Glossary of Terms and Abbreviations

Table of Contents

SpecialCautionary Note Regarding Forward-Looking Statements

This Annual Report on Form 10-K of HMS Holdings Corp. (together with its subsidiaries, “HMS,” the “Company,” “we,” “our” or “us”) contains "forward-looking statements"“forward-looking statements” within the meaning of the U.S. Private Securities Litigation Reform Act of 1995. From time to time, we also provide forward-looking statements in other materials we release to the public, as well as oral forward-looking statements. Such statements givereflect our current expectations, projections and assumptions about our business, the economy and future events or forecasts of future events; theyconditions. They do not relate strictly to historical or current facts.

We have tried wherever possible, to identify suchforward-looking statements by using words such as "anticipate," "estimate," "expect," "project," "intend," "plan," "believe," "will," "target," "seek," "forecast"“aim,” “anticipate,” “believe,” “estimate,” “expect,” “forecast,” “intend,” “likely,” “may,” “plan,” “project,” “seek,” “target,” “will,” “would,” “could,” “should,” and similar expressions and references to guidance. In particular, theseguidance, although some forward-looking statements may be expressed differently. These statements include, statements relating toamong other things, information concerning our possible future actions, business plans, objectives and prospects, our future operating or financial performance, orsales efforts and results of current and anticipated services, the benefits and synergies to be obtained from completed and future acquisitions, and the future performance of companies we have acquired, sales efforts,sufficiency of our appeals reserves, the future effect of different accounting determinations or remediation activities, our ability to successfully remediate material weaknesses in our internal control over financial reporting, our future expenses, interest rates and financial results, and the outcomeimpact of contingencies, such as financial results.changes to U.S. healthcare legislation or healthcare spending affecting Medicare, Medicaid or other publicly funded or subsidized health programs.

We cannot guarantee that any forward-looking statement will be realized. Forward-looking statements are based on our current expectationsnot guarantees and involve risks, uncertainties and assumptions regarding our business, the economythat are difficult to predict. Actual results may differ materially from past results and other future conditions. Shouldforward-looking statements if known or unknown risks or uncertainties materialize, or shouldif underlying assumptions prove inaccurate, actual results could differ materially from past resultsinaccurate. These risks and those anticipated, estimated or projected. We caution you, therefore, against relying on anyuncertainties include, among other things,

These and other risks are discussed under the headings “Part I. Item 1. Business,” “Part I. Item 1A, Risk Factors,” “Part II, Item 7. Management’s Discussion and Analysis of these forward-looking statements. They are neither statementsFinancial Condition and Results of historical fact nor guarantees or assurancesOperations,” and “Part II, Item 7A. Quantitative and Qualitative Disclosures about Market Risk” of future performance. Factors that could cause or contribute to such differences include, but are not limited to, those discussed in this Annual Report on2016 Form 10-K and in particular, the risks discussed under the heading "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K and those discussed in other documents we file with the Securities and Exchange Commission.SEC.

Any forward-looking statements made by us in this Annual Report on2016 Form 10-K speak only as of the date on which they are made. Factors or events that could cause actual results to differ may emerge from time to time and it is not possible for us to predict all of them. We undertake no obligation to publicly update forward-looking statements, whether as a result of new information, future events or otherwise, except as may be required by law. We caution readers not to place undue reliance upon any of these forward-looking statements. You are advised, however, to consult any further disclosures we make on related subjects in our Form10-QForm 10-Q and Form 8-K reports and our other filings with the SEC.

Market and Industry Data

This 2016 Form 10-K contains market, industry and government data and forecasts that have been obtained from publicly available information, various industry publications and other published industry sources. We have not independently verified the information and cannot make any representation as to the Securitiesaccuracy or completeness of such information. None of the reports and Exchange Commission.other materials of third party sources referred to in this 2016 Form 10-K were prepared for use in, or in connection with, this report.

PART I

Item 1. Business.
Business

Founded in 1974, HMS Holdings Corp. is a holding company whose principal business is conducted through its operating subsidiaries. Unless the context otherwise indicates, references in this Annual Report to the terms "we," "our" and "us" refer to HMS Holdings Corp., and its subsidiaries and its affiliates.

General Overview

        We operateleading provider of cost containment solutions in the U.S. healthcare insurance benefit cost containment marketplace. We use innovative technology, extensive data services and powerful analytics, to deliver coordination of benefits, payment integrity and health management and engagement solutions to help healthcare payers improve performance and outcomes. We provide coordination of benefits services to government and privatecommercial healthcare payers and sponsors to ensure that the responsible party pays healthcare claims. Our payment integrity services ensure that healthcare claims billed are accurate and appropriate.appropriate; and our care management technology helps risk-bearing organizations manage the care delivered to their members. Together these various services help customers recover amounts from liable third parties; prevent future improper payments; reduce fraud, waste and abuse; better manage the care that members receive; and ensure regulatory compliance.

 Demand for

HMS began its operations as Health Management Systems, Inc., which became our services arises,wholly owned subsidiary in part, from healthcare funds spentMarch 2003 when we assumed its business in error, where another payer was actually responsible forconnection with the costadoption of the healthcare claim, or a mistake was made in applying complex claim processing rules. According to the Centers for Medicare & Medicaid Services ("CMS") National Health Expenditures ("NHE") 2013-2023 projections and error rates published on paymentaccuracy.gov, the government estimates that improper payments in the Medicaid and Medicare programs totaled $89 billion

        Given that HDI's Medicare RAC contract with CMS is one of our largest contracts and represents a significant potential business opportunity for us, if HDI is not awarded a region, or is awarded a region but on substantially different terms from HDI's current contract, or if the contract awards continue to be delayed, or if CMS imposes or implements other changes to the Medicare RAC Program that materially reduce our revenue or profitability associated with such program, then our business, financial condition, results of operations and cash flows would be materially adversely affected.flows.

        In August 2013, CMS issued CMS Rule 1599-FHospital Inpatient Admission Order and Certification and Two Midnight Benchmark for Inpatient Hospital Admissions for the Fiscal Year 2014 Inpatient Prospective Payment System ("IPPS")/Long-Term Care Hospital ("LTCH"). Under this final rule, CMS redefined the requirements for an inpatient stay with a new formal time-based standard. The new rule, termed the "Two Midnight Rule," states that surgical procedures, diagnostic tests and other treatments (in addition

Part of our growth strategy depends on our ability to services designated as inpatient-only), are generally appropriate for inpatient hospital admission and payment under Medicare Part A when a physician (i) expects the beneficiary to require a stay that crosses at least two midnights, and (ii) admits the beneficiaryrespond to the hospital based uponevolving healthcare landscape with new and enhanced solutions and services that expectation. As part of theour existing and potential customers are willing to adopt. The development, marketing and implementation of these solutions and services may require that we make substantial financial and resource investments. We face risks that our new or modified solutions and services may not be responsive to customer preferences or industry changes, and that the new rule, effective October 2013, CMS suspendedsolution and service development initiatives that we prioritize may not yield the review by Medicare RACs of inpatient hospital claims paid between October 1, 2013 and September 30, 2014 for a determination of whether the inpatient hospital admission and patient status was appropriate. In connection with this audit suspension, CMS announcedgains that it had initiated a provider education and compliance review program and stated that it would re-evaluate the retrospective review strategy after it evaluated the results of the compliance review. On April 1, 2014, the "Protecting Access to Medicare Act of 2014," was signed into law. A provision of this act further delayed the Two Midnight Rule's enforcement and RAC review of Two Midnight Rule claims until March 31, 2015.

        These reviews have historically been a significant finding for the Recovery Audit Program; as a result, the Two Midnight Rule and the suspension of these reviews by the Medicare RACs could have a material negative impact on our future revenuewe anticipate, if HDI is awarded a new Medicare RAC Contract, depending upon, among other factors, how the Two Midnight Rule is applied by providers and the review strategies ultimately approved by CMS.

        In addition, on August 29, 2014, CMS announced it would settle with hospitals willing to withdraw inpatient status claims currently pending in the appeals process by offering to pay hospitals 68% for all eligible claims that they have billed to Medicare. Although we accrue an estimated liability for appeals based on the amount of fees that are subject to appeals, closures or other adjustments, which we estimate are probable of being returned to providers following a successful appeal, and we similarly accrue an allowance against accounts receivables related to fees yet to be collected, the impact of CMS' settlement offer to hospitals remains uncertain and our financial condition and results of operations could be adversely affected if we are required to return certain fees we have already been paid under HDI's existing Medicare RAC contract orany. If we are unable to collect fees for auditspredict market preferences or healthcare industry changes, or if we have already performed. There could be a material negative impact on our revenue if under the current Medicare RAC contract, HDI isare unable to obtain full payments for properly provided servicesdevelop or is required to repay a portion of prior fees associated with the hospital settlement program or if future fees payable to HDI by CMS are reduced.

        Our success also depends on relationships we develop with our customers that enable us to understand our customers' needs and deliveradapt solutions and services that are tailoredresponsive to meet those needs. If a customer is dissatisfied with the quality ofexisting and potential customers’ needs, we may fail to expand our work, or ifbusiness, which could constrain our products, technical infrastructure or services do not comply with the provisions of our contractual agreements or applicable regulatory requirements, we could incur additional costs that may impair the profitability of a contractfuture revenue growth and damage our ability to obtain additional work from that customer, or other current or prospective customers. For

Table of Contents

example, some of our contracts contain liquidated damages provisions and financial penalties related to performance failures, which if triggered, couldmaterially adversely affect our reputation, business, financial condition, results of operations and cash flows. If liquidated damages or other

Our acquisition strategy may subject us to considerable business and financial penalties are assessed against us, we may be requiredrisk.

Historically, to disclose these damages or penalties in connection with future bids for services with other customers, which may reduceachieve our chances of winning such procurements. Althoughstrategic goals, we have liability insurance,made a significant number of acquisitions that have expanded the policy coveragesolutions and limits may not be adequateservices we offer, provided a presence in complementary business lines, or expanded our geographic presence and/or customer base. For example, we acquired IntegriGuard, LLC in September 2009; Verify Solutions, Inc. in December 2009; Allied Management Group-Special Investigation Unit in June 2010; Chapman Kelly, Inc. in August 2010; HDI in December 2011; MedRecovery Management, LLC in December 2012; Essette, Inc. in September 2016; and Eliza Holding Corp. in April 2017.

We intend to provide protection against all potential liabilities. Under the terms of one ofpursue future acquisitions that will continue to expand and diversify our contracts, we have an outstanding irrevocable letter of credit for $4.6 million, which we established against our existing revolving credit facility. If a claim is made against this letter of credit or any similar instrument that we obtainbusiness and to periodically engage in the future, we would be requireddiscussions regarding such possible acquisitions. We are subject to reimburse the issuer of the letter of credit for the amount of the claim.

        From time to time, government customers may face financial pressures or pressure from stakeholders that may cause them to redefine or reduce the scope of our contracts (by, for example, significantly reducing the volume of data that we are permitted to audit) or terminate contracts for our services that may be regarded as non-essential. We also occasionally face challenges in obtaining timely or full payments for our properly provided services from customersrisks and parties who we provide services to, despite our right to prompt and full payment under the terms of our contracts. Since several of our contracts, including those with many of our largest customers, may be terminated upon short notice for convenience, dissatisfied customers might seek to exit existing contracts prior to their scheduled expiration date and could direct future businessuncertainties relating to our competitors.ability to identify suitable potential acquisition candidates, to consummate additional acquisitions that will be advantageous to us, and to successfully integrate future acquisitions. Future and potential business acquisitions involve a number of risk factors that could affect our operations, including, but not limited to:

If we lose a major customer; if we fail to maintain a high level of customer retention; ifadequately address these risks, or to successfully integrate the businesses that we fail to reprocure a contract; ifacquire, we may not realize cost efficiencies, synergies or other benefits that we anticipated when selecting our customers reduce the scope of our contracts or limit future contracting opportunities; or if we are exposed to significant costs, liabilities or negative publicity, our ability to compete for new contracts with current or prospective customers could be damagedacquisition candidates, and our reputation, business, financial condition, reputation, results of operations and cash flows could be materially adversely affected.

