We use these channels of distribution to communicate with our investors and members of the public about our company, our services and other items of interest. Information contained on our website is not part of this report or our other filings with the SEC. The information on our website (or any webpages referenced in this Annual Report on Form 10-K) is not part of this or any other report Waystar files with, or furnishes to, the SEC.

​

Item 1A.Risk Factors

You should carefully consider the following risk factors as well as the other information set forth in this Annual Report on Form 10-K (this “Annual Report”), including “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and related notes thereto. If any of the following risks actually occurs, our business, results of operations, prospects, and financial condition may be materially adversely affected. In such case, the trading price of our common stock could decline and you may lose all or part of your investment. The risks and uncertainties described below are those that we have identified as material but are not the only risks and uncertainties we face. Our business is also subject to general risks and uncertainties that affect many other companies, including but not limited to overall economic and industry conditions and additional risks not currently known to us or that we presently deem immaterial may arise or become material and may negatively impact our business, reputation, financial condition, results of operations, or the trading price of our common stock. Some statements in this Annual Report, including statements in the following risk factors, constitute forward-looking statements. See “Cautionary Statement Concerning Forward-Looking Statements.”

Risks Related to our Business and our Industry

We operate in a highly competitive industry.

We operate in a highly fragmented and competitive market that is characterized by rapidly evolving technology standards, evolving regulatory requirements, and frequent changes in client needs and introduction of new products and solutions. Our competitors range from smaller niche companies to large, well-financed, and technologically-sophisticated entities, including EHR and PM, with which we integrate. The increasing standardization of certain healthcare IT products and solutions has made it easier for companies to enter our industry with, or expand their product offerings to include, competitive products and solutions. Many software, hardware, information systems, and business process outsourcing companies, both with and without healthcare companies as their partners, offer or have announced their intention to offer products or solutions that are competitive with products and solutions that we offer. In particular, well- funded large technology companies are increasingly entering the revenue cycle technology market. In addition, EHR and PM providers (including those with which we integrate) could expand their product offerings to include solutions that compete directly with the solutions we provide. Some of these EHR and PM systems already offer, or may begin to offer, solutions that compete with our platform, including claim management and patient management solutions, payment processing tools, and direct patient communication solutions. Further, we expect that competition will continue to increase as a result of consolidation in both the technology and healthcare industries.

We compete on the basis of several factors, including breadth, depth, and quality of products and solutions, ability to deliver financial and operational performance improvement through the use of products and solutions, quality and reliability of solutions, ease of use and convenience, brand recognition, price, and the ability to integrate our platform solutions with various EHR and PM systems and other new and existing technology, including AI. Some of our competitors have greater name recognition, longer operating histories, lower cost products and solutions, and significantly greater resources than we do. As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards, or client requirements. In addition, current and potential competitors have established, and may in the future establish, strategic relationships with vendors of complementary products, solutions, technologies, or services to increase the availability of their products to the marketplace. Our competitors may have greater market share, larger client bases, more widely adopted proprietary technologies, greater marketing expertise, greater financial resources, and larger sales forces than we have, which could put us at a competitive disadvantage.

Additionally, the pace of change in the revenue cycle technology market is rapid and there are frequent new solution introductions, solution enhancements, and evolving industry standards and requirements. We cannot guarantee that we will be able to upgrade our existing products and solutions, or introduce new products and solutions at the same rate as our competitors, or at all, nor can we guarantee that upgrades or new products and solutions will achieve market acceptance over or among competitive offerings, or at all.

We also may be subject to pricing pressures as a result of competition within the industry, among other factors. If we reduce our pricing in response to competitive pressure, our margins and results of operations will be adversely affected. Conversely, if we do not reduce our pricing, we could lose clients and be unable to attract new clients to our platform, which would adversely affect our business and our results of operations.

These competitive pressures could have a material adverse impact on our business, financial condition, and results of operations.

We must retain our existing clients and attract new clients.

Our business substantially depends on our ability to retain our existing clients and attract new clients. We expect to derive a significant portion of our revenue from renewal of existing clients’ contracts and sales of additional products and solutions to existing clients. As a result, achieving a high client retention rate, expanding within existing clients, and selling additional products and solutions are critical to our revenue. In addition, our ability to increase our client base will be critical to our future growth. In order to retain existing clients and attract new clients, we must provide solutions that enable our existing and prospective clients to simplify and improve the payment process, increase speed and efficiencies, and deliver exceptional client service.

Factors that may affect our client satisfaction, our ability to sell additional products and solutions to existing clients, and expand our client base include, but are not limited to, the following:

Our clients have no obligation to renew their subscriptions for our platform solutions after the initial term expires, which is typically a two to three-year term. Our contracts generally provide for the automatic renewal for one-year subsequent terms, with the ability for our clients to terminate the contract with limited notice to us. Our clients’ renewal rates may fluctuate or decline because of several factors, including their satisfaction or dissatisfaction with our solutions and support, the prices of our solutions as compared to our competitors’ pricing, or reductions in our clients’ spending levels due to the macroeconomic environment or other factors. In addition, our clients may negotiate terms less advantageous to us upon renewal, which may reduce our revenue from these clients and may decrease our annual revenue. If our clients notify us of intent not to renew, renew their contracts upon less favorable terms, or at lower fee levels or fail to purchase new products and solutions from us, our revenue may decline, or our future revenue growth may be constrained.

We must be able to successfully execute on our business strategies in order to grow.

Our growth strategies include expanding our relationships with existing clients, growing our client base, deepening and expanding our relationships with strategic channel partners, innovating and developing adjacent solutions, and selectively pursuing strategic acquisitions. We are actively identifying growth and expansion opportunities in new markets, technology, or offerings, as well as exploring opportunities to increase our existing client base and cross-sell and upsell to our existing clients. To successfully execute on our growth initiatives, we will need to, among other things, successfully identify and execute on those opportunities and successfully identify, acquire, and integrate complementary businesses. We must also manage changing business conditions, anticipate and react to changes in the regulatory environment, and develop expertise in areas outside of our business’s historical core competencies. In addition, our future financial results will depend in part on our ability to profitably manage our business in new markets that we may enter. Failure to successfully address any of the foregoing risks could have a significant negative impact on our business, financial condition, and results of operations.

We must accurately assess the risks related to acquisitions and successfully integrate acquired businesses.

We have historically acquired, and in the future may acquire, businesses, technologies, product lines, and other assets. The successful integration of any businesses and assets we have acquired or may acquire may be critical to our business and growth strategy.

The amount and timing of the expected benefits of any acquisition, including potential synergies, are subject to risks and uncertainties. These risks and uncertainties include, but are not limited to, those relating to:

We cannot guarantee that any acquired businesses, technologies, services, product lines, or other assets will be successfully integrated with our operations in a timely or cost-effective manner, or at all. Failure to successfully integrate acquired businesses or to achieve anticipated operating synergies, revenue enhancements, or cost savings could have a material adverse impact on our business, results of operations, or financial condition. Although we attempt to evaluate the risks inherent in each transaction and evaluate acquisition candidates appropriately, we may not properly ascertain all risks and the acquired businesses or other assets may not perform as expected or enhance our value as a whole. Acquired businesses also may have larger than expected liabilities that are not covered by the indemnification, if any, that we are able to obtain from the sellers. If we are unable to successfully complete and integrate strategic acquisitions in a timely manner, our business and growth strategies could be negatively affected.

Our business depends on our ability to establish and maintain strategic relationships.

We depend on strategic relationships, and if we lose any of these strategic relationships or fail to establish additional relationships, or if our relationships fail to benefit us as expected, this could materially and adversely impact our business, financial condition, and operating results. For example, our solutions are integrated with many EHR and PM solutions offered by providers with whom we have a strategic relationship. Our ability to form and maintain these relationships in order to facilitate the integration of our platform into the EHR and PM systems used by our clients and their patients is important to the success of our business. If providers of EHR or PM solutions amend, terminate, or fail to perform their obligations under their agreements with us, we may need to seek other ways of integrating our platform with the EHR and PM systems of our clients, which could be costly and time consuming, and could adversely affect our business results.

In addition, we have entered into contracts with channel partners to market and sell certain of our solutions, which are generally on a non-exclusive basis. However, under contracts with some channel partners, we may be bound by provisions that restrict our ability to market and sell solutions to potential clients. Our arrangements with some of these channel partners involve negotiated payments to them based on percentages of revenue our common clients generate. These arrangements subject us to federal and state healthcare laws and regulations. For more information regarding risks related to such laws and regulations, see Part I, Item 1A, “Risk Factors—Risks Related to Legal and Governmental Regulation—We conduct business in a heavily regulated industry.” Additionally, if the payments prove to be too high, we may be unable to realize acceptable margins, but if the payments prove to be too low, channel partners may not be motivated to work with us at the levels initially contemplated. The success of these partnerships will depend in part upon the channel partners’ own competitive, marketing, and strategic considerations, including the relative advantages of using alternative solutions being developed and marketed by them or by competitors. If channel partners are unsuccessful in marketing our solutions or seek to amend the terms of their contracts, we may need to broaden our marketing efforts and alter our strategy, which may divert planned efforts and resources from other projects and may increase our costs. In addition, as part of the packages these channel partners sell, they may offer a choice to end-users between our solutions and similar solutions offered by competitors or by the channel partners directly. If our solutions are not chosen or renewed by existing channel partner end-users, revenue we earn via our channel partner relationships will decrease. Significant changes in the terms of our agreements with channel partners may also have an adverse effect on our ability to successfully market our solutions.

Our revenues rely, in part, on the growth and success of our clients and overall healthcare transaction volumes, which are subject to factors outside of our control.

We enter into agreements with our clients, under which a significant portion of our fees may be variable, including fees which are dependent upon the number of add-on features that our clients choose to subscribe to and the utilization of our solutions. These fees, above contractual minimums, are generally not required to be paid in the absence of healthcare transactions. Therefore, if there is a general reduction in patient visits, it may result in a reduction in fees generated from our clients or a reduction in the number of add-on features subscribed for by our clients. Our revenue can also be adversely affected by the impact of lower than normal healthcare utilization trends and other negative economic factors such as higher unemployment. For example, weakened economic conditions or a recession could reduce the amounts patients are willing or able to spend on healthcare services. Further, the number of patients utilizing our patient payment solutions, and the amounts those patients pay directly to our clients for services, is often impacted by factors outside of our control, such as the number of patients with high deductible health plans. The growth and success of our clients could also be impacted by changes in governmental policies and regulations, such as reductions or changes in reimbursement under government programs that adversely affect our clients, or our cost of providing our solutions, recent or future federal government cost-cutting and efficiency measures, actual or potential reductions in the federal workforce that administers government programs, other substantial changes to federal healthcare programs or government spending that adversely affect our clients, and the creation of any future government single-payer system, which would have a significant adverse impact on our business.

For these reasons, revenue under these agreements can be uncertain and unpredictable, and if the associated transaction volumes were reduced by a material amount, such decrease would lead to a decrease in our revenue, which could harm our business, financial condition, and results of operations.

Consolidation in the healthcare industry could adversely impact our business, financial condition, and operating results.

Many healthcare provider organizations are consolidating to create integrated healthcare delivery systems with greater market power. As provider networks and managed care organizations consolidate, thus decreasing the number of market participants, competition to provide products and solutions like ours will become more intense, and the importance of establishing and maintaining relationships with key industry participants will increase. These industry participants may try to use their market power to negotiate price reductions for our products and solutions. Further, consolidation of management and billing services through integrated delivery systems may decrease demand for our products. Such consolidation may also lead integrated delivery systems to require newly acquired physician practices to replace our product with that already in use in the larger enterprise. In addition, vertical integration whereby healthcare provider organizations acquire EHR, PM, revenue management cycle, or similar systems may make it more challenging to establish new relationships with such providers or may lead to such provider organizations replacing our solutions with those offered by systems that they acquire. Any of these factors could materially and adversely impact our business, financial condition, and operating results.

We face a selling cycle of variable length to secure new client agreements.

We face a selling cycle of variable length, which can span from weeks to 18 months or longer, to secure a new agreement with a client. We invest a substantial amount of time and resources on our sales efforts without any assurance that our efforts will produce sales. Even if we succeed at completing a sale, we may be unable to predict the size of the initial arrangement until very late in the sales cycle. We expend time and resources as part of our sales effort, and we may not recognize any revenue to offset such expenditures in the same period, particularly for longer sales cycles. We cannot accurately predict the timing of entering into agreements with new clients due to the complex procurement decision processes of many healthcare providers, which often involves high-level management or board committee approvals that can be delayed due to factors beyond our and their control. Due to our variable selling cycle length, we have only a limited ability to predict the timing of specific new client relationships, which affects our ability to predict future revenues and cash flows.

We face an implementation cycle that is dependent on our clients’ timing and resources.

We face an implementation cycle that is dependent on our clients’ timing, which may pose scheduling challenges, and our clients’ resources, which may be constrained or significantly diverted to larger projects, each of which can impact timing of implementation of our solutions. Providers are faced with labor-intensive, manual tasks as well as disconnected systems and tools, compounded by broad workforce shortages and high staff turnover rates, which can further limit their resources and ability to implement our solutions. Implementation of our solutions may also require other technology implementation or process changes by the client. If implementation periods are delayed or extended, our ability to generate revenue from these solutions would also be delayed even though we have expended time and resources in the implementation of such solutions. Even if implementation has begun, there can be no assurance that we will recognize revenue on a timely basis or at all from our efforts, and any revenue may not be recognized during the same period in which we incur implementation expenses.

We depend on our senior management team and certain key employees and must continue to attract and retain highly skilled employees.

Our success depends, in part, on the skills, working relationships, and continued services of Matthew Hawkins (our Chief Executive Officer), the senior management team, and other key personnel. From time to time, there may be changes in our senior management team resulting from the hiring or departure of executives, which could disrupt our business. In addition, our hybrid work environment could make it difficult to manage our business and adequately oversee our employees and business functions, potentially resulting in harm to our company culture, increased employee attrition, and the loss of key personnel.

We must attract, train, and retain a significant number of highly skilled employees, including sales and marketing personnel, client support personnel, professional services personnel, software engineers, technical personnel, and management personnel, and the availability of such personnel, in particular software engineers, may be constrained. We also believe that our future growth will depend on the continued development of our direct sales force and its ability to obtain new clients and to manage our existing client base. If we are unable to hire and develop sufficient numbers of productive direct sales personnel or if new direct sales personnel are unable to achieve desired productivity levels in a reasonable period of time, sales of our products and solutions will suffer and our growth will be impeded.

Competition for qualified management and employees in our industry is intense and identifying and recruiting qualified personnel and training them requires significant time, expense, and attention. Many of the companies with which we compete for personnel have greater financial and other resources than we do. While we have entered into offer letters or employment agreements with certain of our executive officers, all of our employees are “at-will” employees, and their employment can be terminated by us or them at any time, for any reason, and without notice, subject, in certain cases, to severance payment rights. The departure and replacement of one or more of our executive officers or other key employees would likely involve significant time and costs, may significantly delay or prevent the achievement of our business objectives, and could materially harm our business. In addition, volatility or lack of performance in our stock price may affect our ability to attract replacements should key personnel depart.

The estimates and assumptions we use to determine the size of our total addressable market may prove to be inaccurate.

Market estimates and growth forecasts that we disclose are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate. The estimates and forecasts relating to the size and expected growth of the market for our products and solutions may prove to be inaccurate. These estimates and forecasts may be impacted by economic uncertainty that is outside our control, including macroeconomic trends such as domestic supply chain risks, inflationary pressure, interest rate increases, and declines in consumer confidence that impact our clients. While we believe the information on which we base our total addressable market and the underlying estimates and assumptions is generally reliable, such information is inherently imprecise. We cannot assure you that these assumptions will prove to be accurate.

Risks Related to our Products and Solutions

We may not be able to develop and market new solutions, or enhance our existing solutions, to respond to technological changes or evolving industry standards.

The markets in which we operate are characterized by rapid technological and regulatory change, evolving industry standards, and increasingly sophisticated client needs. For example, from time to time, government agencies may alter format and data code requirements applicable to electronic transactions. In addition, clients may request that solutions be customized to satisfy particular security protocols, modifications, and other contractual terms in excess of industry norms and standard configurations. In order to compete successfully, we must keep pace with our competitors in anticipating and responding to these rapid changes and evolving client demands. Our future success will depend, in part, upon our ability to enhance and improve the functionality of our existing solutions (including the successful continued deployment of the use of AI in our products and solutions) and develop and introduce in a timely manner or acquire new solutions that keep pace with technological and regulatory developments and industry requirements, satisfy increasingly sophisticated client requirements, and achieve market acceptance. Because some of our solutions are complex and require rigorous testing, development cycles can be lengthy, depending upon the solution and other factors. Our estimates of research and development expenses may be too low, our revenue may not be sufficient to support the future product development that is required for us to remain competitive, and development cycles may be longer than anticipated. Further, there is no assurance that research and development expenditures will lead to successful solutions or enhancements to our existing solutions. In addition, technological advances also may result in the downward pricing pressures, which could result in us losing sales unless we lower the prices we charge or provide additional efficiencies or capabilities to the client.

In addition, because some of the software and systems that we use to provide solutions to clients are inherently complex, changing, updating, enhancing, or creating new versions of our solutions or the software or systems we use to provide our solutions introduces a risk of errors or performance problems. These updates and enhancements also require training and support to effectively implement, and our clients may have difficulties doing so. If significant problems occur as a result of these changes, we may fail to meet our contractual obligations to clients, which could result in claims being made against us or in the loss of client relationships.

If we are unable, for technological or other reasons, to develop or acquire on a timely and cost-effective basis new software solutions or enhancements to existing solutions or if such new solutions or enhancements do not achieve market acceptance or are not properly implemented, or if new technologies emerge that are able to deliver competitive offerings at lower prices, more efficiently, more conveniently, or more securely than our offerings, our business, financial condition, and results of operations could be adversely affected.

Our business depends on the interoperability, connectivity, and integration of our solutions with our clients’ and their vendors’ networks and infrastructures.

Our solutions must interoperate, connect, and integrate with our clients’ and their vendors’ existing infrastructures, which often have different specifications, utilize multiple protocol standards, deploy products and solutions from multiple vendors, and contain multiple generations of products that have been added to that infrastructure over time. Some of the technologies supporting our clients and their vendors are constantly evolving and we must continue to adapt to these changes in a timely and effective manner at an acceptable cost. In addition, our clients and their vendors may implement new technologies into their existing networks and systems infrastructures that may not immediately interoperate with our solutions. Our continued success will depend on our ability to adapt to changing technologies, manage, and process ever- increasing amounts of data and information and improve the performance, features, and reliability of our solutions in response to changing client and industry demands. If we encounter complications related to network configurations or settings, we may have to modify our solutions to enable them to interoperate with our clients’ and their vendors’ networks and manage clients’ transactions in the manner intended. For example, if clients or their vendors implement new encryption protocols, it may be necessary for us to obtain a license to implement or interoperate with such protocols, and there can be no assurance that we will be able to obtain such a license on acceptable terms, if at all. On the other hand, any new or enhanced technologies that we employ must be accepted by our clients’ and their vendors’ existing infrastructures and be able to be integrated with their platforms and solutions. For example, we use automated software applications or “bot” technology and Application Interface (“API”) technology in a number of our solutions. Certain of our clients’ platforms may not support those technologies or functionalities for various reasons, which would adversely impact connectivity of our solutions. Any of these difficulties could delay or prevent the successful design, development, testing, introduction, or marketing of our solutions.

Further, because our solutions are interoperated and integrated, any disruption to our clients’ and their vendors’ networks and infrastructures, such as those of the EHR and PM vendors of our clients, could cause our solutions to become unavailable.

As a consequence of any of the foregoing, our ability to sell our solutions may be impaired, which could have a material adverse impact on our business, results of operations, or financial condition.

The successful operation of our business depends upon the performance and reliability of internet, mobile, and other infrastructure, none of which are under our control.

Our business and ability to provide our products and solutions is highly dependent upon the reliable performance of our platform and the underlying network and server infrastructure, including the performance and reliability of internet, mobile, and other infrastructures that are not under our control. This includes maintenance of a reliable network backbone with the necessary speed, data capacity, and security for providing reliable internet access and services and reliable mobile device, and telephone all at a predictable and reasonable cost. We have experienced and expect that we will experience interruptions and delays in services and availability from time to time.

We serve our clients primarily from third-party data-hosting facilities. These facilities are vulnerable to damage or interruption from earthquakes, floods, fires, power loss, telecommunications failures, and similar events. They are also subject to break-ins, sabotage, intentional acts of vandalism, and similar misconduct. Their systems and servers could also be subject to software and hardware errors, hacking, ransomware, viruses, and other disruptive problems or vulnerabilities. Despite precautions taken at these facilities, the occurrence of a natural disaster or an act of terrorism, a decision to close the facilities without adequate notice, or other unanticipated problems at the facilities could result in lengthy interruptions in our solutions. Although we have instituted disaster recovery arrangements, in certain cases, we do not maintain redundant systems or facilities. In the event of a catastrophic event, we may experience an extended period of system unavailability, which could negatively impact our relationship with users or clients.

Any disruption in network access or telecommunications could significantly harm our business. Almost all access to the internet is maintained through telecommunication operators who have significant market power that could take actions that degrade, disrupt, or increase the cost of users’ ability to access our platform. Disruptions in internet infrastructure, cloud-based hosting, or the failure of telecommunications network operators to provide us with the bandwidth we need to provide our products and solutions could temporarily disrupt or shut down our business. The insurance coverage under our policies may not be adequate to compensate us for all losses that may occur. In addition, we cannot provide assurance that we will continue to be able to obtain adequate insurance coverage at an acceptable cost.

Further, the reliability and performance of the internet may be harmed by increased usage or by denial- of-service attacks. The internet has experienced a variety of outages and other delays as a result of damages to portions of its infrastructure, and it could face outages and delays in the future. These outages and delays could reduce the level of internet usage as well as the availability of the internet to us for delivery of our products and solutions. Finally, recent changes in law could impact the cost and availability of necessary internet infrastructure. Increased costs and/or decreased availability would negatively affect our results of operations.

Our business would be adversely affected if we cannot obtain, process, use, disclose, or distribute the highly regulated data we require to provide our solutions.

Our business relies in part on our ability to obtain, process, monetize, use, disclose, and distribute highly regulated data in the healthcare and technology industries in a manner that complies with applicable laws, regulations, and contractual and technological restrictions. The failure by us or our data suppliers, processors, partners, and vendors to obtain, provide, maintain, use, and disclose data in a compliant manner could have a harmful effect on our ability to use and disclose data which in turn could impair our functions and operations, including our ability to share data with third parties or incorporate it into our product offerings. In addition, the processing, use, disclosure, and distribution of data may require us or our data suppliers, processors, partners, and vendors to obtain consent from third parties or follow additional laws, regulations, or contractual and technological restrictions that apply to the healthcare industry. These requirements could interfere with or prevent creation or use of rules and analyses or limit other data-driven activities that benefit us. Moreover, due to lack of valid notice, permission, authorization, consent, or waiver, we may be subject to claims or liability for use or disclosure of information. We have policies and procedures in place to address the proper handling, use, and disclosure of data, but could face claims that our practices occur in a manner not permitted under applicable laws or our agreements with or obligations to data providers, individuals, or other third parties. These claims or liabilities and other failures to comply with applicable requirements could damage our reputation, subject us to unexpected costs, and could have a material adverse impact on our business, results of operations, or financial condition. See Part I, Item 1A, “Risk Factors—Risks Related to Information Technology Systems, Cybersecurity, Data Privacy, and Intellectual Property—Privacy concerns or security breaches or incidents relating to our platform could result in economic loss, damage to our reputation, deter users from using our products, expose us to legal penalties and liability, and otherwise adversely affect our business” and Part I, Item 1A, “Risk Factors—Risks Related to Legal and Governmental Regulation—We are subject to health care laws and data privacy and security laws and regulations governing our Processing of personal information, including PHI, personal health records, and payment card data.”

Additionally, to the extent we are permitted to de-identify personal information, including PHI, and use and disclose such de-identified information for our purposes, we must determine whether such PHI has been sufficiently de-identified to comply with our contractual obligations and the privacy standards under HIPAA. Such determinations may require complex factual and statistical analyses and may be subject to interpretation. Accordingly, we may be subject to claims or liability for failure to sufficiently de-identify data to comply with the HIPAA privacy standards and our contractual obligations. These claims or liabilities could damage our reputation, subject us to unexpected costs and could have a material adverse impact on our business, results of operations, or financial condition. If we are unable to properly protect the privacy and security of PHI entrusted to us, we could be found to have breached our contracts with our clients and be subject to investigation by the OCR, or other governmental or regulatory authorities. In the event OCR or other governmental or regulatory authorities find that we have failed to comply with applicable privacy and security standards, we could face civil and criminal penalties. Additionally, in recent years, consumer advocates, media, and elected officials increasingly and publicly have criticized companies in data-focused industries regarding the Processing of personal information, including the licensing of de-identified information, by such companies. Concerns about our practices with regard to the Processing or security of PHI, personal information, the licensing of de-identified information, or other privacy related matters, even if unfounded, could damage our reputation and adversely affect our business, results of operations, or financial condition.

We rely on certain third-party vendors and providers.

We have entered contracts with third-party providers to provide critical services relating to our business, including clearinghouse systems and payment processing services. We primarily use clearinghouse systems for our claims and payer payment management solutions to facilitate data exchanges between providers and payors in connection with the reimbursement process, and use payment processing services in our patient financial care solutions to facilitate patient payments to their providers. We also rely on third-party data providers to enable us to deliver automated eligibility and benefits verification as part of our financial clearance solutions, as well as third parties who print and deliver paper statements to patients as part of our patient financial care solution. We also use various third-party vendors, such as software as a service and infrastructure as a service, cybersecurity solutions, and cloud based hosting of our proprietary solutions. We rely on hosted software as a service applications from third parties to operate critical functions of our business, including enterprise resource planning, order management, contract management billing, accounting, human resources, and other operational activities. We also rely third parties with respect to internet, mobile, and other infrastructure as described under “—The successful operation of our business depends upon the performance and reliability of internet, mobile, and other infrastructure, none of which are under our control” below.

Our dependence on these third parties to support key functions of our business creates numerous risks, in particular, the risk that we may not maintain service quality, control, or effective management with respect to these operations, which, among other things, could result in our inability to meet certain obligations to our clients. For example, if our clearinghouse partners experience a disruption to their system, this could significantly adversely impact the availability and functionality of our claims management suite and, among other things, could cause us to be in breach of certain client contracts. In the event that these service providers fail to maintain adequate levels of support, do not provide high quality service, increase the fees they charge us, discontinue their lines of business, terminate our contractual arrangements, or cease or reduce operations, we may suffer additional costs and be required to pursue new third-party relationships, which could materially disrupt our operations and our ability to provide our products and solutions, divert management’s time and resources, and cause us to fail to meet required service levels stipulated in our client contracts.

Our reputation and our clients’ willingness to purchase our products and partners’ willingness to use our products depend, in part, on our third-party providers’ compliance with ethical employment practices, such as with respect to child labor, wages and benefits, forced labor, discrimination, safe and healthy working conditions, and with all legal and regulatory requirements relating to the conduct of their businesses. If our third-party providers fail to comply with applicable laws, regulations, safety codes, employment practices, human rights standards, quality standards, environmental standards, production practices, or other obligations, norms, or ethical standards, our reputation and brand image could be harmed and we could be exposed to litigation and additional costs that would harm our business, reputation, and results of operations. The ability of our third-party providers to effectively satisfy our business requirements could also be impacted by financial difficulty of our third-party providers or damage to their operations caused by fire, terrorist attack, natural disaster, or other events.

Any termination of our agreements with, or disruption in the performance of, one or more of these service providers could result in disruption or unavailability of our platform, and harm our ability to continue to develop, maintain, and improve our products, as well as harm our brand and reputation. While we have entered into agreements with these third-party service providers, they have no obligation to renew their agreements on similar terms or on terms that we find commercially reasonable, or at all. Identifying replacement third-party service providers, and negotiating agreements with them, requires significant time and resources. If any one of our material third-party service provider’s ability to perform their obligations was impaired, we may not be able to find an alternative supplier in a timely manner or on acceptable financial terms, and we may not be able to meet the full demands of our clients within the time periods expected, or at all.

Any errors or malfunctions in our products and solutions could result in liability to our clients.

Our products and solutions are used to help simplify the payment process for healthcare providers. If our products and solutions fail to provide accurate and timely information or are associated with errors or malfunctions, then our clients could assert claims against us that could result in substantial costs to us, harm our reputation in the industry, and cause demand for our products and solutions to decline. Although we attempt to limit by contract our liability for damages, the allocations of responsibility and limitations of liability set forth in our contracts may not be enforceable or may not otherwise sufficiently protect us from liability for damages. In certain circumstances, we may also be liable for the acts or omissions of others, such as our vendors or suppliers. On occasion, we enter into standard indemnification arrangements in the ordinary course of business. Pursuant to these arrangements, we indemnify, hold harmless, and agree to reimburse the indemnified parties for losses suffered or incurred by the indemnified party, in connection with any trade secret, copyright, patent, or other intellectual property infringement claim by any third-party with respect to its technology. The terms of these indemnification agreements are generally perpetual. See Part I, Item 1, “Business—Indemnification and Insurance.”

Moreover, our products and solutions may contain defects, errors, bugs, vulnerabilities, or failures that are not detected until after the software is introduced or updates and new versions are released. From time to time we have discovered defects, errors, bugs, vulnerabilities, or failures in our software, and such defects, errors, bugs, vulnerabilities, or failures can be expected to occur in the future. Defects, errors, bugs, vulnerabilities, or failures that are not timely detected and remedied could expose us to risk of liability to our clients and cause delays in introduction of new solutions, result in increased costs and diversion of development resources, require design modifications, decrease market acceptance or client satisfaction with our solutions, and harm our brand and reputation.

In addition, we create rules within our products and solutions based on payers’ authorization policy documents, and which may be used for financial recovery by our clients. These policies and related legal requirements can be complex and are subject to frequent changes. If such rules are inaccurate or contain errors, or if we fail to timely update our rules to reflect any changes in policies or requirements, then we may be subject to liability. If any of these risks occur, they could materially adversely affect our business, financial condition, or results of operations.

Failure by our clients to obtain proper permissions or provide us with accurate and appropriate information may result in claims against us or may limit or prevent our use of information.

To the extent we are not otherwise permitted to use and/or disclose client information, we require our clients to provide necessary notices and obtain necessary permissions, consents, and authorizations for the use and disclosure of the information that we receive from our solutions. We then provide patient information to third parties, pursuant to patient permissions, consents, and authorizations that permit the third parties to collect such information, and such patient information may be aggregated or combined with other data sources to gain additional insights from such patient information. Such patient information may also be anonymized/de-identified and sold to or collected by a data aggregator.

If our clients do not provide necessary notices or obtain necessary permissions, consents, or authorizations, then our use and disclosure of information that we receive from them or on their behalf may be limited or prohibited by federal or state privacy or other laws. Such failures by our clients could impair our functions, processes, and databases that reflect, contain, or are based upon such information. In addition, such failures by our clients could interfere with or prevent creation or use of rules, analyses, or other data-driven activities that benefit us or make our solutions less useful. Accordingly, we may be subject to claims or liability for inaccurate claims data submitted to payers, inaccurate or incomplete billing and coding claims or for use or disclosure of information by reason of lack of valid notice, permission, consent, or authorization. These claims or liabilities could damage our reputation, subject us to unexpected costs, and could have a material adverse impact on our business, results of operations, or financial condition.

Certain of our solutions present the potential for embezzlement, identity theft, or other similar illegal behavior by our employees or vendors and a failure of our employees or vendors to observe quality standards or adhere to environmental, social, and governance standards could damage our reputation.

As a payments facilitator, we handle payments from payers and from patients for many of our provider clients and are in possession of payment card information and banking account information. Even when we do not facilitate payments, our solutions also involve the use and disclosure of personal and business information that could be used to impersonate third parties or otherwise gain access to their data or funds. If any of our employees or vendors or other bad actors does not comply with the law or engages in unethical conduct, such as taking, converting, or misusing funds, documents, or information, or if we experience a data breach creating a risk of identity theft, we could be liable for damages, and our reputation could be damaged or destroyed.

In addition, we could be perceived to have facilitated or participated in illegal misappropriation of funds, documents, or data and, therefore, be subject to civil or criminal liability. Federal and state regulators may take the position that a data breach or misdirection of data constitutes an unfair or deceptive act or trade practice. We also may be required to notify individuals affected by any data breaches. Further, a data breach or similar incident could impact the ability of our clients that are creditors to comply with the federal “red flags” rules, which require the implementation of identity theft prevention programs to detect, prevent, and mitigate identity theft in connection with client accounts. Any such data breach could have an adverse impact on our business, results of operations, and reputation.

We must comply with the applicable rules of the National Automated Clearing House Association (“NACHA”), and we, our clients, and our sales partners must comply with the applicable requirements of card networks.

We provide payments solutions for the secure processing of patient payments. Our payment processing tools can connect to multiple financial services providers and acquiring banks and can also connect directly with patients. We have developed partnerships with ACH operators and primary credit card processors to facilitate payment processing as a third-party sender for patient payments as well as funds disbursements to healthcare providers, and we are registered with numerous card networks as a service provider (payment facilitator or the equivalent) for acquiring banks. The NACHA and these card networks set the operating rules and standards with which we must comply. The termination of our status as a third-party sender or a decision by NACHA to bar us from serving as such, the termination of our status as a certified service provider or a decision by the card networks to disallow payment facilitators or bar us from serving as such, or any changes in NACHA or card network rules or standards, including interpretation and implementation of the operating rules or standards, that increase the cost of doing business or limit our ability to provide payment processing solutions to our clients, could adversely affect our business, financial condition, or results of operations.

In addition, we and our clients are subject to card network rules that could subject us or our clients to a variety of fines or penalties that may be levied by card networks for certain acts or omissions by us or our clients. If a client or sales partner fails to comply with the applicable requirements of card networks, we could be subject to a variety of fines or penalties that may be levied by card networks. We may have to bear the cost of such fines or penalties if we cannot collect them from the applicable client or sales partner, resulting in lower earnings or losses for us. Our violation of the network rules may result in the termination or suspension of our registration with the affected network. The termination of our registration, including a card network barring us from acting as a payment facilitator, or any changes in card network rules that would impair our registration, could require us to stop providing payment solutions relating to the affected card network, which would adversely affect our ability to conduct our business.

In addition, the rules of card networks are set by their boards, which may be influenced by card issuers. Many banks directly or indirectly sell payment processing services to clients in competition with us. These banks could attempt, by virtue of their influence on the networks, to alter the networks’ rules or policies to the detriment of non-members, including us.

We are subject to increases in card network fees and other changes to fee arrangements.

From time to time, card networks, including Visa, MasterCard, American Express, and Discover, increase the fees that they charge, which are indirectly passed down to payment facilitators like us. Although we may attempt to pass these increases along to our clients, this may result in the loss of clients to our competitors that do not pass along the increases. If competitive practices prevent us from passing along the higher fees to our clients in the future, we may have to absorb all or a portion of such increases, which may increase our operating costs and adversely impact our results of operations.

Further, any future regulations on processing rates being capped when applied to transaction refunds could have a negative impact on our business. A provision of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) known as the Durbin Amendment empowered the Federal Reserve Board to establish and regulate a cap on the interchange fees that merchants pay banks for electronic clearing of debit card transactions. The final rule implementing the Durbin Amendment established standards for assessing whether debit card interchange fees received by debit card issuers were reasonable and proportional to the costs incurred by issuers for electronic debit transactions, and it established a maximum permissible interchange fee that an issuer may receive for an electronic debit transaction, limiting the fee revenue to debit card issuers and payment processors. To the extent that HSA-linked payment cards and other exempt payment cards used on our platform (or their issuing banks) lose their exempt status under the current rules or if the current interchange rate caps applicable to other payment cards used on our platform are increased, any such amendment, rule-making, or legislation could increase the interchange fees applicable to payment card transactions processed through our platform. As a result, this could decrease our revenue and profit and could have a material adverse effect on our financial condition and results of operations.

We are subject to the effect of payer and provider conduct which we cannot control.

We offer certain electronic claims submission products as part of our platform. While we have implemented certain product features designed to maximize the accuracy and completeness of claims submissions, these features may not be sufficient to prevent inaccurate claims data from being submitted to payers. Should inaccurate claims data be submitted to payers due to errors and omissions by Waystar, we may be subject to liability claims. Electronic data transmission services are offered by certain payers to healthcare providers that establish a direct link between the provider and payer. This process could reduce revenue to vendors such as us. A significant increase in the utilization of direct links between providers and payers would reduce the number of transactions that we process and for which we are paid, resulting in a decrease in revenue and an adverse effect on our financial condition and results of operations.

Risks Related to Information Technology Systems, Cybersecurity, Data Privacy, and Intellectual Property

We and our vendors are subject to attacks of such information technology systems, including cyber-attacks, security breaches, or other incidents impacting the information Processed through our platform.

We collect, create, receive, maintain, process, use, transmit, disclose, transfer, alter, and store (collectively, “Process”) significant amounts of personal information of patients received in connection with the utilization of our platform and otherwise in connection with the operation of our business, and other sensitive, confidential, and proprietary information such as payment data and PHI. Attacks on information technology systems are increasing in their frequency, levels of persistence, sophistication, and intensity, and they are being conducted by increasingly sophisticated and organized groups and individuals, including state- sponsored organizations, with a wide range of motives and expertise. In addition to extracting personal information and other sensitive or confidential information, such attacks could include the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering, and other means to affect service reliability and threaten the confidentiality, integrity, security, and availability of our information or information technology systems. The prevalent use of mobile devices also increases the risk of data security incidents. Further, like all internet-based solutions, our solutions are vulnerable to software bugs, computer viruses, malware, internet worms, break-ins, phishing attacks, attempts to overload servers with denial-of- service, or other attacks or similar disruptions from unauthorized use of our and third-party computer systems, any of which could lead to system interruptions, delays, or shutdowns, causing loss of critical data, or the unauthorized acquisition of or access to data. While we believe we have taken reasonable steps to protect such data, techniques used to gain unauthorized access to or acquisitions of data and systems, disable or degrade service, or sabotage systems, are constantly evolving, and we may be unable to anticipate such techniques or implement adequate preventative measures to avoid unauthorized access, acquisitions of, or other adverse impacts to such data or our systems. The risk of state-supported and geopolitical-related cyber-attacks may increase in connection with the war in Ukraine and any related political or economic responses and counter-responses. In addition, competitors in our industry have suffered successful cyberattacks in the past, which may lead to us facing additional scrutiny, and we may face similar attacks ourselves. We may not discover all such incidents or activity or be able to respond or otherwise address them promptly, in sufficient respects or at all. Any specific interruption or attack, any failure to maintain performance, reliability, security, and availability of our products, or failure to prevent software bugs and other corruptants such as those listed above, to the satisfaction of our clients or their patients, may harm our reputation and our ability to retain existing clients, negatively affect our clients and their patients, and adversely impact our business, results of operations, and financial condition.