You will not be able to rely on our operating results in any particular period as an indication of our future performance because they are subject to significant fluctuation which may cause the market price of our common stock to decrease significantly.

Our operating results may fail to match our past or projected performance. We have experienced significant variations in our revenue between reporting periods due to the timing of periodic revenue recovery projects, the timing and delays in third party payers’ claim adjudication and ultimate payment to our customers where our revenue is contingent upon such collections and delays in receiving payment for our services. Our revenue and operating results have also been impacted from period to period as a result of a number of factors, some of which are outside of our control, including, but not limited to:

Occasionally our state and federal customers are requested by third party payers to refund payments that we previously recovered for our customers. If our state and federal customers choose to refund money in response to these requests, regardless of whether an error actually occurred in connection with the payments, we may also be required to return contingent revenue which we were previously paid associated with such refunded payments. We also typically face a long implementation period with a new customer or a new contract with an existing customer and may not be able to estimate with certainty the period in which implementation may be completed.

We cannot predict the extent to which future variations could occur due to these or other factors. Although we have experienced some seasonal trends in our operational volume, we do not consider our operations to be seasonal to any material degree. Consequently, our operating results are subject to significant fluctuation for any particular quarter, fiscal year, or other period, and may not be indicative of future periods. Significant fluctuations in our operating results may cause the market price of our common stock to decrease significantly.

We face challenges associated with forecasting the revenue under our contracts and solutions, and any failure to accurately forecast such revenue could have a material adverse effect on our business, financial condition, results of operations and cash flows.

We may not be able to accurately estimate the factors upon which we base our contract pricing, or the costs and timing for implementing and completing contracts. For a majority of our customer contracts, the payment of our fee is contingent upon the recoveries received by our customers. We also have cost-plus or time-and-material based contracts with the federal government where our revenue is recognized based on costs incurred plus an estimate of the negotiated fee earned. Our ability to earn a profit on these contracts requires that we accurately estimate the costs involved with these contracts and assess the probability of achieving certain outcomes or milestones within the contracted time period. In addition, we cannot predict with certainty the costs or the period in which implementation or contracts may be completed when we introduce new solutions or services into the marketplace. We may also face a long implementation period with a new customer or a new contract, making it difficult to reliably forecast revenue under those contracts. If we do not accurately estimate the costs and timing for completing projects, or if we encounter increased or unexpected costs, delays, failures, liabilities or risks, including those outside of our control, our contracts could prove unprofitable for us or yield lower profit margins than anticipated. Although we believe that we have recorded adequate provisions in our financial statements for losses on our fixed-price and cost-plus contracts where applicable, as required under U.S. GAAP, our contract loss provisions may not be adequate to cover all actual future losses.

System interruptions or failures could expose us to liability and harm our business.

Our data and operation centers are essential to our business and our operations depend on our ability to maintain and protect our information systems. We attempt to mitigate the potential adverse effects of a disruption, relocation or change in operating environment; however, the situations we plan for and the amount of insurance coverage that we maintain may not be adequate in every case. Despite systems redundancy and security measures, our systems and operations are vulnerable to damage or interruption from, among other sources:

In addition, while there are backup systems in many of our operating facilities, an extended outage of utility or network services supplied by third party IT vendors or providers may delay or disrupt the delivery or performance of the solutions and services we provide for our customers. If we encounter a business interruption, or in the event our business continuity plans and business interruption insurance coverage are not adequate or fail to compensate us on a timely basis, we could suffer operational disruptions, disputes with customers, civil or criminal penalties, regulatory problems, increases in administrative expenses, loss of our ability to produce timely and accurate financial and other reports or other adverse consequences, any of which could have a material adverse effect on our business, financial condition, results of operations and cash flows.

Our systems and networks and those of third parties on which we rely may be subject to cyber security breaches and other disruptions that could compromise our information and harm our business.

In the ordinary course of our business, we rely heavily upon our technology systems and networks to input, maintain and communicate the confidential and proprietary data we receive on behalf of our customers, as well as third-party products and services. In addition, sub-contractors, teaming partners or other third-party vendors may receive or utilize this information on our behalf. The secure processing and maintenance of this information is critical to our operations and business strategy. Our security measures or those of third parties on which we rely could be compromised or breached as a result of computer hacking, acts of vandalism or theft, malware, computer viruses, employee error or malfeasance, catastrophes or other unforeseen events. As a result, our data, customers’ data, information technology or infrastructure could be accessed improperly, made unavailable, improperly modified, or corrupted or we could suffer system disruptions, shutdowns and denials of service. The occurrence of any of these events could cause our solutions and services to be perceived as vulnerable, cause our customers to lose confidence in our solutions and services, negatively affect our ability to attract new customers, cause existing customers to terminate or not renew our solutions and services and damage our reputation, all of which could reduce our revenue, increase our expenses and expose us to legal claims and regulatory actions. Similarly, we could be materially adversely affected by the loss of proprietary, trade secret or confidential technical and financial data if our internal networks are compromised. We may be unable to implement adequate preventive measures to protect against such compromises. We could also be forced to expend significant resources in response to a cyber-security breach, including repairing system damage, increasing cyber security protection costs by deploying additional personnel and protection technologies, paying regulatory fines and litigating and resolving legal claims and regulatory actions, all of which could increase our expenses, divert the attention of our management and key personnel away from our business operations and materially adversely affect our results of operations.

If we are unable to protect our proprietary technology, information, processes, know-how, and other intellectual property and intellectual property rights, or become subject to claims of infringing or misappropriating the intellectual property of third parties, the value of our solutions and services may be diminished and our business may be materially adversely affected.

Our success as a company depends in part upon our ability to protect our core technology and intellectual property. Our expanding operations and efforts to develop new solutions and services also make protection of our intellectual property more critical. We seek to protect trade secrets and other proprietary information through confidentiality agreements and invention assignment agreements with employees, consultants and other third parties, as well as through the terms of our agreements with customers and vendors, and other security measures. However, the steps we have taken to deter misappropriation of intellectual property may be insufficient to protect our proprietary information. Misappropriation of our intellectual property by third parties, or any disclosure or dissemination of our confidential and proprietary business intelligence, queries, algorithms and other similar information by any means, could undermine any competitive advantage we currently derive or may derive from that intellectual property. For example, our current or former employees, consultants or other third parties may unintentionally or willfully disclose our trade secrets, know-how or other confidential and proprietary information to competitors. Competitors have also attempted to use state open records and/or federal Freedom of Information Act laws to obtain our proposal responses and other documents we provide to our government customers. We cannot be certain that our efforts to protect the confidential and proprietary trade secret information or intellectual property in these proposals or other documents will always be successful, due to the many factors underlying the various state and federal decisions to release information in response to open records requests (even in spite of our objections and efforts to protection information). On the other hand, third parties may claim that we are infringing upon or misappropriating their intellectual property. Our exposure to risks related to the use of intellectual property may also increase as a result of acquisitions because third parties may make infringement and similar or related claims after we have acquired technology. Any of these situations could cause us to expend significant time and resources and to incur substantial costs associated with litigation or legal proceedings that may be necessary to defend ourselves or to enforce our intellectual property rights, in which we may not ultimately prevail, and could result in our being prevented from furnishing certain solutions and services. If the protection of our proprietary rights is inadequate to prevent unauthorized use or appropriation by third parties or our employees, the value of our brand and other intangible assets may be diminished and others may be able to more effectively compete with our business by offering solutions or concepts that are substantially similar to ours, which could have a material adverse effect on our business, financial condition, results of operations and cash flows.

We face significant competition for our solutions and services and we expect competition to increase.increase, which could materially adversely affect our business, financial condition, results of operations and cash flows.

        Competition among U.S.

The market for healthcare insurance benefit cost containment service providerssolutions and services is increasingintensely competitive, driven by rapidly changing technologies, evolving industry standards and we expectcustomer demands to encounter additional competitionbecome more efficient. Our competitors range in size from large, diversified national companies to small, specialized firms, and could include current or former sub-contractors or teaming partners seeking to establish direct relationships with our customers in order to perform similar services as new competitors enter this area as it continues to grow with advances in technology. Our current competitors include the other Medicare RACs; other claim audit vendors; fraud, waste and abuse claim edit and predictive analysis companies; primary claims processors; numerous regional utilization management companies;prime contractor, as well as healthcare consulting firmscurrent and other third-party liability service providers. In addition, someprospective customers can compete by electingthat elect to perform some or all of their recovery and cost avoidance functions in-house.

        We must remainin-house or to develop in-house capacities for solutions and services that we provide or hope to provide. Consolidation among vendors and healthcare providers, as well as the merging of some of our competitors or formation of business alliances with other competitors, have contributed to the increasingly competitive environment. For example, certain state customers have combined or “bundled” TPL services under large-scale IT procurements, allowing MMIS vendors to partner with less experienced TPL identification vendors based on preferred relationships or favorable pricing. In addition, companies that have invested in proprietary technology different from our existing businessown solution and service capabilities and developofferings, such as front-end analytics, have emerged as new products and services, which will require not only that we make substantial financial and resource investments, but that we quickly respondcompetitors due to new or emerging technologies and to changes in customer requirements and the rapidly evolving healthcare industry.landscape. There is also increasing sophistication in certainthe solutions and services andthat our competitors are constantly developing products and services that may become more efficient or appealing to our customers. We cannot provide assurance that ourIn order to remain competitive, we may need to quickly develop and market new or modified product and service innovations will beenhanced solutions and services responsive to customer preferences oremerging technologies and changes in the healthcare industry, changes, or that the product development initiativeswhich may require that we prioritize will yield the gains that we anticipate, if any.make substantial financial and resource investments.

 Many of the cost containment services we provide are being targeted by formidable competitors with national reputations, and their success in attracting business

We may not be able to compete successfully against our existing or winning contract bids could significantly and/or adversely affect our business. In addition, for some of the services that we provide or hope to provide, current and prospective customers could develop in-house capacities and could therefore decide not to engage us.future competitors. Some of our competitors have also merged or formed business alliances with other competitors, which may affect our ability to work with potential customers. In certain cases, our competitors and potentialthese competitors have significantly greater financial and technical resources and market recognition than we

Table of Contents

have, and may be in a position to bundle services that compete with our product and services offerings, or do. They may be able to (i) offer lower prices or negotiate fee reductions on our current solutions and services, (ii) respond more quickly than we can to new and emerging technologies and changing customer requirements, (iii) devote greater resources to the sale of their solutions and services and to developingthe development and implementingimplementation of new and improved systems, solutions and solutionsservices for the customers that we serve. In some areasserve, and (iv) pursue various acquisitions that allow them to rapidly amass a wide array of our business, we could face potential competition from our current or former subcontractors or teaming partners, who may use their position to establish their own relationships with our customers and seek to become prime contractors on similar work in the future. Although we attempt to protect ourselves against such conduct through the terms of our subcontracts and teaming agreements, a subcontractor or teaming partner may determine that the benefits of violating its contract with us outweigh the costs and risks.

capabilities. We cannot provide assurance that we will be able to compete successfully against existing or new competitors. In addition, we may be forced to lower our pricing, unexpectedly increase or enhance our technological or data capabilities, or modify our solution or service offerings. Notwithstanding any changes we make in response to increased competition, the demand for our solutions and services may decrease as a result of increased competition. Further, aA failure to be responsive to our existing and potential customers'customers’ needs or the changing industry landscape could hinder our ability to maintain or expand our customer base, hire and retain new employees, pursue new business opportunities, complete future acquisitions and operate our business effectively. Any inability to compete effectively could materially adversely affect our business, financial condition, results of operations and cash flows.