In addition, some of our third-party service providers and vendors also Process our personal information and other sensitive information such as our clients’ data on our behalf. These service providers and vendors are subject to similar threats of cyber-attacks, security incidents, and other malicious internet-based activities, which could also expose us to risk of loss, litigation, potential liability, and/or other costs. We may have limited insight into the data privacy or security practices of third-party vendors and providers, including as it relates to our AI algorithms. We have also acquired and may continue to acquire companies that are vulnerable to cyber-attacks and security incidents and breaches, and we may be responsible for any such attacks, incidents, and breaches of these newly acquired companies.

Further, the security systems in place at our employees’, vendors’, and service providers’ offices and homes may be less secure than those used in our offices, and while we have implemented technical, physical, and administrative safeguards to help protect our systems when our employees, vendors, and service providers work from their offices, homes, and other remote locations, we may be subject to increased cybersecurity risk, which could expose us to risks of data or financial loss, and could disrupt our business operations. There is no guarantee that the data security and privacy safeguards we have put in place will ultimately be effective or that we will not encounter risks associated with employees, vendors, and service providers accessing company data and systems remotely. If an actual or perceived breach of security occurs to our systems or a third-party’s systems, we could be required to expend significant resources to mitigate the breach of security, pay any applicable fines, and address matters related to any such breach, including notifying impacted individuals, the media, or regulators, making public disclosures, and addressing reputational harm.

Any theft, loss, or misappropriation of, or access to, clients’, or other proprietary data, or other breach of our third-party service providers’ or vendors’ information technology systems could result in fines, legal claims, or proceedings, including regulatory investigations and actions, or liability for failure to comply with privacy and information security laws, which could disrupt our operations, damage our reputation, and expose us to claims from clients, individuals, and others, any of which could have a material adverse effect on our business, financial condition, and results of operations.

The costs of mitigating data security risks are significant and are likely to increase in the future. Although we carry cybersecurity insurance, we cannot ensure our limits are sufficient to cover us against all potential losses for damages or fines in an amount exceeding our policy.

Our business is subject to complex and evolving laws and regulations regarding privacy, data protection, and cybersecurity.

There are numerous U.S. federal, state, local, and international laws and regulations regarding privacy, data protection, and cybersecurity that govern the Processing of personal information and other information. The scope of these laws and regulations is expanding and evolving, subject to differing interpretations, may be inconsistent among jurisdictions, or conflict with other rules. We are also subject to the terms of our privacy policies and obligations to third parties related to privacy, data protection, and cybersecurity.

For example, CCPA took effect on January 1, 2020, which broadly defines personal information, gives California residents expanded privacy rights and protections, and provides for civil penalties for certain violations. Furthermore, in November 2020, California voters passed the CPRA, which amended and expanded the CCPA with additional data privacy compliance requirements and established a regulatory agency dedicated to enforcing those requirements. Many other states, such as Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia have since also passed comprehensive state privacy laws that may impose additional obligations and requirements on our business. Additionally, we may be subject to new laws governing the privacy of certain specific types of data, including, most notably, consumer health data. For example, Washington’s My Health My Data Act broadly defines consumer health data, creates a private right of action to allow individuals to sue for violations of the law, imposes stringent consent requirements, and grants consumers certain rights with respect to their health data, including to request deletion of their information.

In addition, varying jurisdictional requirements could increase the costs and complexity of our compliance efforts and violations of applicable data privacy laws can result in significant penalties. Any failure, or perceived failure, by us to comply with applicable data protection or other laws could result in proceedings or actions against us by governmental entities or others, subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, and adversely affect our business. Many of these new laws, if applicable, may require us to allow individuals to opt-out of the use of their personal information for targeted advertising, which may impact our marketing strategy. Additionally, businesses are legally required to notify affected individuals, governmental entities, and/or credit reporting agencies of certain security incidents affecting personal information. Such laws are not all consistent, and compliance in the event of a widespread security incident is complex and costly and may be difficult to implement. We may also be contractually required to indemnify and hold harmless clients from the costs or consequences of non-compliance with any laws, regulations, or other legal obligations relating to data privacy or health care laws or any inadvertent or unauthorized Processing of personal information or PHI that we store or handle as part of operating our business. Our existing general liability and cyber liability insurance policies may not cover, or may cover only a portion of, any potential claims related to security breaches to which we are exposed or may not be adequate to indemnify us for all or any portion of liabilities that may be imposed. See Part I, Item 1A, “Risk Factors—Risks Related to Legal and Governmental Regulation—We are subject to health care laws and data privacy and security laws and regulations governing our Processing of personal information, including PHI, personal health records, and payment card data” below for further discussion.

If our intellectual property rights are not adequately protected and enforced, we may not be able to build name recognition or protect our technology and products.

Our business depends on proprietary technology and content, including software, databases, confidential information and know-how, the protection of which is crucial to the success of our business. We rely on a combination of trademark, trade-secret, copyright, and other intellectual property laws, confidentiality procedures, and contractual provisions to protect our intellectual property rights in our proprietary technology, content, and brand. We may, over time, increase our investment in protecting our intellectual property through additional trademark, patent, and other intellectual property filings that could be expensive and time- consuming. Effective trademark, trade-secret, and copyright protection is expensive to develop and maintain, both in terms of initial and ongoing registration requirements and the costs of asserting our rights against third parties. Further, these measures may not be sufficient to offer us meaningful protection. If we are unable to protect our intellectual property and assert our rights in such intellectual property against third parties, our brand, competitive position, and business could be harmed, as third parties may be able to dilute our brand or commercialize and use technologies and software products that are substantially the same as ours without incurring the development and licensing costs that we have incurred. Any of our owned or licensed intellectual property rights could be challenged, invalidated, circumvented, infringed, or misappropriated, our trade secrets and other confidential information could be disclosed in an unauthorized manner to third parties, or our intellectual property rights may not be sufficient to permit us to take advantage of current market trends or otherwise provide us with competitive advantages, which could result in costly redesign efforts, discontinuance of certain products and solutions, or other competitive harm.

Monitoring unauthorized use of our intellectual property is difficult and costly. From time to time, we seek to analyze our competitors’ products and solutions, and may in the future seek to enforce our rights against potential infringement. However, the steps we have taken to protect our proprietary rights may not be adequate to prevent infringement or misappropriation of our intellectual property. We may not be able to detect unauthorized use of, or take appropriate steps to enforce, our intellectual property rights. Any inability to meaningfully protect or enforce our intellectual property rights could result in harm to our brand or our ability to compete and reduce demand for our technology and products. Moreover, our failure to develop and properly manage new intellectual property could adversely affect our market positions and business opportunities. Also, some of our products and solutions rely on technologies and software developed by or licensed from third parties. Any disruption or disturbance in such third-party products or services, which we have experienced in the past and may experience again in the future, could interrupt the operation of our platform, and could cause us to be in breach of contracts with our clients. We may not be able to maintain our relationships with such third parties or enter into similar relationships in the future on reasonable terms or at all.

Additional uncertainty may result from changes to intellectual property legislation enacted in the United States and elsewhere, and from interpretations of intellectual property laws by applicable courts and agencies. Accordingly, despite our efforts, we may be unable to obtain and maintain the intellectual property rights necessary to provide us with a competitive advantage. Our failure to obtain, maintain, and enforce our intellectual property rights could therefore have a material adverse effect on our business, financial condition, and results of operations.

Our business depends on our ability to use or license data and integrate third-party technologies.

We depend upon licenses from third parties for some of the technology and data used in our products and solutions, and for some of the technology platforms upon which these products and solutions are built and operate. We expect that we may need to obtain additional licenses from third parties in the future in connection with the development of our products and solutions. In addition, we obtain a portion of the data that we use from government entities and public records for specific client engagements. We believe that we have all rights necessary to use the data that is incorporated into, or used to develop and improve, our products and solutions. However, we cannot assure you that our licenses for information will allow us to use that information for all potential or contemplated products and solutions. In addition, our ability to use data to support and improve existing products and solutions and to develop new products and solutions is largely dependent upon the contractual rights we secure. For example, certain of our products depend on maintaining our data and analytics platform, which is populated with data disclosed to us by healthcare providers and payers with their consent. If these providers and/or payers revoke their consent for us to maintain, use, de-identify, and share this data, consistent with applicable law, our data assets could be degraded.

In the future, data providers could withdraw their data from us or restrict our usage for any reason, including if there is a competitive reason to do so, if legislation is passed restricting the use of the data, or if judicial interpretations are issued restricting use of the data that we currently use in or for development and maintenance of our products and solutions. In addition, data providers could fail to adhere to our quality control standards in the future, causing us to incur additional expense to appropriately utilize the data. If a substantial number of data providers were to withdraw or restrict their data, or if they fail to adhere to our quality control standards, and if we are unable to identify and contract with suitable alternative data suppliers and integrate these data sources into our offerings, our ability to provide products and solutions to our partners would be materially adversely impacted, which could have a material adverse effect on our business, financial condition, and results of operations.

We also integrate into our proprietary products and solutions and use third-party software to maintain and enhance, among other things, content generation and delivery, and to support our technology infrastructure.

Some of this software is proprietary and some is open source software. Our use of third-party technologies and open source software exposes us to increased risks, including, but not limited to, risks associated with the integration of new technology into our platform, the diversion of our resources from development of our own proprietary technology and our inability to generate revenue from licensed technology sufficient to offset associated acquisition and maintenance costs. These technologies may not be available to us in the future on commercially reasonable terms or at all and could be difficult to replace once integrated into our own proprietary products and solutions. Most of these licenses can be renewed only by mutual consent and may be terminated if we breach the terms of the license and fail to cure the breach within a specified period of time. Our inability to obtain, maintain, or comply with any of these licenses could delay development until equivalent technology can be identified, licensed, and integrated, which would harm our business, financial condition, and results of operations.

Most of our third-party licenses are non-exclusive and our competitors may obtain the right to use any of the technology covered by these licenses to compete directly with us. If our data suppliers choose to discontinue support of the licensed technology in the future, we might not be able to modify or adapt our own solutions.

Our use of “open source” software could adversely affect our ability to offer our products and solutions and subject us to possible litigation.

We have in the past incorporated and may in the future incorporate certain open source software into our products and solutions. Open source software is licensed by its authors or owners under open source licenses, which in some instances may subject us to certain unfavorable conditions, including requirements that we offer our products and solutions that incorporate such open source software for no cost, that we make publicly available the source code for any modifications or derivative works we create based upon, incorporating or using the open source software, or that we license such modifications or derivative works under the terms of the particular open source license. In addition, the use of third-party open source software could expose us to greater risks than the use of third-party commercial software to the extent open-source licensors do not provide warranties or controls on the functionality or origin of the software equivalent to those provided by third-party commercial software providers. Further, the public availability of open source software may make it easier for attackers to target and compromise our platform through cyber-attacks. Open sourcing such software requires us to make the source code publicly available, and therefore can limit our ability to protect our intellectual property rights with respect to that software. From time to time, companies that use open source software have faced claims challenging the use of open source software or compliance with open source license terms. Furthermore, there is an increasing number of open source software license types, many of which have not been tested in a court of law. We could be subject to suits by parties claiming copyright infringement or noncompliance with open source licensing terms. While we monitor the use of open source software and try to ensure that none is used in a manner that would require us to disclose our proprietary source code or that would otherwise breach the terms of an open source license, such use could inadvertently occur, in part because open source license terms are often ambiguous. Any requirement to disclose our proprietary source code or pay damages for breach of contract could have a material adverse effect on our business, financial condition, and results of operations and could help our competitors develop products and solutions that are similar to or better than ours.

Third parties may initiate legal proceedings alleging that we are infringing or otherwise violating their intellectual property rights.

Our commercial success depends on our ability to develop and commercialize our products and solutions and use our proprietary technology without infringing the intellectual property or proprietary rights of third parties. However, from time to time, we may be subject to legal proceedings and claims in the ordinary course of business with respect to intellectual property. Intellectual property disputes can be costly to defend and may cause our business, operating results, and financial condition to suffer. As the market for healthcare technology solutions in the United States expands and more patents are issued, the risk increases that there may be patents issued to third parties that relate to our products and technology of which we are not aware or that we must challenge to continue our operations as currently contemplated. Whether merited or not, we may face allegations that we, our licensees, or parties indemnified by us have infringed or otherwise violated the patents, trademarks, copyrights, or other intellectual property rights of third parties. Such claims may be made by competitors seeking to obtain a competitive advantage or by other parties. Additionally, so-called non-practicing entities collect patents and make claims of infringement in an attempt to extract settlements from companies like ours. We have faced such claims, although we do not believe they are material, and may attract such claims in the future. We may also face allegations that our employees have misappropriated the intellectual property or proprietary rights of their former employers or other third parties.

It may be necessary for us to initiate litigation to defend ourselves in order to determine the scope, enforceability, and validity of third-party intellectual property or proprietary rights, or to establish our respective rights. Regardless of whether claims that we are infringing patents or other intellectual property rights have merit, such claims can be time-consuming, divert management’s attention and financial resources, and can be costly to evaluate and defend. Results of any such litigation are difficult to predict and may require us to stop commercializing or using our products or technology, obtain licenses, modify our solutions and technology while we develop non-infringing substitutes, or incur substantial damages, settlement costs, or face a temporary or permanent injunction prohibiting us from marketing or providing the affected products and solutions. If we require a third-party license, it may not be available on reasonable terms or at all, and we may have to pay substantial royalties, upfront fees, or grant cross-licenses to intellectual property rights for our products and solutions. We may also have to redesign our products or solutions so they do not infringe third-party intellectual property rights, which may not be possible or may require substantial monetary expenditures and time, during which our technology and products may not be available for commercialization or use. Even if we have an agreement to indemnify us against such costs, the indemnifying party may be unable to uphold its contractual obligations. If we cannot or do not obtain a third-party license to the infringed technology, license the technology on reasonable terms, or obtain similar technology from another source, our revenue and earnings could be adversely impacted.

Further, some third parties may be able to sustain the costs of complex litigation more effectively than we can because they have substantially greater resources. And even if resolved in our favor, litigation or other legal proceedings relating to intellectual property claims may cause us to incur significant expenses and could distract our technical and management personnel from their normal responsibilities. In addition, there could be public announcements of the results of hearings, motions, or other interim proceedings or developments, and if securities analysts or investors perceive these results to be negative, it could have a material adverse effect on the price of our common stock. Moreover, any uncertainties resulting from the initiation and continuation of any legal proceedings could have a material adverse effect on our ability to raise the funds necessary to continue our operations. Assertions by third parties that we violate their intellectual property rights could therefore have a material adverse effect on our business, financial condition, and results of operations.

We may be subject to claims that our employees, consultants, or independent contractors have wrongfully used or disclosed confidential information of third parties.

We receive confidential and proprietary information from third parties in connection with the operation of our business. In addition, we may employ individuals who were previously employed at other technology companies, including our competitors. We may be subject to claims that us or our employees, consultants, or independent contractors have inadvertently or otherwise improperly used or disclosed confidential information of these third parties or our employees’ or contractors’ former employers. Further, we may be subject to ownership disputes in the future arising, for example, from conflicting obligations of employees, consultants, or others who are involved in developing our solutions. We may also be subject to claims that former employees, consultants, independent contractors or other third parties have an ownership interest in our patents or other intellectual property. Litigation may be necessary to defend against these and other claims challenging our right to and use of confidential and proprietary information. In addition to paying monetary damages, if we fail in defending against any such claims we may lose our rights therein, which could have a material adverse effect on our business. Even if we are successful in defending against these claims, litigation could result in substantial cost and be a distraction to our management and employees.

Risks Related to Legal and Governmental Regulation

We conduct business in a heavily regulated industry.

Our current and future arrangements with our channel partners, healthcare professionals, consultants, clients, and third-party payors subject us to various federal and state fraud and abuse laws and other healthcare laws, including, without limitation, the AKS and state kickback laws, the federal civil and criminal false claims laws, civil monetary penalties laws, the Stark Law, HIPAA, and the regulations promulgated under such laws. These laws impact, among other things, proposed sales, marketing, and educational programs, and other interactions with healthcare professionals and provider clients. For more information regarding the risks related to these laws and regulations please see Part I, Item 1, “Business—Regulation—Healthcare fraud and abuse provisions.”

These laws are complex, may change rapidly, and the scope and enforcement and application of each of these laws to our specific services and relationships may not be clear and may be applied to our business in ways we do not anticipate. Federal and state regulatory and law enforcement authorities continue to focus on enforcement activities with respect to Medicare, Medicaid, other government and third-party payor programs, and other healthcare reimbursement laws and rules in an effort to reduce overall healthcare spending. Federal and state enforcement bodies have recently increased their scrutiny of interactions between healthcare companies and healthcare providers, which has led to a number of investigations, prosecutions, convictions, and settlements in the healthcare industry. Because of the breadth of these laws and the narrowness of their statutory or regulatory exceptions and safe harbors, some of our business activities may be subject to challenge under one or more of them. Recent federal government cost-cutting, efficiency, and fraud and abuse initiatives may also result in reductions in healthcare reimbursement, healthcare spending, and the federal workforce that oversees healthcare programs, which may have a significant adverse impact on our business. In addition, new and evolving payment structures, for example, such as accountable care organizations and other arrangements involving combinations of healthcare providers who share savings, potentially implicate anti-kickback and other fraud and abuse laws. The government has prosecuted revenue cycle management service providers for causing the submission of false or fraudulent claims in violation of the FCA, and vendors of EHR software for, among other things, misrepresenting the capabilities of their software and payment of kickbacks to certain customers in exchange for promoting their products in violation of the AKS and the FCA. Errors created by our platform and our proprietary products and solutions that relate to entry, formatting, preparation, or transmission of claims, reporting of quality or other data pursuant to value-based purchasing initiatives, or cost report information may be alleged or determined to cause the submission of false claims or otherwise be in violation of these laws. As we continue to build new and evolving technologies, such as AI, machine learning, analytics, and biometrics, into our products and solutions, our business may become subject to additional complex and evolving regulatory requirements pertaining to the sale or use of these technologies. The sale of these technologies, or their use by us or by our clients or partners, may also subject us to additional risks, including reputational harm, competitive harm, or legal liabilities.

Ensuring that our internal operations and future business arrangements with third parties comply with applicable healthcare laws and regulations will involve substantial costs. Achieving and sustaining compliance requires us to implement controls across our entire organization which may prove costly and challenging to monitor and enforce. The risk of our being found in violation of healthcare laws and regulations is increased by the fact that their provisions are sometimes open to a variety of interpretations. We cannot assure you that our arrangements and activities will be deemed outside the scope of these laws or that increased enforcement activities will not directly or indirectly have a material adverse effect on our business, financial condition, or results of operations.

It is possible that governmental authorities will conclude that our business practices do not comply with current or future statutes, regulations, agency guidance, or case law involving applicable fraud and abuse or other healthcare laws and regulations. If our operations are found to be in violation of any of the laws described above or any other governmental laws and regulations that may apply to us, we may be subject to significant penalties, including administrative, civil, and criminal penalties, damages, fines, disgorgement, the exclusion from participation in federal and state healthcare programs, disqualification from providing services to healthcare providers doing business with government programs, individual imprisonment, reputational harm, and the curtailment or restructuring of our operations, requirements to change or terminate some portions of our operations or business, as well as additional reporting obligations and oversight if we become subject to a corporate integrity agreement or other agreement to resolve allegations of non-compliance with these laws. If we are determined to have violated any of these laws, we may be required to give our clients the right to terminate our services agreements with them and/or required to refund portions of our base fee revenues and incentive payment revenues, any of which could have a material adverse effect on our business and results of operations. Likewise, if any of the physicians or other providers or entities with whom we expect to do business are found to not be in compliance with applicable laws, they may be subject to criminal, civil, or administrative sanctions, including exclusions from government funded healthcare programs and imprisonment as well. Any violations by, and resulting penalties or exclusions imposed upon, our clients could adversely affect their financial condition and, in turn, have a material adverse effect on our business and results of operations. Even absent an alleged violation of law by us, participants in the healthcare industry receive inquiries or subpoenas to produce documents and provide testimony in connection with government investigations. We could be required to expend significant time and resources to comply with these requests, and the attention of our management team could be diverted by these efforts. Further, defending against any such actions can be costly and time consuming, and may require significant financial and personnel resources. Therefore, even if we are successful in defending against any such actions that may be brought against us, our business may be impaired. If any of the above occur, our ability to operate our business and our results of operations could be adversely affected.