We must comply with laws and regulations regarding individual privacy and information security, including taking stepsOur business could be materially adversely affected if we fail to ensure that our workforce, vendors, subcontractors and other business associates who obtain access to sensitive information about individuals maintain its confidentiality. Our failure, or a failure by our business associates, to comply with those laws and regulations, whether or not inadvertent, could subject us to legal actions, fines and penalties and negatively impact our reputation and operations.

        As a service provider, we often receive, process, transmit and store protected health information ("PHI")high level of individuals, as well as other financial, confidential and proprietary information belonging tocustomer retention, if our customers elect to reduce the scope of our subsidiariescontracts or terminate them before their scheduled expiration dates or if we fail to meet performance standards under our customer contracts.

We historically have derived and third parties (e.g., private insurance companies, financial institutions)expect to continue to generate a significant portion of our revenue from which we obtain information. The use and disclosurea limited number of that information is regulated throughlarge customers at the federal and state lawslevel. Our contracts with these customers are subject to periodic renewal and rules,some permit them to terminate their contracts on short notice, with or without cause. If a customer is dissatisfied with the quality of our work or if we fail to meet performance standards under our contracts, or if our solutions, technical infrastructure or services do not comply with the provisions of our contractual agreements or applicable regulatory requirements, customers might seek to reduce the scope of the services we perform or prematurely terminate their agreements with us, or we could incur additional costs that may impair the profitability of a contract and damage our ability to obtain additional work from that customer, or other current or prospective customers. For example, some of our contracts contain liquidated damages provisions and financial penalties related to performance failures, which if triggered, could materially adversely affect our reputation, business, financial condition, results of operations and cash flows. We also may be required to disclose such liquidated damages or other financial penalties assessed against us in connection with future bids for services with other customers.

In addition, government customers are changed frequentlysubject to financial pressures or pressure from stakeholders that may cause them to terminate contracts for our services that may be regarded as non-essential or to redefine or reduce the scope of our contracts by, legislation, regulatory issuances and/for example, significantly reducing the volume of data that we are permitted to audit. Despite our right to prompt and full payment under the terms of our contracts, we could face challenges in obtaining timely or administrative interpretation. Various state laws address the use and disclosure of individually identifiable financial and health data. Some are derivedfull payments for our properly provided services from the privacy and security provisions such asour customers. If there is a substantial reduction in the federal Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and the regulations implementing these laws. HIPAA also imposes standards and requirements on our business associates (as this term is defined in the HIPAA regulations), including our subcontractors and manyscope of our vendors.

        In January 2013, the U.S. Departmentservices under, or a termination of, Health and Human Services issued Final Omnibus Privacy, Security, Breach Notification, and Enforcement Rules that modified and supplemented manyany of the standards and regulations under HIPAA and HITECH. Theseour key contracts with our major customers, or if we are exposed to significant costs, liabilities or negative publicity, our ability to compete for new rules significantly increased the risk of liability to uscontracts with current or prospective customers could be damaged and our business, associatesfinancial condition, reputation, results of operations and subcontractorscash flows could be materially adversely affected.

Any failure to maintain effective information processing systems and made more incidentsthe integrity of inadvertent disclosure reportable and subject to penalties. Even though we take measures to comply with all applicable regulations and to ensure our business associates and subcontractors comply with these laws, regulations and rules, we have less than complete control over our business associates' and subcontractors' actions and practices. In addition, we could also be exposed to data breach risk if there is unauthorized access to one of our or our subcontractors' secure facilities or from lost or stolen laptops, other portable media from current or former employee theft of data containing PHI, from misdirected mailings containing PHI, or other forms of administrative or operational error. If we or our subcontractors fail to comply with applicable laws; if unauthorized parties gain physical access to one of our facilities and steals or misuses confidential information; if we erroneously use or disclosethe data in, a way that is inconsistent with our granted rights; or if such information is misdirected, lost or stolen during transmission or transport, we may suffer damage to our reputation, potential lossand operations of, existing customers and difficulty attracting new customers. Wethose systems could also be exposed to, among other things, unfavorable publicity, governmental inquiry

and oversight, allegations by our customers that we have not performed our contractual obligations, costs to provide notifications to affected individuals, or litigation by affected parties and possible financial obligations for damages or indemnification obligations related to the theft or misuse of such information, any of which could have a material adverse effect onmaterially adversely affect our business, financial condition, results of operations and cash flows.

 Further, as regulatory focus on privacy issues continues to increase and laws and regulations concerning the protection of personal information expand and become more complex, these potential risks to our business could intensify. Changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, such as healthcare data or other personally identifiable information, along with increased customer demands for enhanced data security infrastructure, could greatly increase our cost of providing our services. See Risk Factor—"Our systems and networks may be subject to cyber security breaches and other disruptions that could compromise our information and harm our business" for additional information.

Our business depends on effective information processing systems that are compliant with current HIPAA transaction and code set standards and the integrity of the data in, and operations of, our information systems, as well as those of other entities that provide us with data or receive data from us.

Our ability to conduct our operations and accurately report our financial results depends on the integrity of the data in our information systems and the integrity of the processes performed by those systems. These information systems and applications require continual maintenance, upgrading and enhancement to meet our operational needs, satisfy customer requests and handle our expansion and growth. Despite our testing and quality control measures, we cannot be certain that errors or system deficiencies will not be found and that remediation can be done in a timeframe that is acceptable to our customers, or that customer relationships will not be impaired by the occurrence of errors or the need for remediation. In addition, implementation of upgrades and enhancements may cost more, take longer or require more testing than originally expected. Given the large amount of data we collect and manage, it is possible that hardware failures or errors or technical deficiencies in our systems could result in data loss or corruption or cause the information that we collect, utilize or disseminate to be incomplete or contain inaccuracies that our customers regard as significant.

        Through several of the services we provide, situations Situations may also arise in which the accuracy of our data analysis or the content and quality of our work product is central to the disposition of claims, controversies or litigation between our customers and third parties. When such situations arise, we may be requiredparties that would require us to allocate significant resources to fulfilling our contractual obligations to provide our customers with full and complete access to records, analysis and back-up documentation of our work. Assuring our capacity to fulfill these obligations as well as actually fulfilling such obligations, canthem could impose significant burdens on our infrastructure for data storage, maintenance and processing, requiringand require us to prioritize maintenance of and access to these resources, or incur additionalincreased costs to supplement them in order to satisfy our obligations. Should the frequency or scope of situations in which customers invoke these obligations increase to a substantial degree, the resulting strain on our personnel, data storage and computing resources, which could materially and negatively impact other business operations.

        Moreover, because

We depend on many different entities to supply information and an inability to successfully manage our relationships with a number of these suppliers may harm the quality and availability of our solutions and services.

We obtain the data used in our solutions and services from many sources, including commercial health insurance plans, financial institutions, managed care organizations, government entities and non-government entities. From time to time, challenges arise in managing and maintaining our relationships with data sources that are not our customers and that furnish information to us pursuant to a combination of voluntary cooperation and legal obligations under laws and regulations that are often subject to differing interpretation. For example, data suppliers could seek to limit or end our access to and use of their data if they determine that certain uses of data for our customers are not permitted by our agreements, or such suppliers may make errors in compiling, transmitting or accurately characterizing data or have technological limitations that interfere with our receipt or use of the servicesdata we furnishrely on them to customers involve submitting high volumes of monetary claims to third parties (such as health insurance carriers) and processing payments from them, the efficiency and effectivenessprovide. If a number of our own operationsinformation sources become unable or unwilling to provide us with certain data under terms of use that are acceptable to some degree dependentus and our customers, or if laws and regulations for use and protection of this data changes in a way that disincentivizes our suppliers, or imposes unacceptable or unreasonable conditions or risks on the claims processing systems of these third parties and their compliance with any new transaction and code set standards. By October 1, 2015, health plans, commercial payers and healthcare providers are required to transition to the new ICD-10 coding system, which greatly expands the number and detail of diagnosis codes used for inpatient, outpatient and physician claims. The transition to the new transaction and code set standard is expensive, time-consuming and may initially result in disruptions or delays as we and other stakeholders make necessary system adjustments to be fully compliant and capable of exchanging data. In

Table of Contents

addition,us, we may experience delays in processing claims and therefore earning our fees if the third partiesnot be able to obtain new or favorable agreements with whom we work are not in full compliance with these new standards in the required timeframe. Claims processing systems failures, incapacities or deficiencies internal to these third-parties could significantly delay or obstructalternative data suppliers. In addition, our ability to recover moneynormalize and fully utilize the information we have received from various data sources in order to enhance and improve current solutions for our customers is an important component of our growth strategy. Although we believe that we have the legal and thereby interfere with our performance under our contractscontractual rights necessary to normalize and our ability to generate revenueuse the data we have obtained from those contracts in the timeframe we anticipate, which in turn could have a material adverse effect on our business, financial condition, results of operationsthese sources for potential or contemplated solution and cash flows.

We may be precluded from bidding on and/or performing certain work due to other work we currently perform.

        Various laws, regulations and administrative policies prohibit companies from performing work for government agencies in capacities that might be viewed to create an actual or perceived conflict of interest. In particular, CMS has stringent conflict of interest rules, which can limit our bidding for specific work for CMS, or for other contracts that might conflict, or be perceived by CMS to conflict, with contractual work for CMS. State governments and managed care organizations also have conflict of interest restrictions that could limit our ability to bid for certain work. Conflict of interest rules and standards change frequently, and are subject to varying interpretations and varying degrees and consistency of enforcement at the federal, state and municipal levels, andservice offerings, we cannot provide assurance that these entities will permit the use of their data for these purposes. If we will be successful in navigating these restrictions.

        The expansion and diversificationlose a number of our business operations increases the potential that customersdata sources or potential customers will perceive conflicts of interest between our various subsidiaries, products, services, activities and customer relationships. Such conflicts, whether real or perceived, could result in loss of contracts or require usaccess to divest ourselves of certain existing business in order to qualify for new contract awards. We may be required to adjust our current management and personnel structure, as well as our corporate organization and entity structure, in order to appropriately mitigate conflicts and otherwise accommodate the needs as a company that is expanding in size and complexity. Our failure to devote sufficient care, attention and resources to managing these adjustments may result in technical or administrative errors that could expose us to potential liability or adverse regulatory action. If we are prevented from expanding our business due to real or perceived conflicts of interest, our business and results of operations could be adversely affected.

System interruptions or failures could expose us to liability and harm our business.

        Our data and operation centers are essentialunable to our businessidentify and our operations depend on our ability to maintain and protect our information systems. We attempt to mitigatereach the potential adverse effects of a disruption, relocationrequisite agreements with suitable alternative suppliers or change in operating environment; however, we cannot provide assurance that the situations we plan for and the amount of insurance coverage that we maintain will be adequate in any particular case. In addition, despite system redundancy and security measures, our systems and operations are vulnerable to damage or interruption from, among other sources:

•

power loss, transmission cable cuts and telecommunications failures;



•

damage or interruption caused by fire, earthquake and other natural disasters;



•

attacks by hackers or nefarious actors;



•

computer viruses and other malware, or software defects; and



•

physical break-ins, sabotage, intentional acts of vandalism, terrorist attacks and other events beyond our control.