The healthcare regulatory and political framework is uncertain and evolving.

Almost all of our revenue is derived from the healthcare industry, which is subject to changing political, legislative, regulatory, and other influences. Healthcare laws and regulations are rapidly evolving and may change significantly in the future, which could adversely affect our financial condition and results of operations. For example, in March 2010, the Patient Protection and Affordable Care Act (the “ACA”) was adopted, which is a healthcare reform measure that provides healthcare insurance for millions of Americans. The ACA includes a variety of healthcare reform provisions and requirements that substantially changed the way healthcare is financed by both governmental and private insurers, which significantly impact our industry and our business. We are unable to predict the full impact of any health reform initiatives or legislative updates to current healthcare laws on our operations in light of the uncertainty regarding whether, when, and how alternative reforms, if any, may be enacted, the timing of enactment and implementation of alternative provisions and the impact of alternative provisions on various healthcare industry participants.

We are also unable to predict how recent regulatory reforms regarding information blocking, algorithm transparency, interoperability, and health data will impact our business and whether the new presidential administration will continue to enforce or implement past reforms. For example, President Trump’s Administration revoked President Biden’s executive order on AI and it is unclear how the new Administration will implement final rules on Health Data, Technology and Interoperability (HTI-1, HTI-2, and HTI-3) that took effect in 2024. Future legislative, executive, and regulatory proposals may constitute a significant departure from previous regulations regarding patient data. While certain of these rules benefit us in that certain EHR vendors will no longer be permitted to interfere with our attempts at integration, they may also make it easier for other similar companies to enter the market, creating increased competition and reducing our market share.

In addition, we are subject to various other laws and regulations, including, among others, anti- kickback laws, antitrust laws, and the privacy and data protection laws described below. See Part I, Item 1, “Business— Regulation—Healthcare fraud and abuse provisions.”

We are subject to health care laws and data privacy and security laws and regulations governing our Processing of personal information, including PHI, personal health records, and payment card data.

Numerous complex federal and state laws and regulations govern the Processing of personal information, including PHI, personal health records, and payment card data. State laws may be even more restrictive and not preempted by HIPAA and may be subject to varying interpretations by the courts and government agencies. These laws and regulations, including their interpretation by governmental agencies, are subject to frequent change and could have a negative impact on our business. Further, these varying interpretations could create complex compliance issues for us and our partners and potentially expose us to additional expense, liability, penalties, negatively impact our client relationships, and lead to adverse publicity, and these risks could adversely affect our business in the short and long term. See Part I, Item 1, “Business— Regulation—Federal and state health information privacy and security laws.”

We are a “covered entity” as defined under HIPAA when we provide our clearinghouse services, and we also are a “business associate” as defined under HIPAA for other covered entities when we provide revenue cycle management and other solutions. HHS OCR may impose civil penalties on both covered entities and business associates for their failure to comply with HIPAA requirements. These requirements are subject to change. In December 2024, HHS OCR issued a notice of proposed rulemaking on the HIPAA Security Rule, which is specifically aimed at strengthening cybersecurity of electronic PHI, and we are monitoring this proposed rulemaking. The U.S. Department of Justice is responsible for criminal prosecutions under HIPAA. Penalties can vary significantly depending on a number of factors, such as whether the covered entity’s or business associate’s failure to comply was due to willful neglect. Violations of HIPAA could result in criminal penalties up to $250,000 and ten years in prison and civil penalties of up to $68,928 for each violation, with a cap of $2,067,813 for violations of the same standard per calendar year, administrative fines and penalties, and/or additional reporting and oversight obligations if we are required to enter into a resolution agreement and corrective action plan. A single breach incident can result in violations of multiple standards over many years, resulting in potential penalties in excess of $2,067,813 per year. For example, HIPAA violations at one covered entity resulted in total penalties of $16 million in 2018. HIPAA also authorizes state attorneys general to file suit on behalf of the residents of their states. While HIPAA does not create a private right of action that would allow individuals to sue in civil court for HIPAA violations, its standards have been used as the basis for the duty of care in state civil suits, such as those for recklessness in misusing individuals’ health information. If we are subject to investigation or litigation related to an alleged violation of HIPAA, then we may elect to resolve the matter through additional reporting and oversight obligations through a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. Such settlement could require payment of a civil penalty or damages, corrective action, and/or monitoring of our business by a third party.

The security measures that we and our third-party vendors and subcontractors have in place to ensure compliance with privacy and data protection laws may not protect our facilities and systems from security breaches or incidents, acts of vandalism or theft, computer viruses, misplaced or lost data, malfeasance, programming, and human errors or other similar events. We may also be liable for privacy and security breaches and failures of our business associates and subcontractors. Even though we provide for appropriate protections through our agreements with our subcontractors, we still have limited control over their actions and practices. A breach of privacy or security of individually identifiable health information by a subcontractor may result in an enforcement action, including criminal and civil liability, against us. We are not able to predict the extent of the impact such incidents may have on our business. Our failure to comply with HIPAA and other health privacy laws may also result in criminal and civil liability. Enforcement actions against us could be costly and could interrupt regular operations, which may adversely affect our business. While we have not received any notices of violation of the applicable privacy and data protection laws and believe we are in compliance with such laws, there can be no assurance that we will not receive such notices in the future.

Our AI platform and the data it uses may also subject us to additional risks. We use de-identified claims data to train our revenue cycle management AI. In order to de-identify PHI for our AI, we must have explicit rights and permissions to do so from our clients. If we do not de-identify PHI in accordance with HIPAA’s safe harbor method or if we do not have rights or permissions to de-identify PHI, but de-identify PHI for such purposes, a regulator or client may consider such actions to be a breach of HIPAA’s requirements or of contractual requirements, and we may be subject to criminal and civil liability or other actions and our clients may not renew or terminate their contracts with us.

Many states are also enacting legislation on the use, creation, and deployment of AI. For example, in March 2024, Utah enacted the Artificial Intelligence Policy Act, which requires disclosures to consumers about the use of AI in certain circumstances, including advance AI use disclosures by physicians and individuals in other regulated occupations. In Connecticut, proposed legislation would regulate the development, deployment, and use of certain AI systems. The Connecticut bill would address algorithmic discrimination, decisions with respect to healthcare services, and studies on the use of AI by healthcare providers. Developers of generative AI systems would be required to complete impact assessments and disclose measures the developer has taken to mitigate any known or reasonably foreseeable risks of algorithmic discrimination that may arise from deployment of certain “high-risk” AI systems that are developed and marketed to make consequential decisions, such as decisions that have a material legal or similarly significant effect on consumer access to certain services, including healthcare and financial services. Other states have introduced similar bills.

Even when HIPAA does not apply, according to the Federal Trade Commission (the “FTC”), failing to take appropriate steps to keep consumers’ personal information secure constitutes unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act (the “FTCA”) 15 U.S.C. § 45(a). The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. The FTC’s current guidance for appropriately securing consumers’ personal information is similar to what is required by the HIPAA security regulations, but this guidance may change in the future, resulting in increased complexity and the need to expend additional resources to ensure we are complying with the FTCA. For information that is not subject to HIPAA and deemed to be “personal health records,” the FTC may also impose penalties for violations of the Health Breach Notification Rule (“HBNR”) to the extent we are considered a “personal health record- related entity” or “third party service provider.” The FTC has taken several enforcement actions under HBNR this year and indicated that the FTC will continue to protect consumer privacy through greater use of the agency’s enforcement authorities. As a result, we expect even greater scrutiny by federal and state regulators, partners, and consumers of our Processing of health information, particularly with our AI-enabled solutions. Additionally, federal and state consumer protection laws are increasingly being applied by the FTC and states’ attorneys general to regulate the Processing of personal information, through websites or otherwise, and to regulate the presentation of website content.

Other federal and state laws that restrict the use and protect the privacy and security of personally identifiable information are, in many cases, not preempted by HIPAA and may be subject to varying interpretations by the courts and government agencies. These varying interpretations can create complex compliance issues for us and our partners and potentially expose us to additional expense, adverse publicity, and liability, any of which could adversely affect our business. Recently, several states have enacted consumer health data laws, which generally require consent for the collection, use, or sharing of any “consumer health data,” which is typically defined as personal information that is linked or reasonably linkable to a consumer and that identifies a consumer’s past, present, or future physical or mental health. Other states have enacted similar bills.

Future laws, regulations, standards, obligations, amendments, and changes in the interpretation of existing laws, regulations, standards, and obligations could impair our or our clients’ ability to Process information relating to consumers, which could decrease demand for our platform, increase our costs, and impair our ability to maintain and grow our client base, and increase our revenue. New laws, amendments to or re-interpretations of existing laws and regulations, industry standards, and contractual obligations could impair our or our clients’ ability to collect, use, or disclose information relating to patients or consumers, which could decrease demand for our platform offerings, increase our costs, and impair our ability to maintain and grow our client base, and increase our revenue. Accordingly, we may find it necessary or desirable to fundamentally change our business activities and practices or to expend significant resources to modify our software or platform and otherwise adapt to these changes.

We are also subject to self-regulatory standards and industry certifications that may legally or contractually apply to us. These include the Payment Card Industry Data Security Standards (“PCI-DSS”) and AICPA Systems and Organization Controls 2 (“SOC 2”), with which we are currently compliant, and HITRUST certification, which we currently maintain. In the event we fail to comply with the PCI-DSS or fail to maintain our SOC 2 or HITRUST certification, we could be in breach of our obligations under client and other contracts, fines, and other penalties could result, and we may suffer reputational harm and damage to our business. Further, our clients may expect us to comply with more stringent privacy, data storage, and data security requirements than those imposed by laws, regulations or self-regulatory requirements, and we may be obligated contractually to comply with additional or different standards relating to our handling or protection of data.

Any failure or perceived failure by us to comply with domestic laws or regulations, industry standards, or other legal obligations, or any actual or suspected breach or privacy or security incident, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personally identifiable information or other data, may result in governmental enforcement actions and prosecutions, private litigation, fines, and penalties or adverse publicity and could cause our clients to lose trust in us, which could have an adverse effect on our reputation and business. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new products and features could be limited. Any of these developments could harm our business, financial condition, and results of operations. Privacy and data security concerns, whether valid or not valid, may inhibit retention of our platform or services by existing clients or adoption of our platform or services by new clients.

The healthcare industry is rapidly evolving, and we may experience reduced revenues and/or be forced to reduce our prices in response to changes to the healthcare regulatory landscape. Value-based care, surprise medical billing, and other laws and regulations that reduce or otherwise affect physician payments and reimbursement could adversely affect the number of transactions we process and our ability to recover charges for our clients’ services.

We may be subject to revenue reductions or pricing pressures arising from various sources, including government actions and the trend of payors shifting to new reimbursement models and value-based care arrangements that incentivize healthcare providers to improve the health of their patients while managing medical expenses of a particular population. Value-based care reimbursement models implemented by government healthcare programs or private third-party payors could materially change the manner in which our clients are reimbursed. Our clients and other entities with which we have business relationships are also affected by other changes in statutes, regulations, and limitations on government spending for Medicare, Medicaid, and other programs. Recent and future government actions, including federal government cost-cutting, efficiency, and fraud and abuse initiatives may also result have a significant adverse impact on our business, and legislation or executive actions could limit or attempt to limit government spending for Medicare and Medicaid programs, limit payments to healthcare providers, initiate new and expanded value-based care reimbursement programs, impose price controls, and create other programs that potentially could have an adverse effect on our clients and the other entities with which we have a business relationship. If such actions or programs reduce the number of transactions, our revenues may decline along with our ability to absorb overhead costs, which may leave our business less profitable. Any failure to adequately implement strategic initiatives to adjust to these developments could have a material adverse impact on our business.

For example, the federal No Surprises Act, enacted in 2020, has impacted our clients, and may impact our business, product offerings, and procedures surrounding claims processing. The No Surprises Act may impact transaction volume and the manner in which our clients use our platform and may necessitate changes to our client contracting model to better align with the ways that our clients are being reimbursed. The No Surprises Act prohibits, among other things, “balance billing” or “surprise billing” by limiting patient costs for services to cost-sharing amounts and by banning providers from billing patients above these cost-sharing amounts. The No Surprises Act also created additional price transparency requirements, including the requirement that providers send patients and health plans a good faith estimate of the expected charges for furnishing certain items or services. If the actual charges are substantially higher than the estimate, the patient can invoke a dispute resolution process to challenge the higher amount. Further, subject to limited exceptions, the No Surprises Act also prohibited out-of-network providers from charging patients more than the relevant in-network cost sharing amount.

A number of state governments have also enacted or may enact legislation on surprise medical bills, which may adversely affect our revenue in those states. These measures could limit the amount our clients can recover for certain services they furnish where they have not contracted with the insurer, and therefore could have a material adverse effect on our business, financial condition, results of operations, and cash flows. For example, state surprise billing laws have established payment standards based on the median in-network rate or a multiplier of what Medicare would pay. These payment standards are often less than the average out-of-network payment and could therefore have an adverse effect on reimbursement rates, and we may experience additional impacts if more states adopt such laws. Moreover, these measures could affect our client’s ability to contract with certain payors or under historically similar terms, and may cause, and the prospect of these changes may cause, payors to seek to terminate or modify their contracts with our clients, further affecting our business, financial condition, results of operations, and cash flows. There is also risk that additional legislation at the federal and state level will give rise to major third-party payors leveraging this legislation or related changes as an opportunity to terminate and renegotiate existing reimbursement rates, which may also adversely affect our business, financial condition, results of operations, and cash flows.

Additionally, there have been numerous federal legislative and administrative actions that have affected government programs, including adjustments that have reduced or increased payments to physicians and other healthcare providers and adjustments that have affected the complexity of our work. For example, the Medicare Access and CHIP Reauthorization Act of 2015 established a Quality Payment Program that requires physician groups to track and report a multitude of data relating to quality, clinical practice improvement activities, use of an EHR, and cost. Success or failure with respect to these measures may impact reimbursement in future years. Similarly, hospitals participating in the Medicare Value-Based Purchasing Program, which requires the reporting of quality and cost measures, may receive a net decrease in payments. It is possible that the federal or state governments will implement additional reductions, increases, or changes in reimbursement under government programs that will adversely affect our client base or increase the cost of providing our services. Any such changes could adversely affect our own financial condition by reducing the reimbursement rates of our clients.

We may be a party to legal, regulatory, and other proceedings that could result in adverse outcomes.

We have been, and may in the future be, a party to legal and regulatory proceedings and investigations, and other proceedings and investigations arising in the ordinary course of business, such as claims brought by our clients in connection with commercial disputes and employment claims made by our current or former employees. Claims may also be asserted by or on behalf of a variety of other parties, including government agencies, patients or vendors of our clients, or stockholders. In addition, there are an increasing number of, and we may be subject to, investigations and proceedings in the healthcare industry generally that seek recovery under HIPAA, anti-kickback laws, false claims laws, civil monetary penalties laws, the Stark Law, state laws, and other statutes and regulations applicable to our business as described in more detail above. These and other similar statutory requirements impose statutory penalties for proven violations, which could be significant. We also may be subject to legal proceedings under non-healthcare federal and state laws affecting our business, such as the TCPA, the FDCPA, the Fair Credit Reporting Act, CAN-SPAM Act, Junk Fax Act, the CCPA, employment, banking and financial services, and USPS laws and regulations, as further detailed above and below. Such proceedings are inherently unpredictable, and the outcome can result in verdicts and/or injunctive relief that may affect how we operate our business or we may enter into settlements of claims for monetary payments. In some cases, substantial non-economic remedies or punitive damages may be sought. Governmental investigations, audits, and other reviews could also result in criminal penalties or other sanctions, including restrictions, changes in the way we conduct business, or exclusion from participation in government programs. We evaluate our exposure to these legal and regulatory proceedings and establish reserves for the estimated liabilities in accordance with GAAP. Assessing and predicting the outcome of these matters involves substantial uncertainties. Unexpected outcomes in these legal proceedings, or changes in management’s evaluations or predictions and accompanying changes in established reserves, could have a material adverse impact on our business, results of operations, or financial condition.

Litigation is costly, time-consuming, and disruptive to normal business operations. The defense of these matters could also result in continued diversion of our management’s time and attention away from business operations, which could also harm our business. Insurance may not cover existing or future claims, be sufficient to fully compensate us for one or more of such claims, or continue to be available on terms acceptable to us. A claim brought against us that is uninsured or underinsured could result in unanticipated costs, thereby reducing our results of operations and resulting in a reduction in the trading price of our common stock. Even if these matters are resolved in our favor, the uncertainty and expense associated with unresolved legal proceedings could harm our business and reputation.

We are contractually required to comply with Bank Secrecy Act and Anti-Money Laundering (“BSA/AML”) laws and regulations as a payment facilitator in certain instances.

We are contractually required to comply with certain anti-money laundering laws and regulations. For instance, we comply with certain provisions of the Bank Secrecy Act, as amended by the USA PATRIOT Act of 2001, and its implementing regulations (collectively, the “BSA”), which are enforced by the Financial Crimes Enforcement Network (“FinCEN”), a bureau of the U.S. Department of the Treasury and the U.S. Department of Justice. We have policies, procedures, systems, and controls designed to identify and address potentially impermissible transactions under these laws and regulations. In addition, we provide BSA/AML training to certain employees to help ensure compliance with such contractual requirements. However, any failure to comply with such contractual requirements could subject us to potential liability for breach of contract, which could adversely affect our business or financial condition.

Existing laws regulate our ability to engage in certain marketing activities.

We rely on a variety of marketing techniques, including email and telephone marketing. These activities are regulated by legislation such as the CAN-SPAM Act and the TCPA. The CAN-SPAM Act imposes penalties for the transmission of commercial emails that do not comply with certain requirements, such as providing an opt-out mechanism for stopping future emails from the sender. The TCPA places certain restrictions on making outbound calls, faxes, and text messages to consumers. Any failure by us to comply fully with any such applicable laws or regulations may subject us to substantial fines and penalties. In addition, any future restrictions in laws such as the CAN-SPAM Act, the TCPA, and various other laws and regulations regarding marketing and solicitation activities could adversely affect the continuing effectiveness of our marketing efforts and could force changes in our marketing strategies. If this occurs, we may not be able to develop adequate alternative marketing strategies, which could have a material adverse impact on our results of operations.

We must comply fully with website accessibility standards.

We conduct business through various internet websites and web-based applications that are subject to accessibility requirements. Courts have ruled that the Americans with Disabilities Act (“ADA”) applies to internet websites and other digital experiences and litigation related to ADA website accessibility has soared in recent years. Failing to comply with those requirements could leave us subject to claims, litigation, lawsuits, and, ultimately, substantial fines and penalties.

We could be subject to changes in our tax rates, the adoption of new tax legislation or exposure to additional tax liabilities.

Current economic and political conditions make tax rates in any jurisdiction subject to significant change. Our future effective tax rates could also be affected by changes in the valuation of our deferred tax assets and liabilities, or changes in tax laws or their interpretation, including changes in tax laws affecting our products and solutions and the healthcare industry more generally. We are also subject to the examination of our tax returns and other documentation by the Internal Revenue Service and state tax authorities. We regularly assess the likelihood of an adverse outcome resulting from these examinations to determine the adequacy of our provision for taxes. There can be no assurance as to the outcome of these examinations or that our assessments of the likelihood of an adverse outcome will be correct. If our effective tax rates were to increase or if the ultimate determination of our taxes owed is for an amount in excess of amounts previously accrued, then this could materially and adversely impact our financial condition and results of operations.