        If we encounter a business interruption; if we fail to effectively maintainsuccessfully integrate them into our information systems; if it takes longer than we anticipate to complete required upgrades, enhancements or integrations;solution and service offerings, or if our business continuity plans and business interruption insurance do not effectively compensate onthere is a timely

Tablelack of Contents

basis,integrity in the data that current or future suppliers provide, we could suffer operationalexperience service disruptions, disputes with customers, civil or criminal penalties, regulatory problems, increases in administrative expenses, lossincreased costs, reduced quality of our ability to produce timelysolutions and accurate financial and other reportsservices, or other adverse consequences, any ofperformance penalties under our customer contracts, which could have a material adverse effect on our business, financial condition, results of operations and cash flows.

We may rely on sub-contractors and other third party providers to provide customers with a single-source solution or service or we may serve as a sub-contractor to a third party prime contractor. If these parties fail to satisfy their obligations to us or if we are unable to maintain these relationships, our business, financial condition, results of operations and cash flows could be materially adversely affected.

In some areas of our business we may engage sub-contractors, teaming partners, vendors or other third party providers to provide our customers with a single-source solution or service for a broader range of service needs. These third parties include software vendors, utility and network providers and other information technology service providers. Our ability to deliver and implement solutions and serve our customers effectively depends on our ability to obtain permissions from our customers, when necessary, to use these third party sub-contractors, or on these third parties meeting our service standards in both timeliness and quality. Similarly, we are and may in the future be engaged as a sub-contractor to a third party prime contractor. Sub-contracting arrangements where we are not the prime contractor pose unique risks to us because we do not successfully integratehave control over the businessescustomer relationship, and our ability to generate revenue under such sub-contracts is dependent on the prime contractor, its performance and relationship with the customer, and its relationship with us. While we believe that we acquire,perform appropriate due diligence on these parties and take adequate measures to ensure that they comply with the appropriate laws and regulations, we cannot guarantee that they will comply with the terms set forth in their agreements with us or in the case of a prime contractor, their agreement with the customer or that they will provide adequate and timely services, construe their contractual rights and obligations in a reasonable way, act appropriately in dealing with us or customers, and remain in compliance with the relevant laws, rules or regulations. As a result, we may have disputes with these parties arising from these or other matters. Performance deficiencies or misconduct by our prime contractors or sub-contractors may be perceived as inadequacies in our solutions or services or cause us to fail to fulfill our contractual obligations to our customers, which could materially adversely affect our customer relationships and reputation, result in termination of a customer contract or the sub-contractor or partner, and subject us to a dispute with our customer or such third party. In addition, if our third party service providers terminate or refuse to renew their relationships with us or offer their products to us in the future on less advantageous terms, we may not realize the anticipated benefits of acquisitions and our results of operations could be adversely affected.

        Historically, to achieve our strategic goals, we have made a significant number of acquisitions that have expanded the products and services we offer, provided a presence in complementary business lines, or expanded our geographic presence and/or customer base. Business acquisitions and combinations involve a number of risk factors that could affect our operations, including:

•

diversion of management's attention and other resources;



•

our ability to maintain relationships with the customers of the acquired business and further develop the acquired business;



•

our ability to cross-sell our services and the services of the acquired businesses to our respective customers;



•

compliance with regulatory requirements and avoiding potential conflicts of interest in markets that we serve;



•

our ability to integrate and coordinate organizations that are geographically diverse and may have different business cultures;



•

transition of operations, users and customers to our existing platforms or the integration of data, systems and technology platforms with ours;



•

our ability to retain or replace key personnel;



•

entry into unfamiliar markets;



•

assumption of unanticipated legal or financial liabilities and/or negative publicity related to prior acts by the acquired entity;



•

litigation or other claims in connection with the acquired company, including claims from terminated employees, customers, former stockholders or third parties;



•

becoming significantly leveraged as a result of incurring debt to finance an acquisition;



•

unanticipated operating, accounting or management difficulties in connection with the acquired entities; and/or



•

impairment of acquired intangible assets, including goodwill, and dilution to our earnings per share.

        We intend to continue our acquisition strategy to expand and diversify our business. We cannot, however, provide assurance that we will be able to identifyperform or deliver solutions or services for existing customers as expected. Likewise, we could suffer losses in the event a prime contract, under which we serve as a sub-contractor, is terminated, whether for non-performance by the prime contractor or otherwise. Upon any potential acquisition candidates or consummate any additional acquisitions or that any future acquisitions will be successfully integrated or will be advantageous to us. Entities we acquire may not achieve the revenue and earnings we anticipate or their liabilities may exceed our expectations. We could face integration issues pertaining to the internal controls and operational functionssuch termination of the acquired companiesprime contract, our sub-contract will similarly terminate, and we also could fail to realize cost efficiencies or synergies that we anticipated when selecting our acquisition candidates. Customer dissatisfaction or performance problems with a particular acquired entitythe resulting contract loss could materially and adversely affect our reputation as a whole. We may be unable to profitably manage entities that we have acquired or that we may acquire, or we may fail to integrate them successfully without incurring substantial expenses, delays or other problems. If we fail to successfully integrate the businesses that we acquire, we may not

Table of Contents

realize any of the benefits that we anticipate in connection with the acquisitions and that could have a material adverse effect on our reputation, business, financial condition, results of operations and cash flows.

We are subjectobtain a significant portion of our business through competitive bidding in response to extensive government regulationrequests for proposals. Reprocurements and future contracts may not be awarded through this process on the same level or our government contracts are subject to audit and investigation rights. Any violation of the laws and regulations applicable to us or a negative audit or investigation findingcontract awards may be challenged by interested parties which could have a material adverse effect onmaterially adversely affect our reputation, business, financial condition, results of operations and cash flows.

 Much

In order to market our solutions and services and compete for contracts with existing and potential state and federal customers, we are often required to respond to government-issued RFPs. These RFP responses typically require us to assemble and submit a large volume of information within a rigid timetable, and to accurately estimate our business is regulated bycost structure for servicing the federal governmentproposed contract, the time required to establish operations and the states in which we operate. The laws and regulations governing our operations are generally intended to benefit and protect individual citizens, including government program beneficiaries, health plan members and providers, rather than stockholders. The government agencies administering these laws and regulations have broad latitude to enforce them. These laws and regulations, along with thelikely terms of any proposals submitted by our government contracts, regulate how we do business, what services we offer and how we interact with our customers, providers, other healthcare payers andcompetitors. We may also be required to disclose the public. We are subject, on an ongoing basis, to various governmental reviews, audits and investigations to verify our compliance with our contracts and applicable laws and regulations.

        In addition, because we receive payments from federal and state governmental agencies, we are subject to various laws, including the Federal False Claims Act and similar state statutes, which permit government law enforcement agencies to institute suits against us for violations and, in some cases, to seek double or treble damages, penalties and assessments. In addition, private citizens, acting as whistleblowers, can sue on behalfoccurrence of the government under the "qui tam" provisions of the Federal False Claims Act and similar statutory provisions in many states.

        The expansion of our operations into new products and services may further expose us to requirements and potential liabilities under additional statutes and legislative schemes that have previously not been relevant toany negative events suffered by our business, such as banking and credit reporting statutes, that may both increase demands on our resources for compliance activities and subject us to potential penalties for noncompliance with statutory and regulatory standards. Increased involvement in analytic or audit work that can have an impact on the eligibility of individuals for medical coverage or specific benefits could increase the likelihood and incidence of our being subjected to scrutiny or legal actions by parties other than our customers, based on alleged mistakes or deficiencies in our work, with significant resulting costs and strain on our resources.

        If the government discovers improper or illegal activities in the course of audits or investigations, we may be subject to various civil and criminal penalties and administrative sanctions, which may include termination of contracts, forfeiture of profits, suspension of payments, fines and suspensions and debarment from doing business with the government. The risks to which we are subject, particularly under the Federal False Claims Act and similar state fraud statutes, have increased in recent years due to legislative changes that have (among other amendments) expanded the definition of a false claim to include, potentially, any unreimbursed overpayment received from, or other monetary debt owed to,customer disputes, a government agency. This subjects usinquiry or an adverse judgment or settlement in litigation or a legal proceeding, which could impair our ability to potential liability for a false claim, for example, where we may be overcharged for services by a subcontractor and may pass that charge on to a government customer,win the contract at issue or where we may have a good faith disagreement with a government agency's view of whether an overpayment has occurred. If we are found to be in violation of any applicable law or regulation, or if we receive an adverse review, audit or investigation, any resulting negative publicity, penalties or sanctions could have anmaterial adverse effect on our reputation in the industry, impairindustry.

Even if we win these contracts, we may fail to secure favorable contract terms and conditions, or a government’s determination to award us the contract may be challenged by an interested party. Under the state and federal laws and regulations governing procurements of goods and services, challenges and award protests may be filed even if there are no valid legal grounds on which to base the protest. The filing of such challenges could potentially delay the start or implementation of the contract if the government agency determines to withhold a contract award or suspend contract performance while the protest is being considered, or to take corrective action on its own, such as soliciting new bids or terminating the contract award or current procurement. In the event of irregularities, we perceive or learn of in the award or bidding process, we also may be forced to file protests in response to RFP awards to other bidders. Resolution of a protest, even in our favor, could force us to expend considerable funds in disputing the potential award or to incur additional expenses to maintain our ability to competetimely start implementation, which may cause our actual results to differ materially and adversely from those anticipated. In addition, if we are unable to win reprocurements or protests of particular contracts, we may be precluded from entering certain customer markets for the term of the contract awarded to another party. Any failure to continue to obtain contracts in response to government RFPs, to design proposals that result in profitable contracts, to win new contracts andor re-procure current contracts after they expire or to prevail in protests or challenges of contract awards could have a material adverse effect on our business, financial condition, results of operations and cash flows.

Table of Contents

We may be a party to litigation, regulatory, or other dispute resolution proceedings. Adverse judgments or settlements in any of theselegal proceedings could materially harm our business, financial condition, operating results and operating results.cash flows.

We are subject and may be a party to lawsuits and other claims that arise from time to time in the ordinary course of our business. Thesebusiness, which may include lawsuits and claimsthose related to, for example, contracts, subcontracts,sub-contracts, teaming agreements, protection of confidential information or trade secrets, adversary proceedings arising from customer bankruptcies, employment of our workforce and immigration requirements or compliance with any of a wide array of state and federal statutes, rules and regulations that pertain to different aspects of our business. We may also be required to initiate expensive litigation or other proceedings to protect our business interests. In addition, because of the payments we receive from government customers, we may be subject to unexpected inquiries, investigations, legal actions or enforcement proceedings pursuant to the False Claims Act, healthcare fraud, waste and abuse laws or similar legislation. Any investigations, settlements or adverse judgments stemming from such legal disputes or other claims may result in significant monetary damages or injunctive relief against us, as well as reputational injury that could adversely affect us. There is a risk that we will not be successful in suchor otherwise be able to satisfactorily resolve any pending or future litigation. In addition, litigation and other legal claims are subject to inherent uncertainties and management'smanagement’s view of currently pending legal matters may change in the future. Those uncertainties include, but are not limited to, litigation costs of litigation,and attorneys’ fees, unpredictable judicial or jury decisions and the differing laws and judicial proclivities regarding damage awards among the states in which we operate. Unexpected outcomes in such legal proceedings, or changes in management'smanagement’s evaluation or predictions of the likely outcomes of such proceedings (possibly resulting in changes in established reserves), could have a material adverse effect on our business, financial condition, results of operations and cash flows.