The Tax Cuts and Jobs Act of 2017 (the “TCJA”) eliminated the option to deduct research and development expenses for tax purposes in the year incurred and requires taxpayers to capitalize and subsequently amortize such expenses over five years for research activities conducted in the United States and over 15 years for research activities conducted outside the United States. This change was effective January 1, 2022. Unless the United States Treasury Department issues regulations that narrow the application of this provision or the provision is deferred, modified, or repealed by Congress, it could harm our future operating results by effectively increasing our future tax obligations. The actual impact of this provision will depend on multiple factors, including the amount of research and development expenses we will incur, whether we achieve sufficient income to fully utilize such deductions, and whether we conduct our research and development activities inside or outside the United States.

Our ability to use our net operating losses (“NOLs”) to offset future taxable income may be subject to certain limitations.

Future changes in our stock ownership, some of which are outside of our control, could result in an ownership change under Section 382 of the Internal Revenue Code of 1986, as amended (the “Code”). In addition, under the TCJA, as amended by The Coronavirus Aid, Relief, and Economic Security Act of 2020, the amount of post 2017 NOLs that we are permitted to utilize in any taxable year is limited to 80% of our taxable income in such year, where taxable income is determined without regard to the NOL deduction itself. For these reasons, we may not be able to realize a tax benefit from the use of our NOLs. We have a valuation allowance related to our NOLs to recognize only the portion of the NOL that is more likely than not to be realized.

Goodwill and other intangible assets, net represent approximately 89% of our total assets as of December 31, 2024 and we could suffer losses due to asset impairment charges.

In accordance with GAAP, goodwill and intangible assets with an indefinite life are not amortized but are subject to a periodic impairment evaluation. We assess our goodwill and other intangible assets for impairment periodically in accordance with applicable authoritative accounting guidance. Our ability to realize the value of the goodwill and intangible assets will depend on the future cash flows of the businesses we have acquired, which in turn depend in part on how well we have integrated these businesses into our own business. Judgments made by management relate to the expected useful lives of long-lived assets and our ability to realize undiscounted cash flows of the carrying amounts of such assets. The accuracy of these judgments may be adversely affected by several factors, including significant:

These types of events or indicators and the resulting impairment analysis could result in impairment charges in the future. If we are not able to realize the value of the goodwill and intangible assets, we may be required to incur material charges relating to the impairment of those assets. Such impairment charges could materially and negatively affect our results of operations and financial condition.

Risks Related to our Indebtedness

We have a substantial amount of debt, which could adversely affect our financial position and our ability to raise additional capital and prevent us from fulfilling our obligations under our obligations.

As of December 31, 2024, we had outstanding indebtedness of approximately $1.2 billion, consisting of $1.2 billion outstanding under our First Lien Credit Facility and $80 million outstanding under our Receivables Facility and not including $12 million of finance lease obligations. Additionally, we had $400 million of availability under our Revolving Credit Facility as of December 31, 2024. As of December 31, 2024, there is no outstanding balance on our Revolving Credit Facility.

Our substantial indebtedness may:

Restrictive covenants in the agreements governing our Credit Facilities may restrict our ability to pursue our business strategies.

The credit agreements governing our Credit Facilities contain, and any future credit agreements we may enter into may contain, a number of covenants that, among other things, restrict our ability to, subject to certain exceptions:

As a result of these covenants and restrictions, we are and will be limited in how we conduct our business, and we may be unable to raise additional debt or equity financing to compete effectively or to take advantage of new business opportunities.

In addition, the Revolving Credit Facility requires us to maintain a first lien leverage ratio, to be tested on the last day of each fiscal quarter for which financial statements have been delivered, but only if, on the last day of such fiscal quarter, the aggregate amount of loans under the Revolving Credit Facility and certain letters of credit (in each case subject to certain exceptions specified therein) which are outstanding and/or issued, as applicable, exceeds 35% of the total amount of the commitments in respect of the Revolving Credit Facility.

Our ability to comply with these covenants may be affected by events beyond our control, and we may not be able to meet those covenants. The terms of any future indebtedness we may incur could include more restrictive covenants. A breach of any such covenants could result in a default under the applicable credit agreement, which could cause all of the outstanding indebtedness under such debt agreement to become immediately due and payable and terminate all commitments to extend further credit. If we are unable to meet our obligations, we may be required to repay any outstanding amounts with sources of capital we may otherwise use to fund our business, operations, and strategy. In addition, if we are forced to refinance these borrowings on less favorable terms, our results of operations and financial condition could be adversely affected.

Interest rate fluctuations may affect our results of operations and financial condition.

Because a substantial portion of our debt is variable-rate debt, fluctuations in interest rates could have a material effect on our business. We currently utilize, and may in the future utilize, derivative financial instruments such as interest rate swaps to hedge some of our exposure to interest rate fluctuations, but such instruments may not be effective in reducing our exposure to interest fluctuations, and we may discontinue utilizing them at any time. As a result, we may incur higher interest costs if interest rates increase. These higher interest costs could have a material adverse impact on our financial condition and the levels of cash we maintain for working capital.

In order to support the growth of our business, we may need to incur additional indebtedness under our current Credit Facilities or seek capital through new equity or debt financings, which sources of additional capital may not be available to us on acceptable terms or at all.

We intend to continue to make significant investments to support our business growth, respond to business challenges or opportunities, develop new products and solutions, enhance our existing products and solutions, enhance our operating infrastructure, and potentially acquire complementary businesses and technologies.

Our future capital requirements may be significantly different from our current estimates and will depend on many factors, including the need to:

Accordingly, we may need to engage in equity or debt financings or collaborative arrangements to secure additional funds. Additional financing may not be available on terms favorable to us, or at all. If we raise additional funds through further issuances of equity or equity-linked securities, our existing stockholders could suffer significant dilution, and any new equity securities we issue could have rights, preferences, and privileges superior to those of holders of our common stock. Any debt financing secured by us in the future could involve additional restrictive covenants relating to our capital-raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities, including potential acquisitions. In addition, during times of economic instability, it has been difficult for many companies to obtain financing in the public markets or to obtain debt financing, and we may not be able to obtain additional financing on commercially reasonable terms, if at all. If we are unable to obtain adequate financing or financing on terms satisfactory to us, it could have a material adverse effect on our business, financial condition, and results of operations.

General Risk Factors

Our business is significantly impacted by general macroeconomic conditions.

Geopolitical instability, including the conflict between Russia and Ukraine, actual and potential shifts in U.S. and foreign, trade, economic, and other policies, and rising trade tensions between the United States and China, as well as other global events, have significantly increased macroeconomic uncertainty at a global level. The current U.S. macroeconomic environment is characterized by recent record-high inflation, supply chain challenges, labor shortages, high interest rates, foreign currency exchange volatility, volatility in global capital markets, and growing recession risk. Such economic volatility could adversely affect our business, financial condition, results of operations and cash flows, and future market disruptions could negatively impact us. Further, adverse macroeconomic conditions affect our clients’ and prospective clients’ operations and financial condition and make it difficult for our clients and prospective clients to accurately forecast and plan future business activities, which may in turn cause our clients to elect not to renew their contracts or affect their ability to pay amounts owed to us in a timely manner or at all, or adversely affect prospective clients’ ability or willingness to enter into contracts with us. We have also observed the effect of inflation on our labor and cost structure. If these trends continue, our business, results of operations, financial condition, and cash flows may be materially adversely affected.

An economic downturn or increased uncertainty may also lead to increased credit and collectability risks, higher borrowing costs or reduced availability of capital and credit markets, reduced liquidity, adverse impacts on our suppliers, failures of counterparties including financial institutions and insurers, asset impairments, and declines in the value of our financial instruments.

We have a history of losses and we may not achieve or maintain profitability in the future.

We incurred net losses of $19.1 million, $51.3 million, and $51.5 million for the years ended December 31, 2024, 2023, and 2022, respectively. Our operating expenses may increase substantially in the foreseeable future, as we increase investments in our business. Furthermore, as a public company, we have incurred and will continue to incur additional legal, accounting, and other expenses that we did not incur as a private company. As a result, our net losses may continue for the foreseeable future.

These efforts and additional expenses may prove more expensive than we expect, and we cannot guarantee that we will be able to increase our revenue to offset such expenses. Our revenue growth may slow or our revenue may decline for a number of other reasons, including increased competition, or if we cannot capitalize on growth opportunities. If our revenue does not grow at a greater rate than our operating expenses, we will not be able to achieve profitability.

Risks Related to Ownership of our Common Stock

The Institutional Investors hold a significant percentage of our outstanding common stock and their interests may be different than the interests of other holders of our securities.

As of February 12, 2025, the Institutional Investors owned approximately 66% of our outstanding common stock. As a result, the Institutional Investors are able to control or influence actions to be taken by us, including future issuances of our common stock or other securities, the payment of dividends, if any, on our common stock, amendments to our organizational documents, and the approval of significant corporate transactions, including mergers, sales of substantially all of our assets, distributions of our assets, the incurrence of indebtedness, and any incurrence of liens on our assets.

The interests of the Institutional Investors may be materially different than the interests of our other stakeholders. In addition, the Institutional Investors may have an interest in pursuing acquisitions, divestitures, and other transactions that, in their judgment, could enhance their investment, even though such transactions might involve risks to other stockholders. For example, the Institutional Investors may cause us to take actions or pursue strategies that could impact our ability to make payments under our Credit Facilities or cause a change of control. In addition, to the extent permitted by agreements governing our Credit Facilities, the Institutional Investors may cause us to pay dividends rather than make capital expenditures or repay debt. The Institutional Investors are in the business of making investments in companies and may from time to time acquire and hold interests in businesses that compete directly or indirectly with us. Our amended and restated certificate of incorporation provides that none of the Institutional Investors, any of their respective affiliates, or any director who is not employed by us (including any non-employee director who serves as one of our officers in both his director and officer capacities) or his or her affiliates will have any duty to refrain from engaging, directly or indirectly, in the same business activities or similar business activities or lines of business in which we operate. The Institutional Investors also may pursue acquisition opportunities that may be complementary to our business, and, as a result, those acquisition opportunities may not be available to us.

So long as the Institutional Investors continue to own a significant amount of our outstanding common stock, even if such amount is less than 50%, they will continue to be able to strongly influence or effectively control our decisions and, so long as each of the Institutional Investors continues to own shares of our outstanding common stock, they will have the ability to nominate individuals to our board of directors. See Part III, Item 13, “Certain Relationships and Related Transactions and Director Independence—Stockholders Agreement.” In addition, the Institutional Investors, acting together, will be able to determine the outcome of all matters requiring stockholder approval and will be able to cause or prevent a change of control of our company or a change in the composition of our board of directors and could preclude any unsolicited acquisition of our company. The concentration of ownership could deprive other stockholders of an opportunity to receive a premium for their shares of common stock as part of a sale of our company and ultimately might affect the market price of our common stock.

We are an “emerging growth company” and we cannot be certain if the reduced disclosure requirements applicable to “emerging growth companies” will make our common stock less attractive to investors.

We are an “emerging growth company,” as defined in Section 2(a)(19) of the Securities Act, and we may take advantage of certain exemptions and relief from various reporting requirements that are applicable to other public companies that are not “emerging growth companies.” In particular, while we are an “emerging growth company,” among other exemptions:

In addition, Section 107 of the JOBS Act provides that an emerging growth company can take advantage of the extended transition period provided in Section 7(a)(2)(B) of the Securities Act for complying with new or revised accounting standards, meaning that we can delay the adoption of certain accounting standards until those standards would otherwise apply to private companies. We have elected to take advantage of this extended transition period, and as a result, our financial statements may not be comparable with similarly situated public companies.

We will remain an “emerging growth company” until the earliest to occur of (1) our reporting of $1.24 billion or more in annual gross revenue; (2) our becoming a “large accelerated filer,” with at least $700 million of equity securities held by non-affiliates; (3) our issuance, in any three year period, of more than $1.0 billion in non-convertible debt; and (4) the fiscal year end following the fifth anniversary of the completion of our initial public offering.

We cannot predict whether investors will find our common stock less attractive if we rely on the exemptions and relief granted by the JOBS Act. For example, if we do not adopt a new or revised accounting standard, our future results of operations may not be as comparable to the results of operations of certain other companies in our industry that adopted such standards. If some investors find our common stock less attractive as a result, there may be a less active trading market for our common stock, and our stock price may decline and/or become more volatile.

We have incurred significant increased costs and become subject to additional regulations and requirements as a result of becoming a public company, and our management is required to devote substantial time to compliance matters.

As a public company, we have incurred and will continue to incur significant legal, regulatory, finance, accounting, investor relations, and other expenses that we did not incur as a private company, including costs associated with public company reporting requirements and costs of recruiting and retaining non- executive directors. We also have incurred and will continue to incur costs associated with the Sarbanes- Oxley Act and the Dodd-Frank Act, and related rules implemented by the SEC, and Nasdaq. The expenses incurred by public companies for reporting and corporate governance purposes have been increasing. These rules and regulations have increased our legal and financial compliance costs and have made some activities more time-consuming and costly. Our management devotes a substantial amount of time to ensure that we comply with all of these requirements, diverting the attention of management away from revenue- producing activities. These laws and regulations also could make it more difficult or costly for us to obtain certain types of insurance, including director and officer liability insurance, and we may be forced to accept reduced policy limits and coverage or incur substantially higher costs to obtain the same or similar coverage. These laws and regulations could also make it more difficult for us to attract and retain qualified persons to serve on our board of directors, our board committees, or as our executive officers. Furthermore, if we are unable to satisfy our obligations as a public company, we could be subject to delisting of our common stock, fines, sanctions, and other regulatory action and potentially civil litigation.

Failure to comply with requirements to design, implement, and maintain effective internal controls could have a material adverse effect on our business and stock price.

As a public company, we are subject to significant requirements for enhanced financial reporting and internal controls. The process of designing and implementing effective internal controls is a continuous effort that requires us to anticipate and react to changes in our business and the economic and regulatory environments and to expend significant resources to maintain a system of internal controls that is adequate to satisfy our reporting obligations as a public company. If we are unable to establish or maintain appropriate internal financial reporting controls and procedures, it could cause us to fail to meet our reporting obligations on a timely basis, result in material misstatements in our consolidated financial statements, and harm our results of operations. In addition, we are required, pursuant to Section 404(a) of the Sarbanes-Oxley Act (“Section 404”), to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting in the second annual report following the completion of our initial public offering. This assessment must include disclosure of any material weaknesses identified by our management in our internal control over financial reporting. The rules governing the standards that must be met for our management to assess our internal control over financial reporting are complex and require significant documentation, testing, and possible remediation. Testing and maintaining internal controls may divert our management’s attention from other matters that are important to our business. Once we are no longer an “emerging growth company,” our auditors will be required to issue an attestation report on the effectiveness of our internal controls on an annual basis.

In connection with the implementation of the necessary procedures and practices related to internal control over financial reporting, we may identify deficiencies that we may not be able to remediate in time to meet the deadline imposed by the Sarbanes-Oxley Act for compliance with the requirements of Section 404. In addition, we may encounter problems or delays in completing the remediation of any deficiencies identified by us or our independent registered public accounting firm in connection with the issuance of their attestation report. Our testing, or the subsequent testing (if required) by our independent registered public accounting firm, may reveal deficiencies in our internal controls over financial reporting that are deemed to be material weaknesses. Any material weaknesses could result in a material misstatement of our annual or quarterly financial statements or disclosures that may not be prevented or detected.

We may not be able to conclude on an ongoing basis that we have effective internal control over financial reporting in accordance with Section 404 or our independent registered public accounting firm may not issue an unqualified opinion. If either we are unable to conclude that we have effective internal control over financial reporting or our independent registered public accounting firm is unable to provide us with an unqualified report (to the extent it is required to issue a report), investors could lose confidence in our reported financial information, which could have a material adverse effect on the trading price of our common stock.

The market price of our common stock has been volatile and may continue to fluctuate substantially, which could result in substantial losses for purchasers of our common stock.

The stock market has experienced extreme volatility in the past. This volatility often has been unrelated or disproportionate to the operating performance of particular companies. Since shares of our common stock were sold in our IPO in June 2024 at a price of $21.50 per share, our stock price has ranged from $20.26 to $42.56 through February 12, 2025. The market price of our common stock has fluctuated in the past and may continue to fluctuate substantially due to a number of factors such as those listed in Part I, Item 1A, “Risk Factors—Risks Related to our Business and our Industry” and the following:

Furthermore, the stock markets in general have experienced extreme volatility that, in some cases, may be unrelated or disproportionate to the operating performance of particular companies. These broad market and industry fluctuations may adversely affect the market price of our common stock, regardless of our actual operating performance. In addition, price volatility may be greater if the public float and trading volume of our common stock are low.

In the past, following periods of market volatility, stockholders have instituted securities class action litigation. If we were to become involved in securities litigation, it could have a substantial cost and divert resources and the attention of executive management from our business regardless of the outcome of such litigation.

Future issuances of our common stock may dilute the percentage ownership of existing owners, which could reduce their influence over matters on which stockholders vote.

As of February 12, 2025, we have approximately 2,327,848,161 shares of common stock authorized but unissued. Our amended and restated certificate of incorporation authorizes us to issue these shares of common stock, other equity or equity-linked securities, options, and other equity awards relating to our common stock for the consideration and on the terms and conditions established by our board of directors in its sole discretion, whether in connection with acquisitions or otherwise. Issuances of common stock or voting preferred stock would reduce the influence of existing stockholders over matters on which our stockholders vote, and, in the case of issuances of preferred stock, would likely result in such existing owners’ interest in us being subject to the prior rights of holders of that preferred stock, if any.

We have reserved, or will reserve in the future, shares for issuance (i) for outstanding awards under our 2019 Stock Incentive Plan and for grants under our 2024 Equity Incentive Plan and (ii) under our 2024 Employee Stock Purchase Plan. See Part III, Item 11, “Executive Compensation—Equity Awards.” Any common stock that we issue, including under our 2019 Stock Incentive Plan, 2024 Equity Incentive Plan, 2024 Employee Stock Purchase Plan, or other equity incentive plans that we may adopt in the future, would dilute the percentage ownership of existing investors. In the future, we may also issue our securities in connection with investments or acquisitions. The amount of shares of our common stock issued in connection with an investment or acquisition could constitute a material portion of our then- outstanding shares of our common stock. Any issuance of additional securities in connection with investments or acquisitions may result in additional dilution to existing stockholders.

Because we have no current plans to pay cash dividends on our common stock, stockholders may not receive any return on investment unless they sell their shares of common stock for a price greater than that which they paid for it.

We have no current plans to pay cash dividends on our common stock. The declaration, amount, and payment of any future dividends will be at the sole discretion of our board of directors, and will depend on, among other things, general and economic conditions, our results of operations and financial condition, our available cash and current and anticipated cash needs, capital requirements, contractual, legal, tax, and regulatory restrictions and implications on the payment of dividends by us to our stockholders or by our subsidiaries to us, including restrictions under our credit agreements and other indebtedness we may incur, and such other factors as our board of directors may deem relevant. See Part II, Item 5, “Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities—Dividend Policy.”

As a result, stockholders may not receive any return on an investment in our common stock unless they sell our common stock for a price greater than their purchase price.

Future sales, or the perception of future sales, by us or our existing stockholders in the public market could cause the market price for our common stock to decline.

The sale of substantial amounts of shares of our common stock in the public market, or the perception that such sales could occur, could harm the prevailing market price of shares of our common stock. These sales, or the possibility that these sales may occur, also might make it more difficult for us to sell equity securities in the future at a time and at a price that we deem appropriate.