We may not be able to deliver our solutions and services efficiently if we are unable to attract and retain qualified employees.

Our successful delivery of services and solutions is dependent upon our ability to recruit, employ, train and retain skilled personnel. Our ability to maintain our productivity and profitability is limited by our ability to attract and retain the skilled personnel necessary to sustain our business and operations. The success of recruitment and retention strategies depend on a number of factors, including the competitive demands for employees having the skills we need and the level of compensation required to hire and retain such employees. As our business expands and undergoes change, we may also find it difficult to preserve our corporate culture, which could reduce our ability to innovate and operate effectively or result in a loss of experienced personnel. In addition, our customers or competitors may hire away our qualified employees. We may not be able to recruit the appropriate personnel or maintain the personnel necessary to efficiently operate and support our business, and even if our recruitment and retention strategies are successful, our labor costs may increase significantly. Our inability to hire sufficient personnel on a timely basis without significantly increasing our labor costs could materially adversely affect our business, financial condition, results of operations and cash flows.

Our future success depends, in part, on the continued service of members of our management team.

Our ability to execute on our business plans and future success requires that we attract, develop, motivate and retain experienced and innovative executive officers and senior managers who have successfully managed, designed or implemented government services programs or information technology projects, or have relevant experience in other sectors of data management or the healthcare industry. These individuals are in great demand and are likely to remain a limited resource in our industry. The loss of services of one or more members of our management team could materially adversely affect our business, financial condition, results of operations and cash flows. In addition, to the extent we lose an executive officer or senior manager, we may incur increased expenses in connection with the hiring, promotion or replacement of these individuals and the transition of leadership and critical knowledge.

Our outstanding indebtedness could materially adversely affect our financial condition and our ability to operate our business, and we may not be able to generate sufficient cash flows to meet our debt service obligations.

 In December 2011, we entered into a five-year, revolving and term secured credit agreement with certain financial institutions and Citibank, N.A. as Administrative Agent in connection with our acquisition of HDI. In May 2013, we amended and restated the credit agreement and entered into a $500 million five-year revolving credit agreement ("Credit Agreement"). Under specified circumstances, the revolving credit facility under the Credit Agreement can be increased or one or more incremental term loan facilities can be added. Our obligations and any amounts due under the Credit Agreement are guaranteed by our material subsidiaries and secured by a security interest in all, or substantially all, of our and our subsidiaries' physical assets.

As of December 31, 2014,2016, the outstanding principal balance due on the revolving credit facilityunder our Credit Agreement was $197.8 million.

Our outstanding indebtedness and any additional indebtedness we incur may have important consequences for us, including, without limitation, that: (i) we may be required to use a substantial portion of our cash flow to pay the principal of and interest on our indebtedness; (ii) our indebtedness and leverage may increase our vulnerability to adverse changes in general economic and industry conditions, as well as to competitive pressures; (iii) our ability to obtain additional financing for working capital, capital expenditures, acquisitions and for general corporate and other purposes may be limited; and (iv) our flexibility in planning for, or reacting to, changes in our business and our industry may be limited.

In addition, our ability to make payments of principal and interest on our outstanding revolving credit facility depends upon our future performance and our ability to generate cash flows. Under the terms of the Credit Agreement, we are required to comply with specified financial and operating covenants, which may limit our ability to operate our business as we otherwise might operate it. For example, our obligations may be accelerated upon the occurrence of an event of default, which includes customary events of default including, without limitation, payment defaults, failure to perform affirmative covenants, failure to refrain from actions or omissions prohibited by negative covenants, the inaccuracy of representations or warranties, cross-defaults, bankruptcy and insolvency related defaults, defaults relating to judgments, defaults due to certain ERISA related events and a change of control default. If not cured, an event of default would result in any amounts outstanding, including any accrued interest and unpaid fees, becoming

Table of Contents

immediately due and payable, which would require us to, among other things: seek additional financing in the debt or equity markets, refinance or restructure all or a portion of our indebtedness, sell selected assets, and/or reduce or delay planned capital or operating expenditures. Such measures might not be sufficient to enable us to service our debt, and any such financing or refinancing might not be available on economically favorable terms or at all. If we are not able to generate sufficient cash flows to meet our debt service obligations or are forced to take additional measures to be able to service our indebtedness, our business, financial condition and results of operations could be materially and adversely affected.

We obtain a significant portionChanges in, or interpretations of, tax rules and regulations may materially adversely affect our business through competitive bidding in response to government requests for proposals and future contracts may not be awarded through this process on the same level and we may not re-procure certain contracts.effective tax rates.

 In order

We are a United States-based company subject to market our services to customers, we are often required to respond to government-issued requests for proposals ("RFPs") to compete for a contract. This requires that we accurately estimate our cost structure for servicing a proposed contract, the time required to establish operationsvarious federal, state and the likely terms of any proposals submitted by our competitors. We must also assemble and submit a large volume of information within a RFP's rigid timetable, and our ability to provide timely and complete responses to RFPs will greatly impact our business. Should any part of our business suffer a negative event, for example, a customer dispute or a government inquiry, we may be required to disclose the occurrence of that event in a RFP, which could impact our ability to win the contract at issue. We cannot provide assurance that we will continue to obtain contracts in response to government RFPs, that we will be successful in re-winning contracts after they expire, or that our proposals will result in profitable contracts. In addition, if we are unable to win particular contracts, we may be precluded from entering certain customer markets for a number of years. If we are unable to consistently win new contract awards over any extended period, our business and prospects will be adversely affected.

If we fail to accurately estimate the factors upon which we base our contract pricing, we may generate less profit than expected or incur losses on those contracts.

        Our pricing is dependent on our internal forecasts and predictions about our projects and the marketplace, which might be based on limited data and could turn out to be inaccurate. A majority of our contracts are contingency fee based. For contingency fee based offerings, we receive our fee based on recoveries received by our customers. Our ability to earn a profit on a contingency fee offering requires that we accurately estimate costs involved and outcomes likely to be achieved and assess the probability of completing multiple tasks and transactions within the contracted time period. Some of our contracts with the federal government are cost-plus or time-and-material based. Revenue on cost-plus contracts is recognized based on costs incurred plus an estimate of the negotiated fee earned. To earn a profit on these contracts, we must accurately estimate costs involved and assess the probability of achieving certain milestones within the contracted time period. If we do not accurately estimate the costs and timing for completing projects, or if we encounter increased or unexpected costs, delays, failures, liabilities or risks, including those outside of our control, our contracts could prove unprofitable for us or yield lower profit margins than anticipated. Although we believe that we have recorded adequate provisions in our financial statements for losses on our fixed-price and cost-plus contracts where applicable, as required under United States generally accepted accounting principles ("U.S. GAAP"), we cannot provide assurance that our contract loss provisions will be adequate to cover all actual future losses.

The U.S. government's determination to award a contract may be challenged by an interested party. As a result, even if we win a bid, the contract may be delayed or may never be implemented if such a challenge is successful.

        Thelocal tax laws and regulations governing procurementsin multiple U.S. jurisdictions that govern numerous aspects of goods andour business. As we expand our business, we may perform services by the U.S. government provide procedures by which other bidders and other interested parties may challenge the award of a government contract. Challenges or protests to government awards may be filed even if there are no valid

Table of Contents

legal grounds on which to base the protest. If any such protests are filed, the government agency may decide to withhold a contract award or suspend performance under the contract while the protest is being considered by the GAO or the applicable federal court, or may choose to take corrective action on its own, in each case, potentially delaying the startfor new customers located outside of the contract. If we are the original awardee ofUnited States or in a protested contract, we could be forcedU.S. Territory, which may subject us to expend considerable funds to defend a potential award, while also incurring expenses to maintain our ability to timely start implementation in case the protest is resolved in our favor. It can take many months to resolve these protests, and even if it is resolved in our favor, the resulting delay in the start-up and funding of our work under the contracts may cause our actual results to differ materially and adversely from those anticipated. In the event of irregularities we perceive or learn of in the award or bidding process, we also may be forced to file protests in response to RFP awards to competitors, at significant cost to us. In addition, a contract award may be terminated or the government agency may opt to solicit new bids and award a new contract if a protest is successful or the government agency chooses not to uphold its original award. We cannot provide assurance that we will prevail if a contract we are awarded is protested or that if we protest an award we will be successful. Extended implementation delays or successful challenges of our contract awards could have a material adverse effect on our financial condition or results of operations.

We depend on many different entities to supply information and an inability to successfully manage our relationships with a number of these suppliers may harm the quality and availability of our services.

        We obtain data used in our services from many sources, including commercial insurance plans, financial institutions, managed care organizations, government entities and non-government entities. From time to time, challenges arise in managing and maintaining our relationships with entities that are not our customers and that furnish information to us pursuant to a combination of voluntary cooperation and legal obligation underforeign tax laws and regulations that could increase our exposure to additional tax liabilities. Unanticipated changes in our tax rates could affect our future results of operations. Our future effective tax rates could be unfavorably affected by changes in the tax rates in jurisdictions where our income is earned and taxed, by changes in, or our interpretation of, tax rules and regulations in the jurisdictions in which we do business, by providing services in new jurisdictions, by increases in expenses not deductible for tax purposes including impairments of goodwill, by changes in U.S. GAAP or by changes in the valuation of our deferred tax assets and liabilities. Furthermore, the results of the 2016 elections create uncertainty regarding future potential tax law reform.

In addition, we are often subject to differing interpretation. Our data suppliers may determine that some uses of data for our customers are not permitted by our agreements, and seek to limit or end our access and use of certain data for particular purposes or customers. They may also make errors in compiling, transmitting or accurately characterizing data, or may have technological limitations that interfere with our receipt or use of the data we are relying upon them to provide. If a number of information sources or suppliers become unable or unwilling to provide us with certain data under terms of use that are acceptable to us and our customers, or if the applicable regulatory and law enforcement regime for use and protection of this data changes in a way that imposes unacceptable or unreasonable conditions or risks on us or disincentivizes our suppliers to continue to provide us with data, we cannot provide assurance that we will be able to obtain new agreements with alternative data suppliers on terms favorable to us, or at all. If we lose our data sources or access to certain data; are unable to identify and reach the requisite agreements with suitable alternative suppliers and integrate these data sources into our service offerings; or there is a lack of integrity of data that our suppliers provide, we could experience service disruptions, increased costs, reduced qualitycontinual examination of our services and/or performance penalties under our customer contracts, which could have an adverse effect on our business, financial condition, results of operations or cash flows.

We may rely on subcontractors and partners to provide customers with a single-source solution or we may serve as a subcontractor to a third party prime contractor.

        From time to time, we may engage subcontractors, teaming partners or other third parties to provide our customers with a single-source solution for a broader range of service needs. Similarly, we are and may in the future be engaged as a subcontractor to a third party prime contractor. Subcontracting arrangements pose unique risks to us because we do not have control over the customer relationship, and our ability to generate revenue under the subcontract is dependent on the prime contractor, its performance and relationship with the customer and its relationship with us. While we believe that we perform appropriate due diligence on our prime contractors, subcontractors and teaming partners and that we take adequate measures to ensure that they comply with the appropriate laws and regulations, we cannot guarantee that

Table of Contents

those parties will comply with the terms set forth in their agreements with us (or in the case of a prime contractor, their agreement with the customer), or that they will be reasonable in construing their contractual rights and obligations, always act appropriately in dealing with us or customers, provide adequate service, or remain in compliance with the relevant laws, rules or regulations. We may have disputes with our prime contractors, subcontractors, teaming partners or other third parties arising from the quality and timeliness of work being performed, customer concerns, contractual interpretations or other matters. Performance deficiencies or misconduct by our prime contractors or subcontractors or perceived performance deficiencies by us could result in a contract termination and/or could adversely affect our customer relationships and reputation. We may be exposed to liability if we lose or terminate a subcontractor or teaming partner due to a dispute, and subsequently have difficulty engaging an appropriate replacement or otherwise performing their functions in-house, such that we fail to fulfill our contractual obligations to our customer. In the event a prime contract, under which we serve as a subcontractor, is terminated, whether for non-performanceincome tax returns by the prime contractor or otherwise, then our subcontract will similarly terminateIRS and we could face contractual liability andother domestic tax authorities. We regularly assess the likelihood of outcomes resulting contract loss could adversely affect our business, financial condition, results of operations and cash flows.