Pursuant to the Amended and Restated Registration Rights Agreement, dated as of June 10, 2024, by and among Waystar Holding Corp. and the other parties named therein, certain of our existing stockholders have the right, subject to certain conditions, to require us to register the sale of their shares of our common stock under the Securities Act. See Part III, Item 13, “Certain Relationships and Related Transactions and Director Independence—“Registration Rights Agreement.” By exercising their demand registration rights and selling a large number of shares, such existing stockholders could cause the prevailing market price of our common stock to decline. Registration of any of these outstanding shares of our common stock would result in such shares becoming freely tradable without compliance with Rule 144 upon effectiveness of the registration statement.

If the existing stockholders exercise their registration rights, the market price of our shares of common stock could drop significantly if the holders of these restricted shares sell them or are perceived by the market as intending to sell them. These factors could also make it more difficult for us to raise additional funds through future offerings of our shares of common stock or other securities.

If securities analysts do not publish research or reports about our business or if they downgrade our stock or our sector, our stock price and trading volume could decline.

The trading market for our common stock depends in part on the research and reports that industry or financial analysts publish about us or our business. We do not control these analysts. Furthermore, if one or more of the analysts who do cover us downgrade our stock or our industry, or the stock of any of our competitors, or publish inaccurate or unfavorable research about our business, the price of our stock could decline. If one or more of these analysts ceases coverage of us or fails to publish reports on us regularly, we could lose visibility in the market, which in turn could cause our stock price or trading volume to decline.

Anti-takeover provisions in our organizational documents could delay or prevent a change of control.

Certain provisions of our amended and restated certificate of incorporation and amended and restated bylaws may have an anti-takeover effect and may delay, deter, or prevent a merger, acquisition, tender offer, takeover attempt, or other change of control transaction that a stockholder might consider in its best interest, including those attempts that might result in a premium over the market price for the shares held by our stockholders. These provisions provide for, among other things:

Further, EQT has the right to nominate to our board of directors (i) two nominees for so long as EQT beneficially owns 25% or greater of our then-outstanding common stock and (ii) one nominee for so long as EQT beneficially owns 5% or greater, but less than 25%, of our then outstanding common stock. CPPIB has the right to nominate to our board of directors one nominee for so long as CPPIB beneficially owns 5% or greater of our then-outstanding common stock. Bain has the right to nominate to our board of directors one nominee for so long as Bain beneficially owns 5% or greater of our then-outstanding common stock.

These anti-takeover provisions could make it more difficult for a third party to acquire us, even if the third party’s offer may be considered beneficial by many of our stockholders. These provisions also may have the effect of preventing changes in our board of directors and may make it more difficult to accomplish transactions that stockholders may otherwise deem to be in their best interests. As a result, our stockholders may be limited in their ability to obtain a premium for their shares.

Our board of directors is authorized to issue and designate shares of our preferred stock in additional series without stockholder approval.

Our amended and restated certificate of incorporation authorizes our board of directors, without the approval of our stockholders, to issue 100,000,000 shares of our preferred stock, subject to limitations prescribed by applicable law, rules and regulations and the provisions of our amended and restated certificate of incorporation, as shares of preferred stock in series, to establish from time to time the number of shares to be included in each such series and to fix the designation, powers, preferences, and rights of the shares of each such series, and the qualifications, limitations, or restrictions thereof. The powers, preferences, and rights of these additional series of preferred stock may be senior to or on parity with our common stock, which may reduce its value.

Our amended and restated certificate of incorporation provides that the Court of Chancery of the State of Delaware (or if such court does not have jurisdiction, another state or the federal courts (as appropriate) located within the State of Delaware) will be the sole and exclusive forum for certain stockholder litigation matters, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers, employees, or stockholders.

Our amended and restated certificate of incorporation provides that unless we consent to the selection of an alternative forum, the Court of Chancery of the State of Delaware (or if such court does not have jurisdiction, another state or the federal courts (as appropriate) located within the State of Delaware) shall, to the fullest extent permitted by law, be the sole and exclusive forum for any (i) derivative action or proceeding brought on behalf of us, (ii) action asserting a claim of breach of a fiduciary duty owed by any current or former director, officer, or other employee or stockholder of ours to us or our stockholders, (iii) action asserting a claim against us or any director or officer of ours arising pursuant to any provision of the DGCL, or our amended and restated certificate of incorporation or our amended and restated bylaws or as to which the DGCL confers jurisdiction on the Court of Chancery of the State of Delaware, or (iv) action asserting a claim governed by the internal affairs doctrine of the State of Delaware. Our amended and restated certificate of incorporation further provides that, unless we consent in writing to the selection of an alternative forum, to the fullest extent permitted by law, the federal district courts of the United States of America will be the exclusive forum for the resolution of any complaint asserting a cause of action arising under the federal securities laws of the United States, including any claims under the Securities Act and the Exchange Act. However, Section 22 of the Securities Act creates concurrent jurisdiction for federal and state courts over all suits brought to enforce a duty or liability created by the Securities Act or the rules and regulations thereunder and accordingly, we cannot be certain that a court would enforce such provision.

Any person or entity purchasing or otherwise acquiring any interest in shares of our capital stock shall be deemed to have notice of and consented to the forum provisions in our amended and restated certificate of incorporation, except our stockholders will not be deemed to have waived (and cannot waive) compliance with the federal securities laws and the rules and regulations thereunder. This choice of forum provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or any of our directors, officers, other employees, or stockholders which may discourage lawsuits with respect to such claims. Alternatively, if a court were to find the choice of forum provision contained in our amended and restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could harm our business, results of operations, and financial condition.

Item 1B.Unresolved Staff Comments

None.

Item 1C.Cybersecurity

Cybersecurity Risk Management and Strategy

We have developed a cybersecurity risk management program to regularly assess risks from cybersecurity threats and monitor our systems to manage those risks. Our cybersecurity risk management program is an important component of, and integrated with, our overall enterprise risk management framework, which addresses legal, compliance, operational, and financial risks, alongside cybersecurity risks. Through this integration, we aim to optimize resource allocation, improve risk identification, and strengthen our cybersecurity governance.

Our cybersecurity risk management program is based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0) and is aimed to assess, identify, and manage risks from cybersecurity threats. The processes comprising our cybersecurity risk management program include risk assessments, vulnerability scanning and penetration testing, threat intelligence monitoring, and employee training and awareness programs. To respond to and handle cybersecurity incidents, we have implemented and maintain a comprehensive incident response process that is regularly tested and updated.

To protect our information systems from cybersecurity threats, we employ technical processes as a crucial component of our multi-layered cybersecurity risk management program. These processes include firewalls, intrusion detection and prevention systems, access controls, endpoint protection, data encryption, vulnerability management, security information event management, data loss prevention, regular security assessments, and penetration testing. Our technical processes are regularly reviewed and updated.

As part of our cybersecurity risk management program, we undergo regular assessments and audits by external and independent auditors. These include assessments following the Health Information Trust Alliance (HITRUST) Common Security Framework. We also undergo independent System and Organization Controls 2 (SOC 2) Type 2 audits and assessments to validate compliance with the Payment Card Industry Data Security Standard (PCI DSS) requirements. We carry a HITRUST certification and PCI certification. The results of these audits and assessments are reported to our Board of Directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary or appropriate based on the information provided by these assessments and audits.

Our cybersecurity team, which is led by our Digital Information & Cybersecurity Officer (DISO), implements and maintains our cybersecurity risk management program and is dedicated to mitigating risks and protecting the confidentiality, integrity, and availability of our systems and data. Our cybersecurity team’s functions include security operations, vulnerability management, security engineering and architecture, compliance and audit support, threat intelligence, security awareness training, and policy development. Our cybersecurity team is also responsible for developing and executing the incident response plan.

Because we rely on third-party vendors, including for information technology services, we have processes to oversee and identify risks from cybersecurity threats associated with our third-party vendors. These processes include vendor screening and due diligence, contractual requirements, security assessments and audits, incident response planning requirements, and ongoing monitoring.

We are not aware of any risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. As discussed more fully under Item 1A “Risk Factors,” there is a risk that we could experience a security incident and a compromise of our information technology systems and data. There is no assurance that our cybersecurity program will in all cases prevent such security incidents. We also maintain cybersecurity insurance that we regularly review to assess for appropriate coverage.

Cybersecurity Governance

Role of the Board

Our Board of Directors plays an active role in overseeing our cybersecurity risk management program. The Board of Directors or the Audit, Compliance, and Risk Committee receives a quarterly update on cybersecurity-related topics. The Board of Directors receives materials every quarter and presentations on alternating quarters from our Chief Technology Officer (CTO) on topics including significant cyberattacks and emerging threats, cybersecurity program performance, results of risk assessments, incident response updates, cybersecurity strategy, and cybersecurity program maturity. We have also established procedures for promptly informing the Board of Directors of any material cybersecurity incidents outside of these scheduled briefings.

Role of Management

Our DISO is responsible for developing and implementing our cybersecurity program and holds certifications including ISO/IEC 27001:2002 Certified Information Security Executive, Cyber Security Executive Certification from Cornell University, Risk & Compliance Executive Certification from William & Mary University, and Healthcare Risk & Compliance Certification from American College of Medical Practice Executives (ACMPE). Our DISO’s responsibilities include managing cybersecurity risk, leading the cybersecurity team, staying informed about threats, reporting on cybersecurity performance, promoting a culture of security, and compliance and audit support. Our DISO regularly updates senior management and the Board of Directors on the performance of the cybersecurity program and the state of cybersecurity risk. Our DISO reports directly to our CTO who provides executive leadership and support for the overall technology and cybersecurity strategy.

To promote strong governance and oversight in managing cybersecurity risk, we have established a Cyber Risk Council, which is composed of our CTO, DISO, Chief Privacy Officer, Chief Financial Officer, Chief Legal & Administrative Officer, and representatives of our technology and cybersecurity teams. The Cyber Risk Council is responsible for overseeing cybersecurity risk, monitoring performance of the cybersecurity risk management program, providing strategic guidance, and direction of the cybersecurity risk management program, among other oversight and monitoring functions.

Item 2.Properties

Our corporate headquarters are co-located in Lehi, Utah and Louisville, Kentucky. In addition to our headquarters, we have offices in Atlanta, Georgia and Duluth, Georgia. All of our facilities are leased and none of our facilities are used for any purpose other than general office use. We believe that our current facilities meet our needs and we are confident that we will be able to obtain, if needed, additional or different space on commercially reasonable terms to accommodate future growth.

Item 3.Legal Proceedings

We are subject to various claims and legal actions that arise in the ordinary course of our business, including claims resulting from employment related matters. We believe that we are not party to any material pending legal proceedings and we are not aware of any claims that could have a material effect on our business, financial condition, results of operations, or cash flows. However, a significant increase in the number of these claims or an increase in amounts owing under successful claims could materially and adversely affect our business, financial condition, results of operations, or cash flows.

Item 4.Mine Safety Disclosures

Not applicable.

​

Part II

Item 5.Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities

Our common stock trades on the Nasdaq Global Select Market under the symbol “WAY.” As of February 12, 2025, there were approximately 21 shareholders of record. This does not include persons whose stock is held in nominee or “street name” accounts through brokers.

Unregistered Sales of Equity Securities

During the twelve months ended December 31, 2024, we granted an aggregate of 4,003,703 stock options which were not registered under the Securities Act to employees, directors, and consultants under our 2019 Stock Incentive Plan and 2024 Equity Incentive Plan, with per share exercise prices ranging from $21.50 to $37.20. In addition, we issued 2,420 shares of common stock that were not registered under the Securities Act to employees, directors, or consultants under our 2019 Stock Incentive Plan upon the exercise of vested stock options with per share exercise prices ranging from $16.53 to $36.37.

None of the foregoing transactions involved any underwriters, underwriting discounts or commissions, or any public offering. The sales of the above securities were deemed to be exempt from registration under the Securities Act in reliance upon Section 4(a)(2) of the Securities Act (or Regulation D or Regulation S promulgated thereunder) or Rule 701 promulgated under Section 3(b) of the Securities Act as transactions by an issuer not involving any public offering or pursuant to benefit plans and contracts relating to compensation as provided under Rule 701. The recipients of the securities in each of these transactions represented their intentions to acquire the securities for investment only and not with a view to or for sale in connection with any distribution thereof and appropriate legends were placed upon the stock certificates issued in these transactions.

Purchases of Equity Securities by Issuer

During the three months ended December 31, 2024, we did not repurchase any of our equity securities that are registered pursuant to Section 12(b) of the Securities Exchange Act of 1934.

Dividend Policy

We currently expect to retain all future earnings for use in the operation and expansion of our business and have no current plans to pay dividends on our common stock. The declaration, amount, and payment of any future dividends will be at the sole discretion of our board of directors, and will depend on, among other things, general and economic conditions, our results of operations and financial condition, our available cash and current and anticipated cash needs, capital requirements, contractual, legal, tax and regulatory restrictions and implications on the payment of dividends by us to our stockholders or by our subsidiaries to us, including restrictions under our credit agreements and other indebtedness we may incur, and such other factors as our board of directors may deem relevant. If we elect to pay such dividends in the future, we may reduce or discontinue entirely the payment of such dividends at any time.

​

Stock Performance Graph

The graph below compares the cumulative total stockholder return on our common stock with the cumulative total return on the Nasdaq Global Composite Index and the S&P 600 Information Technology Index, assuming an initial investment of $100 at the market close of June 7, 2024, the date our stock commenced trading on the Nasdaq. Data for the Nasdaq Global Composite Index and the S&P 600 Information Technology Index assumes reinvestment of dividends. We did not declare cash dividends on our common stock in 2024. The comparisons in the graph below are based on historical data and are not indicative of, nor intended to forecast, future performance of our common stock.

​

*$100 invested on June 7, 2024, including reinvestment of dividends.

Source Data: FactSet

The performance graph and related information shall not be deemed “soliciting material”, is not deemed “filed” with the SEC, and is not to be incorporated by reference into any future filing under the Securities Act or Exchange Act.

Item 6.Reserved

​

​

Item 7.Management’s Discussion and Analysis of Financial Condition and Results of Operations

The following discussion and analysis of Waystar Holding Corp. (“Waystar”, the “Company”, “we”, “us”, and “our”) financial condition and results of operations should be read in conjunction with our consolidated financial statements and the related notes included elsewhere in this Form 10-K. In addition to historical information, this discussion and analysis contains forward-looking statements based on current expectations that involve risks, uncertainties, and other factors outside the Company’s control, as well as assumptions, such as our plans, objectives, expectations, and intentions. Our actual results may differ materially from those expressed or implied in the forward-looking statements as a result of various factors, including those described under the section entitled “Cautionary Statement Concerning Forward-Looking Statements” above and Part I, Item 1A, “Risk Factors” in this Form 10-K and our other filings with the SEC.

Overview

Waystar provides healthcare organizations with mission-critical cloud software that simplifies healthcare payments. Our enterprise-grade platform streamlines the complex and disparate processes our healthcare provider clients must manage to be reimbursed correctly, while improving the payments experience for providers, patients, and payers. We leverage AI as well as proprietary, advanced algorithms to automate payment-related workflow tasks and drive continuous improvement, which enhances claim and billing accuracy, enriches data integrity, and reduces labor costs for providers.

Our software is used daily by providers of all types and sizes across the continuum of care, including physician practices, clinics, surgical centers, and laboratories, as well as large hospitals and health systems. We currently serve over 30,000 clients of various sizes, representing over one million distinct providers practicing across a variety of care sites, including 16 of the top 20 institutions on the U.S. News Best Hospitals Honor Roll. Our business model is designed such that as our clients grow to serve more patients, their claims and transactional volumes increase, resulting in corresponding growth in our business. In addition, our clients frequently adopt a greater number of our solutions over time and introduce our solutions across new sites of care. In 2024, we facilitated over six billion healthcare payments transactions, including over $1.8 trillion in gross claims volume. As of 2023, we facilitated healthcare payments transactions spanning approximately 50% of patients in the United States.

Our platform benefits from powerful network effects. Our cloud-based software is driven by a sophisticated, automated, and curated rules engine, employing AI to generate and incorporate real-time feedback from millions of network transactions processed through our platform each day. Every transaction we process provides additional data insights across providers, patients, and payers, which are embedded in updates that are deployed efficiently across our client base. This results in cumulative benefits to us over time —as we capture more data from each transaction we process, we leverage that data to continue to improve the Waystar platform through embedded machine learning, advanced algorithms, and other in-house AI technologies to deliver added value to our clients. In turn, the more value we create for our clients, the more likely it is that they will continue to use our products, allowing us to continue to capture more data that results in tangible improvements to our platform. As a result, our clients benefit from faster and more efficient performance from software that is evolving to meet ever-changing regulatory and payer requirements, enabling accurate and timely reimbursement.

We have demonstrated an ability to drive recurring, predictable, and profitable growth. Over 99% of our revenue is either recurring subscription or based on highly predictable volumes. For the twelve months ended December 31, 2024, our Net Revenue Retention Rate was 110.1% and we have 1,203 clients as of December 31, 2024 generating over $100,000 over the same twelve-month period. For the year ended December 31, 2024, we generated revenue of $943.5 million (reflecting a 19.3% increase compared to revenue of $791.0 million for the same period in the prior year), net loss of $19.1 million (compared to net loss of $51.3 million for the same period in the prior year), and Adjusted EBITDA of $383.5 million (reflecting a 14.9% increase compared to Adjusted EBITDA of $333.7 million for the same period in the prior year).

Initial Public Offering

In June 2024, we completed an IPO of 45,000,000 shares of common stock at a price of $21.50 per share. After underwriting discounts and commissions of $53.2 million, we received total proceeds from the offering of $914.3 million. On July 5, 2024, pursuant to the option granted to the underwriters for a period of 30 days from the date of the prospectus to purchase up to 6,750,000 additional shares of common stock from us at the IPO price less the underwriting discount, the underwriters exercised the right to purchase 5,059,010 additional shares of common stock, resulting in additional net proceeds of $102.8 million, after deducting underwriting discounts and commissions of $6.0 million. The remaining option to purchase additional shares expired unexercised at the end of the 30-day period. See Part II, Item 8, “Financial Statements—Note 1 (Business)”, for more information.

Significant Items Affecting Comparability

We believe that the future growth and profitability of our business, and the comparability of our results from period to period, depend on numerous factors, including the following:

Our Ability to Expand our Relationship with Existing Clients

As our clients grow their businesses and provide more services and see more patients, our volume-based revenues also increase. In addition, our growth in revenues also depends on our ability to sell more products and solutions to existing clients, including through cross-selling as our clients adopt additional Waystar offerings as well as up-selling as our clients leverage our solutions across additional providers and sites of care.

Our Ability to Grow our Client Base

We are focused on continuing to grow our client base, which will depend in part on our ability to continue to maintain our product leadership, invest in our research and development team, and maintain our reputation and brand.

Timing and Number of Acquisitions

Since 2018, we have completed and successfully integrated nine acquisitions, two of which closed in the second half of 2023; HealthPay24 on August 3, 2023; and certain assets of Olive AI, Inc.’s Clearinghouse and Patient Access business on October 31, 2023. The historical results of operations of our acquisitions are only included starting from the date of closing of such acquisition. As a result, our consolidated statements of operations for any given period during which an acquisition closed may not be comparable to future periods, which would include the results of operations of such acquisition for the entirety of such future period.

Impacts of Our Competitor’s Cybersecurity Attack

Following the February 2024 cybersecurity incident involving one of our competitors, more than 30,000 providers, including a significant number of large health systems and ambulatory providers, began adopting our solutions, and we were able to implement our solutions for many of these new clients in as little as 48 hours. This incident and our response to it generated approximately $34 million in additional revenue in the year ended December 31, 2024 due to increased win rates above our historically competitive rates and associated accelerated implementation timeline.

Impacts of the IPO

Components of Results of Operations

Revenue

We primarily generate two types of revenue: (i) subscription revenue and (ii) volume-based revenue, which account for 99% of total revenue for all periods presented. We believe we have high visibility into our volume-based and subscription revenue from existing clients. We refer to the solutions our clients use to better process and understand their payment workflows from payers as provider solutions, and we refer to the products that assist healthcare providers in collecting payments from patients as patient payment solutions. We expect provider solutions will continue to generate the substantial majority of our total revenue, although the revenue mix attributable to patient payment solutions is expected to increase slightly over time.

We also derive revenue from implementation fees for our software, as well as hardware sales to facilitate patient payments. Our implementation fees are billed upfront, and the revenue is recognized ratably over the contract term.

Cost of Revenue (Exclusive of Depreciation and Amortization)

Cost of revenue includes salaries, stock-based compensation, and benefits (“personnel costs”) for our team members who are focused on implementation, support, and other client-focused operations, as well as team members focused on enhancing and developing our platform. Cost of revenue also includes costs for third-party technology such as interchange fees and infrastructure related to the operations of our platform, including communicating and processing patient payments, and services to support the delivery of our solutions. Third-party costs for patient payments solutions are approximately 60% of the revenue generated from these solutions, while third-party costs for provider solutions are approximately 6% to 8% of the associated revenue, in each case, for the years ended December 31, 2024 and 2023.

Sales and Marketing

Sales and marketing costs consist primarily of personnel costs, internal sales commissions, channel partner fees, travel, and advertising costs.

General and Administrative

General and administrative expenses consist of personnel costs incurred in our corporate service functions such as finance expenses, legal, human resources, and information technology, as well as other professional service costs.

Research and Development

Research and development (“R&D”) costs consist primarily of personnel costs for team members engaged in research and development activities as well as third-party fees. All such costs are expensed as incurred, except for capitalized software development costs.

Depreciation and Amortization

Depreciation and amortization consists of the depreciation of property and equipment and amortization of certain intangible assets, including capitalized software.

Other Expense

Other expense consists primarily of interest expense and related-party interest expense, inclusive of the impact of interest rate swaps.

Income Tax Benefit

Income tax benefit includes current income tax and income tax credits from deferred taxes. Income tax benefit is recognized in profit and loss except to the extent that it relates to items recognized in equity or other comprehensive income, in which case the income tax expense is also recognized in equity or other comprehensive income.

Results of Operations for the Years Ended December 31, 2024, 2023 and 2022

The following table provides consolidated operating results for the periods indicated and percentage of revenue for each line item:

​

Revenue

​

Revenue was $943.5 million for the year ended December 31, 2024 as compared to $791.0 million for the year ended December 31, 2023, an increase of $152.5 million, or 19.3%, of which $57.0 million was attributed to subscription revenue from new and existing clients, with $54.8 million generated by provider solutions, and $2.2 million generated from patient payments solutions. Another $93.6 million was attributed to volume-based revenue primarily related to expansion of existing client usage and acquired clients, of which $36.5 million was generated by provider solutions and $57.1 million by patient payments solutions.

Included within the revenue increases over the period is an estimated $34 million increase due to our heightened win rates above our historically high rates and accelerated implementation timelines as well as increased volume-based revenue from existing clients related to the cybersecurity incident involving one of our competitors in February 2024.

Revenue was $791.0 million for the year ended December 31, 2023 as compared to $704.9 million for the year ended December 31, 2022, an increase of $86.1 million, or 12.2%, of which $34.3 million was attributed to subscription revenue primarily from existing clients, with $31.9 million generated by provider solutions, and $2.4 million generated from patient payments solutions. Another $50.8 million was attributed to volume-based revenue primarily related to expansion of existing client usage and acquired clients, of which $20.9 million was generated by provider solutions and $29.9 million by patient payments solutions.

Cost of Revenue (Exclusive of Depreciation and Amortization)

Cost of revenue was $315.7 million for the year ended December 31, 2024 as compared to $249.8 million for the year ended December 31, 2023, an increase of $66.0 million, or 26.4%. The increase was primarily driven by $52.3 million in increased costs stemming from higher transaction volume and associated third-party costs, including higher platform usage, of which approximately $13.1 million was from costs associated with provider solutions and $39.2 million from patient payments solutions. In addition, there was an $8.0 million increase in personnel costs and a $2.3 million increase in stock-based compensation expense primarily related to the recognition of performance condition options and new option and RSU grants related to the June IPO.

Cost of revenue was $249.8 million for the year ended December 31, 2023 as compared to $214.9 million for the year ended December 31, 2022, an increase of $34.9 million, or 16.2%. The increase was primarily driven by $28.5 million in increased costs stemming from higher transaction volume and associated third-party costs, including higher platform usage, of which approximately $9.5 million was from costs associated with provider solutions and $19.0 million from patient payments solutions. In addition, there was a $4.6 million increase in personnel costs.

Sales and Marketing

Sales and marketing expense was $156.9 million for the year ended December 31, 2024 as compared to $124.4 million for the year ended December 31, 2023, an increase of $32.5 million, or 26.1%. The increase was driven by an increase in channel partner fees and amortization of the internal sales commission deferred contract costs assets of $16.3 million associated with revenue growth. Additionally, there was an increase of $10.6 million in stock-based compensation expense related to the recognition of performance condition options and new option and RSU grants related to the June IPO.

Sales and marketing expense was $124.4 million for the year ended December 31, 2023 as compared to $111.5 million for the year ended December 31, 2022, an increase of $13.0 million, or 11.6%. The increase was primarily driven by an increase in channel partner fees and internal commissions of $9.1 million, an increase in marketing expenses of $0.8 million and an increase in third-party professional fees of $0.7 million.

General and Administrative

General and administrative expense was $111.8 million for the year ended December 31, 2024 as compared to $62.9 million for the year ended December 31, 2023, an increase of $48.8 million, or 77.6%. The increase was driven by a $26.3 million increase in stock-based compensation expense primarily related to the recognition of performance condition options and new option and RSU grants related to the June IPO. Additionally, there was an increase in third party fees of $14.1 million expensed as incurred, of which $10.3 million related to the debt modification related to the refinancing of the First Lien Credit Facility in February, $2.4 million related to the debt re-pricing in June, $1.3 million related to the debt re-pricing in December and $0.1 million relates to the payoff of the Second Lien Credit Facility in February.

General and administrative expense was $62.9 million for the year ended December 31, 2023 as compared to $73.1 million for the year ended December 31, 2022, a decrease of $10.2 million, or 13.9%. The decrease was primarily driven by an impairment expense recognized in 2022 related to leasehold improvements and right-of-use assets at closed office locations of $10.9 million.

Research and Development

Research and development expense was $48.8 million for the year ended December 31, 2024 as compared to $35.3 million for the year ended December 31, 2023, an increase of $13.4 million, or 38.0%. The increase was driven by higher personnel costs, net of capitalized expenses, of $7.3 million increase and increased third party consulting and engineering efforts. Additionally, there was increased stock-based compensation expense of $7.0 million primarily related to the recognition of performance condition options and new option and RSU grants related to the June IPO.

Research and development expense was $35.3 million for the year ended December 31, 2023 as compared to $32.8 million for the year ended December 31, 2022, an increase of $2.5 million, or 7.7%. The increase was primarily driven by higher personnel costs, net of capitalized expenses, of $1.5 million and increased third party consulting and engineering efforts, net of capitalized amounts, of $0.4 million.

Depreciation and Amortization

Depreciation and amortization expense was $186.6 million for the year ended December 31, 2024, as compared to $176.5 million for the year ended December 31, 2023, an increase of $10.2 million, or 5.8%. Due to the relocation of one of our offices, we reduced the useful life of the related finance lease and leasehold improvement assets which represented $17.9 million of accelerated depreciation for the year ended December 31, 2024. This was offset by several intangibles fully matured in 2024, driving a decrease in intangible amortization.

Depreciation and amortization expense was $176.5 million for the year ended December 31, 2023 as compared to $183.2 million for the year ended December 31, 2022, a decrease of $6.7 million, or 3.7%. The decrease was primarily driven by $6.3 million of amortization in 2022 related to intangible assets that were fully amortized as of January 1, 2023.

Other Expense

Total interest expense was $146.3 million for the year ended December 31, 2024 as compared to $205.9 million for the year ended December 31, 2023, a decrease of $59.6 million, or 29.0%. The decrease was driven by the First Lien Credit Facility paydown during 2024 totaling $1.0 billion and the full paydown of the Second Lien Credit Facility.

Total interest expense was $205.9 million for the year ended December 31, 2023 as compared to $155.3 million for the year ended December 31, 2022, an increase of $50.6 million, or 32.6%, of which $48.6 million was primarily related to higher interest expense driven by higher interest rates with respect to our First Lien Credit Facility and Second Lien Credit Facility, which is net of the impact of interest rate swaps.

Income Tax Expense/ (Benefit)

Income tax benefit was $3.4 million for the year ended December 31, 2024, as compared to an income tax benefit of $12.5 million for the year ended December 31, 2023, a decrease of $9.1 million. The decrease was primarily driven by our net loss has decreased year over year, which is driven by a decrease in interest expense for the year ended December 31, 2024.

Income tax benefit was $12.5 million for the year ended December 31, 2023 as compared to $14.4 million for the year ended December 31, 2022, a decrease of $1.9 million, or 13.3%. The decrease was primarily driven by decrease in pre-tax loss.

Non-GAAP Financial Measures

We present adjusted EBITDA, adjusted EBITDA margin, non-GAAP net income/(loss), and non-GAAP net income/(loss) per share as supplemental measures of financial performance that are not required by, or presented in accordance with, GAAP. We believe they assist investors and analysts in comparing our operating performance across reporting periods on a consistent basis by excluding items that we do not believe are indicative of our core operating performance. Management believes these non-GAAP financial measures are useful to investors in highlighting trends in our operating performance, while other measures can differ significantly depending on long-term strategic decisions regarding capital structure, the tax jurisdictions in which we operate, and capital investments. Management uses these non-GAAP financial measures to supplement GAAP measures of performance in the evaluation of the effectiveness of our business strategies, to make budgeting decisions, to establish discretionary annual incentive compensation, and to compare our performance against that of other peer companies using similar measures. Management supplements GAAP results with non-GAAP financial measures to provide a more complete understanding of the factors and trends affecting the business than GAAP results alone provide.

Adjusted EBITDA, adjusted EBITDA margin, non-GAAP net income / (loss), and non-GAAP net income / (loss) per share are not recognized terms under GAAP and should not be considered as an alternative to net income (loss) or net income (loss) margin as measures of financial performance or cash provided by operating activities as a measure of liquidity, or any other performance measure derived in accordance with GAAP. Additionally, these measures are not intended to be a measure of free cash flow available for management’s discretionary use, as they do not consider certain cash requirements such as interest payments, tax payments, and debt service requirements. The presentations of these measures have limitations as analytical tools and should not be considered in isolation, or as a substitute for analysis of our results as reported under GAAP. Because not all companies use identical calculations, the presentations of these measures may not be comparable to other similarly titled measures of other companies and can differ significantly from company to company. A reconciliation is provided below for our non-GAAP financial measures to the most directly comparable financial measure stated in accordance with GAAP. Investors are encouraged to review the related GAAP financial measures and the reconciliation of non-GAAP financial measures to their most directly comparable GAAP financial measures, and not to rely on any single financial measure to evaluate our business.

Adjusted EBITDA and Adjusted EBITDA Margin

We define adjusted EBITDA as net loss before interest expense, net, income tax benefit, depreciation and amortization, and as further adjusted for stock-based compensation expense, acquisition and integration costs, asset and lease impairments, costs related to amended debt agreements, and IPO related costs. Adjusted EBITDA margin represents adjusted EBITDA as a percentage of revenue.

The following table presents a reconciliation of net loss to adjusted EBITDA and net loss margin to adjusted EBITDA margin for the years ended December 31, 2024, 2023 and 2022:

Non-GAAP Net Income / (Loss) and Non-GAAP Net Income / (Loss) Per Share

We define non-GAAP net income as GAAP net income excluding the impact of stock-based compensation, acquisition and integration costs, asset and lease impairments, IPO related costs, costs related to amended debt agreements and amortization of intangibles. We updated the definition of non-GAAP net income to include amortization of intangibles to align with a more common definition used by our peers. We have revised prior year disclosures to align with this updated definition. The tax effects of the adjustments are calculated using a management estimated annual effective non-GAAP tax rate of 21%.

Non-GAAP net income / (loss) per share is shown on both a basic and diluted basis and is defined as non-GAAP net income / (loss) divided by the basic or diluted weighted-average shares, respectively.

The following table presents a reconciliation of net loss to non-GAAP net income / (loss) and non-GAAP net income / (loss) per share for the years ended December 31, 2024, 2023 and 2022:

Key Performance Metrics

Net Revenue Retention Rate

We also regularly monitor and review our Net Revenue Retention Rate.

The following table presents our Net Revenue Retention Rate for December 31, 2024, 2023 and 2022, respectively:

​

Our Net Revenue Retention Rate compares twelve months of client invoices for our solutions at two period end dates. To calculate our Net Revenue Retention Rate, we first accumulate the total amount invoiced during the twelve months ending with the prior period-end, or Prior Period Invoices. We then calculate the total amount invoiced to those same clients for the twelve months ending with the current period-end, or Current Period Invoices. Current Period Invoices are inclusive of upsell, downsell, pricing changes, clients that cancel or chose not to renew, and discontinued solutions with continuing clients. The Net Revenue Retention Rate is then calculated by dividing the Current Period Invoices by the Prior Period Invoices. Our total invoices included in the analysis are greater than 98% of reported revenue. We use Net Revenue Retention Rate to evaluate our ongoing operations and for internal planning and forecasting purposes. Acquired businesses are included in the last-twelve month Net Revenue Retention Rate in the ninth quarter after acquisition, which is the earliest point that comparable post-acquisition invoices are available for both the current and prior twelve-month period.

Customer Count with >$100,000 Revenue

We also regularly monitor and review our count of clients who generate more than $100,000 of revenue.

The following table sets forth our count of clients who generate more than $100,000 of revenue for the periods presented:

​

Our count of clients who generate more than $100,000 of revenue is based on an accumulation of the amounts invoiced to clients over the preceding twelve months. The invoices for acquired clients are included starting in the first full calendar quarter after the date of acquisition.

Liquidity and Capital Resources

Overview

We assess our liquidity in terms of our ability to generate adequate amounts of cash to meet current and future needs. Our expected primary uses on a short-term and long-term basis are for working capital, capital expenditures, debt service requirements, and investments in future growth, including acquisitions. We have historically funded our operations and acquisitions through our cash and cash equivalents, cash flows from operations, and debt financings. We believe that our existing unrestricted cash on hand, expected future cash flows from operations, and additional borrowings will provide sufficient resources to fund our operating requirements, as well as future capital expenditures, debt service requirements, and investments in future growth for at least the next 12 months. To the extent additional funds are necessary to meet our long-term liquidity needs as we continue to execute our business strategy, we anticipate that they will be obtained through the incurrence of additional indebtedness, additional equity financings, or a combination of these potential sources of funds. In the event that we need access to additional cash, we may not be able to access the credit markets on commercially acceptable terms or at all. Our ability to fund future operating expenses and capital expenditures and our ability to meet future debt service obligations or refinance our indebtedness will depend on our future operating performance, which will be affected by general economic, financial, and other factors beyond our control, including those described under Part I, Item 1A, “Risk Factors” in this report.

On December 31, 2024 and 2023, we had restricted cash of $22.4 million and $9.8 million, respectively, which consists of cash deposited in lockbox accounts owned by us which are contractually required to be disbursed to participating clients on the following day, as well as cash collected on behalf of healthcare providers from patients that have not yet been remitted to providers. These funds payable are not available for our use and liquidity, and are offset on our balance sheet by an aggregated funds payable liability.

Our liquidity is influenced by many factors, including timing of revenue and corresponding cash collections, the amount and timing of investments in strategic initiatives, our investments in property, equipment, and software, as well as other factors described under Part I, Item 1A, “Risk Factors” in this report. Depending on the severity and direct impact of these factors on us, we may not be able to secure additional financing on acceptable terms, or at all.

Cash Flows

Cash flows from operating, investing, and financing activities for the years ended December 31, 2024, 2023 and 2022, are summarized in the following table:

​

Cash Flows Provided by Operating Activities

Cash flows provided by operating activities were $169.8 million for the year ended December 31, 2024 as compared to $51.5 million for the year ended December 31, 2023. This increase was largely driven by the changes in working capital, increases in revenue and profits, and decreases in the cash paid for interest due to the multiple paydowns on our First Lien Credit Facility in 2024.

Cash flows provided by operating activities were $51.5 million for the year ended December 31, 2023 as compared to $102.6 million for the year ended December 31, 2022. The decrease was primarily driven by the change in deferred income taxes and income tax receivable resulting in a decrease of $43.4 million and by an impairment expense of $10.9 million recognized in 2022 related to leasehold improvements and right-of-use assets at closed office locations.

Cash Flows Used in Investing Activities

Cash flows used in investing activities were $27.3 million for the year ended December 31, 2024 as compared to $61.5 million for the year ended December 31, 2023. Cash flows used in investing activities decreased due to the $40.0 million of cash used in the 2023 acquisitions of HealthPay24 and certain assets of Olive AI (see Part II, Item 8, “Financial Statements—Note 6”).

Cash flows used in investing activities were $61.5 million for the year ended December 31, 2023 as compared to $17.4 million for the year ended December 31, 2022. Cash flows used in investing activities increased in 2023 relative to 2022 as we used $40.0 million for acquisitions completed in 2023.

Cash Flows Provided By (Used In) Financing Activities

Cash flows provided by financing activities were $16.7 million for the year ended December 31, 2024 as compared to cash flows used of $17.2 million for the year ended December 31, 2023. The increase was due to the proceeds from our IPO net of third-party IPO issuance costs (see Part II, Item 8, “Financial Statements—Note 1”), as well as the issuance of debt, net of creditor fees (see Part II, Item 8, “Financial Statements—Note 11). These increases were offset by increased payments on our debt compared to the prior period (see Part II, Item 8, “Financial Statements—Note 11”).

Cash flows used in financing activities were $17.2 million for the year ended December 31, 2023 as compared to $67.1 million for the year ended December 31, 2022. Cash flows used in financing activities decreased in 2023 relative to 2022 primarily due to the $47.0 million partial pay down in principal of the Second Lien Credit Facility in April 2022.

Indebtedness

First Lien Credit Facilities

Our indirect wholly-owned subsidiary, Waystar Technologies, Inc., a Delaware corporation (the “Borrower”), is the Borrower under a first lien credit agreement, dated as of October 22, 2019 (as amended from time to time, the “First Lien Credit Agreement”), that initially provided for an $825.0 million senior secured first lien term loans and commitments under a revolving credit facility in an aggregate principal amount of $125.0 million, with a sub-commitment for issuance of letters of credit of $25.0 million. The initial first lien term loans are scheduled to mature on October 22, 2026 and commitments under the revolving credit facility and the loans thereunder were initially scheduled to terminate and mature on October 22, 2024.

On December 1, 2019, the Borrower and certain lenders amended the First Lien Credit Agreement to add 2019 first lien incremental term loans in the amount of $100.0 million to be used for certain acquisitions consummated substantially simultaneously with the closing of such amendment. The terms of such 2019 first lien incremental term loans were the same as the terms of the initial first lien term loans, including in respect of maturity, and were considered an increase in the aggregate principal amount of the initial first lien term loans outstanding under the First Lien Credit Agreement and were part of the initial first lien term loans.