We use software vendors, utility providers and network providers in our business and could be materially adversely affected if they cannot deliver or perform as expected or if our relationships with them are terminated or otherwise change.

        Our abilityfrom these examinations to service our customers and deliver and implement solutions requires that we work with certain third party providers, including software vendors, utility and network providers and depends on such third parties meeting our expectations in both timeliness and quality. Our business could be materially and adversely affected and we might incur significant additional liabilities ifdetermine the services provided by these third party providers do not meet our expectations, or if they terminate or refuse to renew their relationships with us, or if they were to offer their products to us in the future on less advantageous terms. In addition, while there are backup systems in manyadequacy of our operating facilities, an extended outageprovision for income taxes and have reserved for potential adjustments that may result. The final determination of utility or network services supplied byany of these vendors or providers mayexaminations could have a material adverse effect on our business, financial condition, results of operations and cash flows.

Our health insurance coverage and self-insurance reserves may not cover future claims, which could materially adversely affect our business, financial condition, results of operations and cash flows.

We maintain various insurance policies for company employee health, workers’ compensation, general liability and property damage. We are self-insured for our health plans, and have purchased a fully-insured stop loss policy to help offset our liability for both individual and aggregate claim costs. We are also responsible for losses up to a certain limit for workers’ compensation, general liability and property damage insurance.

For policies under which we are responsible for losses, we record a liability that represents our estimated cost of claims incurred and unpaid as of the balance sheet date. Our estimated liability is not discounted and is based on a number of assumptions and factors, including historical trends, actuarial assumptions and economic conditions, and is closely monitored and adjusted when warranted by changing circumstances. Our prior growth could affect the accuracy of estimates based on historical experience. Should a greater amount of claims occur compared to what was estimated or medical costs increase beyond what was expected, our accrued liabilities might not be sufficient and we may be required to record additional expense. Unanticipated changes may also produce materially different amounts of expense than reported under these programs, which could materially adversely affect our business, financial condition, results of operations and cash flows.

We identified material weaknesses in our internal control over financial reporting, and if we fail to remedy them or other material weaknesses that we may identify in the future, our financial statements could be materially misstated.

Our management is responsible for establishing and maintaining adequate internal control over our financial reporting, as defined in Rule 13a-15(f) under the Exchange Act. As described in Part II, Item 9A of this Annual Report on Form 10-K, management identified material weaknesses in our internal control over financial reporting as of December 31, 2016 related to the calculation of the estimated liability for appeals balance in connection with our CMS reserve and the valuation of our accounts receivable allowance. These material weaknesses resulted in an immaterial reclassification error in revenue and selling, general and administrative expenses that was corrected prior to issuance of the consolidated financial statements. Until remediated, these material weaknesses could result in misstatements of account balances or disclosures that would result in a material misstatement to the annual or interim consolidated financial statements that will not be prevented or detected on a timely basis.

We are actively revising and supplementing our control environment and our risk assessment process and the design of our process level controls in order to remediate these material weaknesses, including a set of compensating controls in the near term. We are enhancing and revising the design of controls and procedures to ensure the calculations of the CMS reserve and the accounts receivable allowance properly utilize historical information to derive the period-end balances. Additionally, management will be supplementing the review controls over the CMS reserve and the accounts receivable allowance, and controls over the completeness and accuracy of the data used to calculate the balances, with additional levels of review involving senior members of our accounting department and will assess the need for additional remediation steps.

We cannot predict the outcome of our assessment and that of our independent registered public accounting firm in future periods. If our remedial measures are insufficient to address the material weaknesses, or if additional material weaknesses or significant deficiencies in our internal controls are discovered or occur in the future, we may fail to meet our future reporting obligations on a timely basis, our financial statements may contain material misstatements, our operating results or financial condition may be negatively impacted, and we may be subject to litigation and regulatory actions, causing investor perceptions to be adversely affected and potentially resulting in a decline in the market price of our common stock.

Risks Relating to Our Industry

Our business could be materially adversely affected by changes in the U.S. healthcare environment or in laws relating to healthcare programs and policies, particularly as they relate to the ACA and the Medicare and Medicaid programs.

The healthcare industry in the United States is subject to changing political, economic and regulatory influences that may affect the procurement practices and operations of federal, state and commercial healthcare organizations and agencies. The ACA’s emphasis on program integrity and cost containment, along with its expansion of Medicaid, created new opportunities to grow our business and our service offerings. However, due to a wide range of factors contributing to uncertainty of the healthcare landscape, including, among other factors, the results of the 2016 elections, Congressional activity to repeal the ACA, and the numerous, varying ACA replace measures that may encompass Medicaid, Medicare and commercial insurance, it is difficult to predict its full impact and influence on future changes to healthcare policy. Policies that fundamentally change the financial structure of the Medicaid program, currently funded jointly by the states and the U.S. Federal Government, could result in early termination or non-renewal of our contracts with certain state government customers. Federal changes may also reduce reimbursement rates to states, establish new payment models, increase or decrease government involvement in healthcare, decrease the Medicare RAC Program, or otherwise change the operating environment for our customers. Healthcare organizations may react to such changed circumstances and financial pressures by taking actions to ramp up, curtail or defer their retention of cost containment providers like us, which could impact the demand for our solutions and services. While certain changes may present new opportunities to us, our business, financial condition, results of operations and cash flows could be materially adversely affected if efforts to waive, modify or otherwise change the ACA, in whole or in part, are successful, if we are unable to protectadapt our intellectual property rightssolutions and services to meet changing requirements or expand service delivery into new areas, or if the valuedemand for our solutions and services is reduced.

Healthcare spending fluctuations, simplification of the healthcare payment process or other aspects of the healthcare financing system, budgetary pressures and/or programmatic changes diminishing the scope of program benefits, or limiting payment integrity initiatives, could reduce the need for and the price of our productssolutions and services, may be diminished andwhich would have a material adverse effect on our business, may be adversely affected.financial condition, results of operations and cash flows.

Our projections and expectations are premised, in part, upon consistent growth rates in spending in the Medicare and Medicaid programs, the current healthcare financing system and the need for our solutions and services within that existing framework. Our success as a company depends in part upon our ability to protect our core technology and intellectual property. Our expanding operations and efforts to develop new productsis based on offering solutions and services also make protectionthat improve the ability of our intellectual property more critical. The steps we have takencustomers to deter misappropriation of intellectual property mayidentify and recover revenue that would otherwise be insufficient to protect our proprietary information. From time to time, competitors have attempted to use state open records and/or federal Freedom of Information Act laws to obtain our proposal responses. We cannot be certain that our efforts to protect these confidential and proprietary elements will always be successful, due to the many factors that go into the various state and federal decisions to release information (even in spite of our objections and responses). In addition, misappropriation of our intellectual property by third parties, or any disclosure or dissemination of our business intelligence, queries, algorithms and other similar information by any means, could undermine any competitive advantage we currently derive or may derive. On the other hand, third parties may claim that we are infringing upon or misappropriating their intellectual property. Our exposure to risks related to the use of intellectual property may also increaselost often as a result of acquisitions since third partiesprocedural inefficiencies and complexities in that system. However, the need for our solutions and services, the price customers are willing to pay for them or the scope and profitability of our contracts could be negatively affected by a number of factors, including a lower than projected growth in Medicare and Medicaid programs due to developments such as the possible repeal of or modification to the ACA, and any action taken to reduce eligibility or services, or reform Medicaid spending. The absence of near-term compliance deadlines effected by the ACA and other legislation could additionally cause our revenue to decline. There can be no certainty that additional incentives will be created in regard to our solutions and services, or that any legislation or regulations that may make infringementbe adopted would favorably impact our business.

Modifications in provider billing behavior and similarhabits, often in response to the success of our solutions and services or to changes that reduce healthcare spending, could also reduce the profitability of our contracts and reduce the need for our solutions and services. Compounding this are budgetary pressures that may drive changes at the state level. The demand for our solutions and services could also be impacted by other changes in government healthcare programs or in the level of government spending, such as:

For example, during 2014 and 2015, our recovery audit services under HDI’s existing Medicare RAC contract were limited because of significant delays in procurement activities for the new Medicare RAC contract awards, resulting from, in part, the cancellation of the original and second procurements following the denial of pre-award protests and ongoing litigation regarding certain payment terms proposed by CMS as part of the new Medicare RAC proposals. In October 2016, CMS announced the new awards, including the award of RAC Region 4 to our wholly owned subsidiary. These new Medicare RAC contracts are currently being implemented and we currently expect that audits will begin in Q2 2017. Our existing Medicare RAC contract ends on January 31, 2018, and we are required to maintain certain reserves related to pending appeals for this contract through at least this date. In addition, CMS has shifted the responsibility for initial medical reviews of short inpatient stays from the Medicare RACs to Quality Improvement Organizations, further restricting the Medicare RACs review to a small subset of claims for potential payment inaccuracies. CMS has also implemented new ADR limits for inpatient providers that reduces the ADR requirement to 0.5% under the new contract, down from the 2.0% ADR requirement under the prior contract. This change significantly impacts the volumes of claims Medicare RACs are permitted to review for inpatient providers and reduces their ability to identify overpayments and underpayments under their Medicare RAC contracts. For the new contract, CMS has continued to maintain the previously established ADR limits for institutional providers, originally established in January 2016, which reduced the ADR requirement to 0.5%. In April 2016, CMS instituted a new policy adjusting ADR limits based on provider denial rate after three (3) 45-day ADR cycles. This change significantly impacts the volumes of claims Medicare RACs are permitted to review for inpatient providers, and reduces their ability to identify overpayments and underpayments under their Medicare RAC contracts in the near term, pending the adjustment of ADR limits based on provider denial rates established following the first three (3) cycles of RAC reviews.

Further, in August 2014, CMS announced it would settle with hospitals willing to withdraw inpatient status claims currently pending in the RAC appeals process by offering to pay hospitals 68% for all eligible claims they had billed to Medicare. In June 2015, CMS notified HDI that based on the initial lists of finalized settlements, HDI owed CMS approximately $28.6 million due to adjustments in contingency fees under our existing Medicare RAC contract. HDI previously advised CMS that it disagrees with CMS’ interpretation of the contract and that CMS does not have the contractual right, among other things, to require repayment of fees already paid. The amount ultimately payable to CMS by HDI remains uncertain. In addition, in September 2016, CMS announced that it would extend an opportunity for another round of settlements for hospitals that were eligible for but did not choose to participate in the 2014 settlement, with CMS offering to pay 66% for all eligible claims they had billed to Medicare. We believe this settlement will be processed and evaluated by CMS over the course of 2017, and the number and amount of claims that will be subject to the 2016 settlement remains uncertain. There could be a material negative impact on our future revenue to the extent that (i) any final determination of amounts owed by us to CMS under the current Medicare RAC contract materially exceeds our accrued reserves for such appeals, (ii) we have acquired technology. Anyare required to increase or decrease our contractually required reserves with respect to pending appeals due to changes in appeal performance, changes in data provided to us from other entities in the RAC process, or other related factors, (iii) we are required to repay a portion of prior fees associated with the hospital settlement program, (iv) we are unable to obtain full payments for properly provided services, or (v) future fees payable to us by CMS are reduced. Although we do not anticipate our Medicare RAC contract will represent a significant portion of our business going forward, our Medicare RAC contract still represents a future business opportunity for us and any of these situations could result infactors or other changes to the Medicare RAC program that materially reduce our expending significant time and incurring expense to defend ourselvesrevenue or to enforce our intellectual property rights and could result in our being prevented from furnishing certain products and services. Although we have taken measures to protect our proprietary rights, we cannot provide assurance that others will not competeprofitability with our business by offering products or concepts that are substantially similar to ours. If the protection of our proprietary rights is inadequate to prevent

Table of Contents

unauthorized use or appropriation by third parties or our employees, the value of our brand and other intangible assets may be diminished and competitors may be able to more effectively mimic our products and services, whichsuch program could have ana material adverse effect on our business, financial condition, results of operations and cash flows.

Our systemsA failure to comply with the laws and networksregulations that apply to companies in our industry regarding individual privacy and information security could subject us to legal actions, fines and penalties and negatively impact our reputation and operations.

As a service provider, we often receive, process, transmit and store sensitive data, including PHI and personally identifiable information of individuals, as well as other financial, confidential and proprietary information belonging to our customers, subsidiaries, data supplies and other third parties from which we obtain information. The use and disclosure of that information is regulated at the federal, state, international and industry levels and we are also obligated by our contractual requirements with customers. For example, we are subject to federal regulation under HIPAA, as amended by the HITECH Act, the Final Omnibus Privacy, Security, Breach Notification, and Enforcement Rule, which modified and supplemented many of the standards and regulations under HIPAA and the HITECH Act, and various state laws. HIPAA also imposes standards and requirements on our business associates as defined under HIPAA.

Even though we take measures to comply with all applicable regulations and to ensure our business associates and sub-contractors comply with these laws, regulations and rules, we have less than complete control over our business associates’ and sub-contractors’ actions and practices. We may be exposed to data breach risk if there is unauthorized access to one of our or our sub-contractors’ secure facilities or from lost or stolen laptops, other portable media from current or former employee theft of data containing PHI, from misdirected mailings containing PHI, or other forms of administrative or operational error. If we or our sub-contractors fail to comply with applicable laws; if unauthorized parties gain physical access to one of our facilities and steals or misuses confidential information; if we erroneously use or disclose data in a way that is inconsistent with our granted rights; or if such information is misdirected, lost or stolen during transmission or transport, we may suffer damage to our reputation, potential loss of existing customers and difficulty attracting new customers. We could also be exposed to, among other things, unfavorable publicity, governmental inquiry and oversight, allegations by our customers that we have not performed our contractual obligations, costs to provide notifications to affected individuals, or litigation by affected parties and possible financial obligations for damages or indemnification obligations related to the theft or misuse of such information, any of which could have a material adverse effect on our business, financial condition, results of operations and cash flows.

In addition, laws, rules and regulations concerning the protection of personal information are subject to frequent change by legislation, regulatory issuances or administrative interpretation. As regulatory focus on privacy issues continues to increase and these laws and regulations continue to expand and become more complex, these potential risks to our business could intensify. Changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, such as healthcare data or other personally identifiable information, along with increased customer demands for enhanced data security infrastructure, could greatly increase our cost of providing our solutions and services.

We are subject to extensive government regulation, including government audits and investigations relating to our compliance with the laws and regulations applicable to companies in our industry, and a negative finding or other adverse determination could have a material adverse effect on our reputation, business, financial condition, results of operations and cash flows.

Much of our business is regulated by the federal government and the states in which we operate. The laws and regulations governing our operations are generally intended to benefit and protect individual citizens, including government program beneficiaries, health plan members and providers, rather than shareholders, and the government agencies administering these laws and regulations have broad latitude to enforce them. As such, we are subject, on an ongoing basis, to various governmental reviews, audits and investigations to verify our compliance with our contracts and applicable laws and regulations, as well as legal actions and enforcement proceedings. For example, because we receive payments from federal and state governmental agencies, we are subject to various laws, including the Federal Acquisition Regulations, the Foreign Corrupt Practices Act, federal and state employment, equal opportunity and affirmative action laws, federal and state prompt pay statutes. We are also subject to Federal False Claims Act and similar state statutes, which permit government law enforcement agencies to institute suits against us for violations and, in some cases, to seek double or treble damages, penalties and assessments. In addition, private citizens, acting as whistleblowers, can sue on behalf of the government under the “qui tam” provisions of the Federal False Claims Act and similar statutory provisions in many states.

The expansion of our operations into new solutions and services may further expose us to requirements and potential liabilities under additional statutes and legislative schemes that have previously not been relevant to our business, such as banking and credit reporting statutes, that may both increase demands on our resources for compliance activities and subject us to potential penalties for noncompliance with statutory and regulatory standards. Increased involvement in analytic or audit work that can have an impact on the eligibility of individuals for medical coverage or specific benefits, or payments made by our customers to providers, could increase the likelihood and incidence of our being subjected to scrutiny or legal actions by parties other than our customers, based on alleged mistakes or deficiencies in our work, with significant resulting costs and strain on our resources.

These laws and regulations, along with the terms of our government contracts, regulate how we do business, what solutions and services we offer and how we interact with our customers, providers, other healthcare payers and the public. If the government discovers improper or illegal activities in the course of audits or investigations, we may be subject to cyber security breachesvarious civil and criminal penalties and administrative sanctions, which may include termination of contracts, forfeiture of profits, suspension of payments, fines and suspensions and debarment from doing business with the government. Similarly, if our customers assert that we have failed to properly perform or comply with our contractual obligations, or if the carriers to which we send billings assert that we have failed to properly comply with applicable federal or state billing rules and regulations, we may be required to provide refunds or make payments to resolve such issues. The risks to which we are subject, particularly under the Federal False Claims Act and similar state fraud statutes, have also increased in recent years due to legislative changes that have (among other disruptionsamendments) expanded the definition of a false claim to include, potentially, any unreimbursed overpayment received from, or other monetary debt owed to, a government agency. This subjects us to potential liability for a false claim, for example, where we may be overcharged for services by a sub-contractor and may pass that could compromise our information and harm our business.

        In the ordinary coursecharge on to a government customer, or where we may have a good faith disagreement with a government agency’s view of our business,whether an overpayment has occurred. If we rely heavily upon our technology systems and networksare found to input, maintain and communicate the confidential and proprietary databe in violation of any applicable law or regulation, or if we receive on behalf of our customers. The secure processing and maintenance of this information is critical to our operations and business strategy. Our security measuresan adverse review, audit or investigation, any resulting negative publicity, penalties or sanctions could be compromised and, as a result, our data, customers' data, information technology or infrastructure could be accessed improperly, made unavailable, improperly modified, corrupted by computer hackers, computer viruses or other malicious software programs that could attack our services or breached due to employee error or malfeasance, all of which could create system disruptions and cause shutdowns or denials of service. This is also true for third-party products or services that we use. In addition, subcontractors, teaming partners or other third party vendors that receive or utilize confidential informationhave an adverse effect on our behalf may become subject to a security breach, which may resultreputation in unauthorized access to such third-party's information systems and/or our customers' protected information. The occurrence of any of these events could cause our services to be perceived as vulnerable, cause our customers to lose confidence in our services, negatively affectthe industry, impair our ability to attractcompete for new customers, cause existing customers to terminatecontracts or not renew our services and damage our reputation, all of which could reduce our revenue, increase our expenses and expose us to legal claims and regulatory actions. Similarly, if our internal networks are compromised, we could be adversely affected by the loss of proprietary, trade secret or confidential technical and financial data. Because techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until they are launched against a target, we may be unable to anticipate these techniques or to implement adequate preventive measures. We could be forced to expend significant resourcesbid in response to RFPs in one or more jurisdictions and have a cyber-security breach, including repairing system damage, increasing cyber security protection costs by deploying additional personnel and protection technologies, paying regulatory fines and litigating and resolving legal claims and regulatory actions, all of which could increase our expenses, divert the attention of our management and key personnel away frommaterial adverse effect on our business, financial condition, results of operations and adversely affect our results of operations.cash flows.

The federal government or a

Federal and state governments may limit or prohibit the outsourcing of certain programs or functions, or may refuse to grant consents and/or waivers necessary to permit private entities such as us, to perform certain elements of government programssuch work, or functions, or there may beimpose other state or federal limitations on our outsourcing of work or our vendor usecertain vendors that may obstruct cost-effective performance of our contracts.

The federal government or a state could limit or prohibit private contractors like us from operating or performing elements of certain government functions or programs. State or local governments could be required to operate such programs with government employees as a condition of receiving federal funding. Moreover, under current law, in order to privatize certain functions of government programs, the federal government must grant a consent and/or waiver to the petitioning state or local agency. If the federal government does not grant a necessary consent or waiver, the state or local agency will be unable to outsource that function to a privatecommercial entity. Such a situation could eliminate a contracting opportunity or reduce the value of an existing contract.

Similarly, other state or federal limitations on outsourcing certain types of work to vendors that supplement our own workforce could make it more difficult for us to fulfill our contracts in a cost-effective manner. Certain segments of our operations use or involve vendor or subcontractorsub-contractor personnel located outside of the United States, who may (under carefully controlled circumstances) access certain PHI in the

Table of Contents

course of assisting us with various elements of the services we provide to our customers. There is, however, increasing pressure from an expanding number of sources to prohibit the use of off-shore labor, particularly on government contracts. The federal government and a number of states have considered laws and/or issued rules, regulations, and orders that would limit, restrict or wholly prohibit the use of off-shore labor in performance of government contracts, or impose sanctions for the use of such resources. Some of our customers have already chosen to contractually limit or restrict our ability to use off-shore resources. Intensified restrictions of this type or associated penalties could raise our costs of doing business, expose us to unexpected fines or penalties, increase the prices we must charge to customers to realize a profit and eliminate or significantly reduce the value of existing contracts or potential contract opportunities, any of which could have a material adverse effect on our business, financial condition, results of operations and cash flows.

Changes in, or interpretations of, tax rules and regulations may adversely affect our effective tax rates.

        We are a United States-based company subject to various federal, state and local tax laws and regulations in multiple U.S. jurisdictions that govern numerous aspects of our business.

        Unanticipated changes in our tax rates could affect our future results of operations. Our future effective tax rates could be unfavorably affected by changes in the tax rates in jurisdictions where our income is earned and taxed, by changes in, or our interpretation of, tax rules and regulations in the jurisdictions in which we do business, by increases in expenses not deductible for tax purposes including impairments of goodwill, by changes in U.S. GAAP or by changes in the valuation of our deferred tax assets and liabilities.

        In addition, we are subject to the continual examination of our income tax returns by the U.S. Internal Revenue Service ("IRS") and other domestic tax authorities. We regularly assess the likelihood of outcomes resulting from these examinations to determine the adequacy of our provision for income taxes and have reserved for potential adjustments that may result. There can be no assurance that the final determination of any of these examinations will not have an adverse effect on our financial condition, results of operations and cash flows.

We may not be ableprecluded from bidding on or performing certain work due to realize the entire book value of goodwill and other intangible assets from acquisitions.