On September 23, 2020, the Borrower and certain lenders amended the First Lien Credit Agreement to (i) add 2020 first lien incremental term loans in the amount of $620.0 million to be used for certain acquisitions consummated substantially simultaneously with the closing of such amendment and (ii) add revolving credit commitments in the amount of $75.0 million to increase the revolving credit commitments available under the First Lien Credit Agreement to $200.0 million. Such 2020 first lien incremental term loans constituted a separate class of first lien term loans from the initial first lien term loans but were otherwise on the same as the terms of the initial first lien term loans (other than with respect to the “LIBOR-floor” applicable thereto).

On March 24, 2021, the Borrower and certain lenders amended the First Lien Credit Agreement to (i) reduce the “LIBOR-floor” applicable to the 2020 first lien incremental term loans and (ii) in connection therewith, combine the initial first lien term loans with the 2020 first lien incremental term loans which thereafter then constituted one class of first lien term loans.

On August 24, 2021, the Borrower and certain lenders amended the First Lien Credit Agreement to add 2021 first lien incremental term loans in the amount of $247.0 million to be used for certain acquisitions consummated substantially simultaneously with the closing of such amendment. The terms of such 2021 first lien incremental term loans were the same as the terms of the initial first lien term loans outstanding at such time, including in respect of maturity, and were considered an increase in the aggregate principal amount of the initial first lien term loans outstanding under the First Lien Credit Agreement at such time and were part of the initial first lien term loans.

On June 1, 2023, the Borrower and certain lenders amended the First Lien Credit Agreement to replace all LIBOR-based interest rates applicable to borrowings under the revolving credit facility with a Term SOFR-based rate plus a credit spread adjustment of 0.11%.

On June 23, 2023, the Borrower and certain lenders amended the First Lien Credit Agreement to replace all LIBOR-based interest rates applicable to the first lien term loans with a Term SOFR-based rate plus a credit spread adjustment of 0.11%.

On October 6, 2023, the Borrower and certain lenders amended the First Lien Credit Agreement to, among others, (i) increase the revolving credit commitments under the First Lien Credit Agreement by $142.5 million to a total of $342.5 million, with a sub-commitment for issuance of letters of credit of $50.0 million, (ii) amend the applicable margin with respect thereto upon the consummation of a qualifying initial public offering, and (iii) extend the availability period of such revolving credit commitments and the maturity date of loans thereunder from October 22, 2024 to October 6, 2028; provided that if, prior to October 6, 2028, either (i) on the date that is 91 days prior to the maturity date of the first lien term loans (or any loans refinancing such first lien term loans), more than $150.0 million of such first lien term loans (or any such loans refinancing such first lien term loans) are outstanding or (ii) on the date that is 91 days prior to the maturity date of the second lien term loans under the Second Lien Credit Facility (or any loans refinancing such second lien term loans), any such second lien term loans (or any such loans refinancing such second lien term loans) are outstanding, the commitments under the revolving credit facility and the loans thereunder will terminate and mature on such date (the “Springing Maturity Condition”). The revolving credit commitments as increased by the amendment replaced the existing revolving credit commitments under the First Lien Credit Agreement.

On February 9, 2024, the Borrower and certain lenders amended the First Lien Credit Agreement to, among others, (i) increase the total First Lien Credit Facility term loan balance to $2.2 billion, $449.6 million of which was utilized to pay off the remaining principal and interest on the Second Lien Credit Facility, and (ii) extend the maturity date of the First Lien Credit Facility to October 22, 2029. As of February 9, 2024, the effective interest rate under the First Lien Credit Facility was 4.00% per annum above the SOFR rate.

On June 27, 2024, the Borrower and certain lenders amended the First Lien Credit Agreement to, among other things, reprice the outstanding balance bearing an interest rate of 2.75% per annum above the SOFR rate with a minimum base of 0.00%.

On December 30, 2024, the Borrower and certain lenders amended the First Lien Credit Agreement to, among other things, (i) fully refinance the Borrower’s $1,166,772,750 aggregate outstanding principal amount of term loans under the Existing Credit Agreement with replacement term loans bearing reduced interest at a rate per annum equal to, at the election of the Borrower, either (a) Adjusted Term SOFR (as defined in the First Lien Credit Agreement) subject to a floor of 0.00%, plus an applicable rate of 2.25% (compared to the previous applicable rate of 2.75%) or (b) the Alternate Base Rate (as defined in the First Lien Credit Agreement) subject to a floor of 1.00%, plus an applicable rate of 1.25% (compared to the previous applicable rate of 1.75%), (ii) increase the maximum borrowing capacity under the Revolving Credit Facility from $342.5 million to $400.0 million and (iii) reduce the interest rates under the Revolving Credit Facility to (a) Adjusted Term SOFR, plus an initial applicable rate of 1.75% (compared to the previous applicable rate of 2.25%) with adjustments to an applicable rate between 1.75% and 2.50% and (b) the Alternate Base Rate, plus an initial applicable rate of 0.75% (compared to the previous applicable rate of 1.25%) with adjustments to an applicable rate between 0.75% and 1.50%. Such adjustments will depend on the achievement of certain leverage ratios specified in the First Lien Credit Agreement.

All obligations under the First Lien Credit Agreement are unconditionally guaranteed on a senior first lien priority basis by, subject to certain exceptions, the Borrower and each of the Borrower’s existing and subsequently acquired or organized direct or indirect wholly owned restricted subsidiaries organized in the United States. Additionally, the obligations under First Lien Credit Agreement and such guarantees are secured on a first lien priority basis, subject to certain exceptions and excluded assets, by (i) the equity securities of the Borrower and of each subsidiary guarantor and (ii) security interests in, and mortgages on, substantially all personal property and material owned real property by the Borrower and each subsidiary guarantor.

Borrowings under the First Lien Credit Agreement currently bear interest at a rate per annum equal to, at the option of the Borrower, either (i) (x) the Term SOFR rate for the applicable interest period, with a floor of 0.00%, plus (y) an applicable margin rate of, for the first lien term loans, between 3.75% and 3.50% and, for loans under the revolving credit facility, between 3.00% and 2.25%, in each case, depending on the applicable first lien leverage ratio or (ii) (x) an alternate base rate (“ABR”), with a floor of 1.00%, plus (y) an applicable margin rate of, for the first lien term loans, between 2.75% and 2.50% and, for loans under the revolving credit facility, between 2.00% and 1.25%, in each case, depending on the applicable first lien leverage ratio (with the ABR determined as the greatest of (a) the prime rate, (b) the federal funds effective rate plus 0.50%, and (c) the Term SOFR rate plus 1.00%).

In addition to paying interest on outstanding principal under the first lien term loans and the revolving credit facility, the Borrower is required to pay a commitment fee, payable quarterly in arrears, of 0.375% per annum on the average daily unused portion of the revolving credit facility, with step-down to 0.25% per annum, in each case, on such portion upon achievement of certain first lien leverage ratios. The Borrower must also pay customary letter of credit issuance and participation fees and other customary fees and expenses of the letter of credit issuers.

The Borrower is required to repay installments on the first lien term loans in quarterly principal amounts equal to approximately $2.9 million on the last business day of each March, June, September, and December of each year, with the balance payable on October 22, 2029. Additionally, the entire principal amount of revolving loans outstanding (if any) under the revolving credit facility are due and payable in full at maturity on October 6, 2028, subject to the Springing Maturity Condition, on which day the revolving credit commitments thereunder will terminate.

The Borrower is required, subject to certain exceptions, to pay outstanding amounts of the first lien term loan, (i) with 50% of excess cash flow, with step-downs upon achievement of certain first lien net leverage ratios, (ii) with 100% of the net cash proceeds of all non-ordinary course asset sales by the Borrower and its restricted subsidiaries, subject to customary reinvestment right, and (iii) with 100% of the net cash proceeds of issuances of debt obligations of the Borrower and its restricted subsidiaries, other than permitted debt. Additionally, the Borrower may voluntarily repay outstanding loans under the first lien term loan and the revolving credit facility at any time without premium or penalty. In addition, the Borrower may elect to permanently terminate or reduce all or a portion of the revolving credit commitments and the letter of credit sub-limit under the revolving credit facility at any time without premium or penalty.

The First Lien Credit Agreement also includes customary representations, warranties, covenants, and events of default (with customary grace periods, as applicable).

As of December 31, 2024, we had $1,164 million of outstanding borrowings on the first lien term loan and $400 million of availability under the revolving credit facility under the First Lien Credit Agreement, and outstanding letters of credit of $0 million under the First Lien Credit Agreement. As of December 31, 2024 and 2023, we were in compliance with the covenants under the First Lien Credit Agreement.

Second Lien Credit Facilities

Our indirect wholly-owned subsidiary, Waystar Technologies, Inc., a Delaware corporation (the “Borrower”), is the Borrower under a second lien credit agreement, dated as of October 22, 2019 (as amended from time to time, the “Second Lien Credit Agreement”), that initially provided for a second lien term loan of $255.0 million. On September 23, 2020, we increased the second lien term loan by an incremental $190.0 million (“2020 Incremental Second Lien Term Loan”) to a total of $445.0 million. On August 24, 2021, we increased the second lien term loan by an incremental $70.0 million to a total of $515.0 million in conjunction with the acquisition of Patientco (“2021 Incremental Second Lien Term Loan”). We refer to the term loan facilities under the Second Lien Credit Agreement as the “Second Lien Credit Facility.” The Second Lien Credit Facility matures on October 21, 2027. On June 27, 2023, we amended the Second Lien Credit Agreement to replace all LIBOR-based interest rates applicable to the second lien term loans with a Term SOFR-based rate plus a credit spread adjustment of 0.11%. On February 9, 2024, we utilized proceeds from the amended First Lien Credit Facility to paydown the remaining principal and interest on the Second Lien Credit Facility.

Receivables Facility

On August 13, 2021, the Borrower, as servicer, and Waystar RC LLC, a wholly-owned “bankruptcy remote” special purpose vehicle, as “Receivables Borrower”, entered into a receivables financing agreement (the “Receivables Financing Agreement”), providing for an aggregate borrowing of up to $50 million. Loans under the Receivables Financing Agreement mature on August 13, 2024. Borrowings under the Receivables Financing Agreement accrue interest at a rate per annum of, at the option of the Receivables Borrower, either Term SOFR or base rate plus 2.00%. All amounts outstanding under the Receivables Financing Agreement are collateralized by substantially all of the accounts receivables and unbilled revenue of the Receivables Borrower. On October 31, 2023, the Borrower and Receivables Borrower amended the Receivables Financing Agreement to increase the aggregate borrowing availability to up to $80 million and extend the maturity date to October 30, 2026. On September 6, 2024, we drew $10.0 million on the Receivables Facility and used the proceeds to paydown $10.0 million on the First Lien Credit Facility.

In connection with the Receivables Financing Agreement, eligible accounts receivable of certain of our subsidiaries are sold to the Receivables Borrower. The Receivables Borrower pledges the receivables as security for loans. The accounts receivable owned by the Receivables Borrower are separate and distinct from our other assets and are not available to our other creditors should we become insolvent.

The Receivables Financing Agreement also contains customary representations, warranties, covenants, and default provisions.

As of December 31, 2024, the Receivables Borrower had $80 million in outstanding borrowings under the Receivables Financing Agreement. As of December 31, 2024 and 2023, we were in compliance with the covenants under the Receivables Financing Agreement.

Critical Accounting Policies and Estimates

The above discussion and analysis of our financial condition and results of operations is based upon our consolidated financial statements. The preparation of financial statements in conformity with GAAP requires management to make estimates and judgments that affect the reported amounts of assets, liabilities, revenue, and expenses, and disclosures of contingent assets and liabilities. Our significant accounting policies are described in Note 2, “Significant Accounting Policies,” of the accompanying consolidated financial statements included elsewhere in this report. Critical accounting policies are those that we consider to be the most important in portraying our financial condition and results of operations and also require the greatest amount of judgments by management. Judgments or uncertainties regarding the application of these policies may result in materially different amounts being reported under different conditions or using different assumptions. We consider the following policies to be the most critical in understanding the judgments that are involved in preparing the consolidated financial statements.

Revenue Recognition

Revenue is recognized for each performance obligation upon transfer of control of the software solutions to the client in an amount that reflects the consideration we expect to receive. Revenues are recognized net of any taxes collected from clients and subsequently remitted to governmental authorities.

We derive revenue primarily from providing access to our solutions for use in the healthcare industry and in doing so generate two types of revenue: (i) subscription revenue and (ii) volume-based revenue, which account for 99% of total revenue for all periods presented. We also derive revenue from implementation fees for our software, as well as hardware sales to facilitate patient payments.

Revenue from our subscription services as well as from our volume-based services represents a single promise to provide continuous access (i.e., a stand-ready obligation) to our software solutions in the form of a service. Our software products are made available to our clients via a cloud-based, hosted platform where our clients do not have the right or practical ability to take possession of the software. As each day of providing access to the software solutions is substantially the same and the client simultaneously receives and consumes the benefits as services are provided, these services are viewed as a single performance obligation comprised of a series of distinct daily services.

Revenue from our subscription services is recognized over time on a ratable basis over the contract term beginning on the date that the service is made available to the client. Volume-based services are priced based on transaction, dollar volume, or provider count in a given period. Given the nature of the promise is based on unknown quantities or outcomes of services to be performed over the contract term, the volume-based fee is determined to be variable consideration. The volume-based transaction fees are recognized each day using a time-elapsed output method based on the volume or transaction count at the time the clients’ transactions are processed.

Our other services are generally related to implementation activities across all solutions and hardware sales to facilitate patient payments. Implementation services are not considered performance obligations as they do not provide a distinct service to clients without the use of our software solutions. As such, implementation fees related to our solutions are billed upfront and recognized ratably over the contract term. Implementation fees and hardware sales represent less than 1% of total revenue for all periods presented.

Revenue recorded where we act in the capacity of a principal is reported on a gross basis equal to the full amount of consideration to which we expect in exchange for the good or service transferred. Revenue recorded where we act in the capacity of an agent is reported on a net basis, exclusive of any consideration provided to the principal party in the transaction.

The principal versus agent evaluation is a matter of judgment that depends on the facts and circumstances of the arrangement and is dependent on whether we control the good or service before it is transferred to the client or whether we are acting as an agent of a third party. This evaluation is performed separately for each performance obligation identified. For the majority of our contracts, we are considered the principal in the transaction with the client and recognize revenue gross of any related channel partner fees or costs. We have certain agency arrangements where third parties control the goods or services provided to a client and we recognize revenue net of any fees owed to these third parties.

Goodwill and Long-Lived Assets

Goodwill and long-lived assets comprise 88.7% of our total assets as of December 31, 2024. Goodwill represents the excess of consideration paid over the estimated fair value of the net intangible and identifiable intangible assets acquired in business combinations. We evaluate goodwill for impairment annually on October 1st or whenever there is an impairment indicator. Potential impairment indicators may include, but are not limited to, the results of our most recent annual or interim impairment testing, downward revisions to internal forecasts, macroeconomic conditions, industry and market considerations, cost factors, overall financial performance, changes in management and key personnel, changes in composition or carrying amount of net assets, and changes in share price.

ASC Topic 350, Intangibles — Goodwill and Other (“ASC 350”), allows entities to first use a qualitative approach to test goodwill for impairment by determining whether it is more likely than not (a likelihood of greater than 50%) that the fair value of a reporting unit is less than its carrying value. If the qualitative assessment supports that it is more likely than not that the fair value of the asset exceeds its carrying value, a quantitative impairment test is not required. If the qualitative assessment indicates that it is more likely than not that the fair value of the asset does not exceed its carrying value, we will perform the quantitative goodwill impairment test, in which we compare the fair value of the reporting unit to the respective carrying value, which includes goodwill. If the fair value of the reporting unit exceeds its carrying value, then goodwill is not considered impaired. If the carrying value is higher than the fair value, the difference would be recognized as an impairment loss.

Goodwill is tested for impairment at the reporting unit level, which is defined as an operating segment or one level below an operating segment (referred to as a component). Our single operating segment is also our single reporting unit as we do not have segment managers and there is no discrete information reviewed at a level lower than the consolidated entity level. All of our assets and liabilities are assigned to this single reporting unit.

For our annual goodwill impairment test during the year ended December 31, 2023, we elected to perform a qualitative assessment. Our assessment of relevant events and circumstances was designed to indicate whether it is more likely than not that the fair value of a reporting unit is less than its carrying amount. The assessment considered whether or not we observed changes in market conditions within the industry and macroeconomy, changes in cost factors which could result in a negative effect on earnings or financial performance of the reporting unit, such as negative or declining cash flows compared to prior period results, and other entity-specific events or conditions impacting the reporting unit. There were no indicators that it was more likely than not that the fair value of the asset did not exceed its carrying value. In connection with our goodwill impairment testing performed as of December 31, 2024, 2023, and 2022, we concluded that there was no impairment to goodwill.

Prior assessments have indicated that the fair value exceeds the carrying value for the reporting unit with reasonable headroom and no indication of impairment. However, we elect to perform a goodwill impairment test utilizing a quantitative approach every fourth year in order to calculate a new fair value “base” to which future qualitative tests can be compared. Our most recent quantitative assessment was performed as of October 1, 2024. We utilized both an income approach and market approach to calculate a fair value of our single reporting unit, Waystar, and compared that value to the company’s carrying value as of October 1, 2024. As a result of this analysis, our fair value under each method exceeded our carrying value and therefore, no impairment was recorded.

Long-lived assets are amortized over their useful lives. We evaluate the remaining useful life of long-lived assets periodically to determine if events or changes in circumstances warrant a revision to the remaining period of amortization. The carrying amounts of these assets are reviewed for impairment whenever events or changes in circumstances indicate that the carrying value of these assets may not be recoverable. We measure the recoverability of these assets by comparing the carrying amount of the asset group to the future undiscounted cash flows the assets are expected to generate. If the undiscounted cash flows used in the test for recoverability are less than the carrying amount of the asset group, then the carrying amount of such assets is reduced to fair value.

Recent Accounting Pronouncements

Refer to Part II, Item 8, “Financial Statements—Note 2 (Summary of Significant Accounting Policies)”.

JOBS Act Election

We are currently an “emerging growth company,” as defined in the JOBS Act. Under the JOBS Act, emerging growth companies can delay adopting new or revised accounting standards until such time as those standards apply to private companies. We have elected to use this extended transition period for complying with new or revised accounting standards that have different effective dates for public and private companies until the earlier of the date we (i) are no longer an emerging growth company or (ii) affirmatively and irrevocably opt out of the extended transition period provided in the JOBS Act.

Item 7A.Qualitative and Quantitative Disclosures About Market Risk

We are exposed to certain market risks arising from transactions in the normal course of our business. Such risks are principally associated with credit risk and interest rate risk.

Credit Risk

Credit risk involves the possibility that a counterparty will not meet its obligations under a financial instrument or client contract, leading to a financial loss. Concentrations of credit risk with respect to our clients are limited due to our diversified client base.

We routinely assess the financial strength of our clients through a combination of third-party financial reports, credit monitoring, publicly available information, and direct communication with those clients. We establish payment terms with clients to mitigate credit risk and monitor its accounts receivable credit risk exposure. However, while we actively seek to ensure credit risk, there can be no assurance that in the future it will be able to obtain credit risk insurance at commercially attractive terms or at all.

Interest Rate Risk

Our exposure to interest rate risk is related to our First Lien Credit Facility, which bears interest at SOFR plus 2.25% as of December 31, 2024. A hypothetical 100 basis point increase or decrease in the current effective rate would have an impact on our interest expense of approximately $17.3 million for the year ended December 31, 2024.

In order to limit exposure to risk, we maintain derivative instruments with creditworthy institutions to hedge against changing interest rate fluctuations. We utilize interest rate swap contracts and other non- derivative hedging instruments to manage such risk.