        As of December 31, 2014,work we have $361.5 million of goodwill and $74.6 million of net intangible assets. We assess goodwill and other intangible assets at least annually for impairment in the second quarter of each year, or more frequently if certain events or circumstances warrant. In the event that the book value of goodwill is impaired, any such impairment would be charged to earnings in the period of impairment. We cannot provide assurance that future impairment of goodwill will not have a material adverse effect on our business, financial condition, results of operations and cash flows.

Our success may depend on the continued service and availability of key personnel and we may be unable to attract and retain sufficient qualified personnel to properly operate our business.

        Our success and future growth is dependent upon the ability of our executive officers and our senior managers to generate business and execute on our business plans successfully. We have experienced executive turnover in the past year and have hired and promoted a number of new executive officers. We may face challenges in effectively managing our operations as they learn about our company and business and develop working relationships with our other executive officers and their staff. Our ability to execute on our business plans will be impacted if our management team cannot work together effectively, or if other members of our senior management team resign.

        In addition, our success requires that we attract, develop, motivate and retain experienced and innovative executive officers, senior managers who have successfully managed or designed government services programs or who have relevant experience in other sectors of the data management or healthcare

Table of Contents

industry and information technology professionals who have designed or implemented complex information technology projects. Innovative, experienced and technologically proficient individuals are in great demand and are likely to remain a limited resource. We cannot provide assurance that we will be able to continue to attract and retain the most capable and desirable executive officers and senior managers. We may incur increased expenses in connection with the hiring, promotion or replacement of any of these key individuals. The loss of the services of one or more of our key employees or the loss of significant numbers of senior managers or information technology professionalscurrently perform, which could materially adversely affect our business, financial condition, results of operations and cash flows.

Our ability

Various laws, regulations and administrative policies prohibit companies from performing work for government agencies in capacities that might be viewed to execute oncreate an actual or perceived conflict of interest. In particular, CMS has stringent conflict of interest rules, which can limit our bidding for specific work for CMS, or for other contracts is dependent onthat might conflict, or be perceived by CMS to conflict, with contractual work for CMS. State governments and managed care organizations also have conflict of interest restrictions that could limit our ability to attractbid for certain work and retain qualified employees.

        Our deliveryimpede our overall sales strategy. As we continue to expand and diversify our business operations, the likelihood that customers or potential customers will perceive conflicts of interest between our various subsidiaries, solutions, services, is labor-intensive. When we are awardedactivities and customer relationships may increase. Such conflicts, whether real or perceived, could result in a contract, we must quickly hire project leaders, case management staff and other personnel with the specific qualifications required by our contracts. Theloss of contracts or additional staff also creates a concurrent demand for increased administrative personnel. Our ability to maintain our productivity and profitability is limited by our ability to recruit, employ, train and retain the skilled personnel necessary to fulfill our contractual requirements. The success of recruitment and retention strategy depends on a number of factors, including the competitive demands for employees having the skills we need and the level of compensation required to hire and retain such employees. We cannot provide assuranceinternal structural barriers that delay operational efficiency, or may require that we will be abledivest ourselves of certain existing businesses or reorganize our current management and personnel structure, as well as our corporate organization and entity structure, in order to recruitqualify for new contract awards or to appropriately mitigate conflicts and otherwise accommodate the appropriate personnelneeds as a company that is expanding in complexity. Our failure to devote sufficient care, attention and resources to managing these adjustments may result in technical or administrative errors that could expose us to potential liability or adverse regulatory action. In addition, conflict of interest rules and standards change frequently, and are subject to varying interpretations and varying degrees and consistency of enforcement at the timeframe required to fulfill our contractual obligations,federal, state and municipal levels, and we willmay not be successful in maintaining the personnel necessary to efficiently operate and supportnavigating these restrictions. If we are prevented from expanding our business or ifare unable to effectively implement our recruitmentstrategic initiatives due to real or perceived conflicts of interest, our business, financial condition, results of operations and retention strategies are successful,cash flows could be materially adversely affected.

Risks Related to Our Common Stock

The market price of our labor costs will not increase significantly. Our inability to hire sufficient personnel on a timely basiscommon stock may be volatile, and without significantly increasingfluctuations in the price of our labor costs couldcommon stock may materially adversely affect our business, financial condition, results of operations and cash flows.

Our health insurance coverageflows and self-insurance reserves may not cover future claims.

        We maintain various insurance policies for employee health, workers' compensation, general liability and property damage. We are self-insured for our health plans, and have purchased a fully-insured stop loss policy to help offset our liability for both individual and aggregate claim costs. We are also responsible for losses up to a certain limit for workers' compensation, general liability and property damage insurance.

        For policies under which we are responsible for losses, we record a liability that represents our estimated cost of claims incurred and unpaid as of the balance sheet date. Our estimated liability is not discounted and is based on a number of assumptions and factors, including historical trends, actuarial assumptions and economic conditions, and is closely monitored and adjusted when warranted by changing circumstances. Our significant growth rate could affect the accuracy of estimates based on historical experience. Should a greater amount of claims occur compared to what was estimated or medical costs increase beyond what was expected, our accrued liabilities might not be sufficient and we may be required to record additional expense. Unanticipated changes may also produce materially different amounts of expense than reported under these programs, which could adversely affect our financial condition, results of operations and cash flows.

Risks Related to Our Common Stock
shareholders.

The market price of our common stock may be volatile.

The market price of our common stock has fluctuated widely and may continue to do so. During the 52-week period ended February 20, 2015,May 31, 2017, the closing price of our common stock on the NASDAQ Global Select market ranged from a high of $23.23$23.46 per share, to a low of $15.74$16.18 per share. We expect ourOur stock price to beis subject to fluctuationsfluctuation as a result of a variety of factors, including factors beyond our control. Some of these factors are:

•

actual or anticipated variations in our results of operations;

        Our management is responsible for establishing and maintaining adequate internal control over our financial reporting, as defined in Rule 13a-15(f) under the Exchange Act. If we identify and are unable to remediate material weaknesses or significant deficiencies in our internal control, our consolidated financial statements may contain material misstatements and we could be required to restate our financial results. If our financial statements are not accurate, investors may not have a complete understandingCertain provisions of our operations. Likewise, if our financial statements are not filed on a timely basis as required by the SECcertificate of incorporation and NASDAQ, webylaws could face severe consequences from those authorities. Either case may result in a material adverse effect on our business. Inferior internal controls could also cause investors to lose confidence in our reported financial information,discourage unsolicited takeover attempts, which could have a negative effect ondepress the tradingmarket price of our common stock.

Our certificate of incorporation authorizes the issuance of up to 5,000,000 shares of “blank check” preferred stock with such designations, rights and preferences as may be determined by our Board of Directors. Accordingly, our Board of Directors is empowered, without shareholder approval, to issue preferred stock with dividend, liquidation, conversion, voting or other rights, that could adversely affect the voting power or other rights of holders of our common stock. In the event of issuance, preferred stock could be utilized, under certain circumstances, as a method of discouraging, delaying, or preventing a change in control. Although we have no present intention to issue any shares of preferred stock, it is possible that we will do so in the future. In addition, our bylaws provide for a classified Board of Directors, require advance notice of shareholder proposals for business to be conducted at meetings of our shareholders and for nominations of candidates for election to our Board of Directors and provide for Delaware as an exclusive forum for certain disputes with our shareholders, all of which could also have the effect of discouraging a change of control.

Item 1B. Unresolved Staff Comments.
Comments

None.

Item 2. Properties.
Properties

 In June 2010,

As of December 31, 2016, we purchased the 223,000 square foot office building in Irving, Texas that serves as our corporate headquarters and as the primary center for our operational activities. In addition, in February 2014, we entered into a lease agreement for 63,922leased approximately 78,000 square feet of office space in Las Vegas, Nevada. As of December 31, 2014, we leased approximately 272,000 square feet of office space in 3021 other locations throughout the United States, the leases for which have expiration dates later in 2015 andstarting late 2017 through 2024. See Note 14—"Commitments12 - “Commitments and Contingencies"Contingencies” in our Notes to the Consolidated Financial Statements in Item 8. Consolidated Financial Statements and Supplementary Data for additional information aboutregarding our lease commitments. In general, we believe our facilities are suitable to meet our current and reasonably anticipated future needs.

Item 3. Legal Proceedings.
Proceedings

 From time to time, we may be subject to investigations, legal proceedings and other disputes arising

The information set forth under the caption “Litigation” in the ordinary course of our business, including but not limited to regulatory audits, billing and contractual disputes and employment-related matters.

        Our contractual relationships, including those with federal and state government entities, subject our operations, billing and business practices to scrutiny and audit, including by multiple agencies and levels of government, as well as to frequent transitions and changes in the personnel responsible for oversight of our contractual performance. From time to time, we may have contractual disputes with our customers arising from differing interpretations of contractual provisions that define our rights, obligations, scope of work or terms of payment, and with associated claims of liability for inaccurate or improper billing for reimbursement of contract fees, or for sanctions or damages for alleged performance deficiencies. Resolution of such disputes may involve litigation or may require that we accept some amount of loss or liability in order to avoid customer abrasion, negative marketplace perceptions and other disadvantageous results that could affect our business, financial condition, results of operations and cash flows.

Table of Contents

        Kern Health Systems:    In August 2011, in the Superior CourtNote 12 of the State of California, County of Los Angeles, Kern Health Systems ("KHS" or "Plaintiff") soughtNotes to recoverthe Consolidated Financial Statements included in excess of $7.0 million exclusive of interest, attorney feesPart II, Item 8. Consolidated Financial Statements and costs, against Allied Management Group Special Investigation Unit, Inc. ("AMG"), Dennis Demetre, and Lori Lewis (collectively, "Defendants"), jointly and severally, on causes of action for breach of contract, professional negligence, intentional misrepresentation, negligent misrepresentation and unfair business practices under the California Business and Professions Code. On June 9, 2014, the jury issued its verdict in favor of all Defendants, and against KHS, on all causes of action except negligent misrepresentation. On that cause of action, the jury issued a verdict against all Defendants, jointly and severally, in the sum of $1.38 million. The negligent misrepresentation verdict was based on representations to KHS allegedly madeSupplementary Data is incorporated herein by AMG and former owner Dennis Demetre in the spring of 2008, prior to our acquisition of AMG. We believe that the jury erroneously awarded damages based on an error inasmuch as the jury unanimously found that Defendants (through Demetre) made the negligent misrepresentation to KHS while having reasonable grounds for believing the representation to be true. Based on the jury's verdict, we believe we are properly characterized as the prevailing party on the breach of contract claim. AMG has filed an appeal of the verdict and is seeking to recover its attorney fees and costs in the sum of approximately $2.3 million. We have not recorded an obligation on this matter at this time, as we have appealed this decision and believe it is probable that we will prevail on the appeal of this matter, although there are risks and uncertainties related to any litigation, including appeals, and neither we nor our counsel can assure litigation results. Pending the appeal process, we were required to obtain a surety bond in the amount of 150% of the final judgment amount, or approximately $2.2 million, which was collateralized by a cash deposit and is reflected in Other current assets on our audited Consolidated Balance Sheet at December 31, 2014.reference.

        Dennis Demetre and Lori Lewis:    In July 2012, two of AMG's former owners, Dennis Demetre and Lori Lewis filed an action in the Supreme Court of the State of New York, claiming an undetermined amount of damages alleging that various actions unlawfully deprived Demetre and Lewis of the acquisition earn-out portion of the purchase price of AMG under the applicable Stock Purchase Agreement (the "SPA") and that we had breached certain contractual provisions under the SPA. Demetre and Lewis filed a second amended complaint with two causes of action for breach of contract. We filed a counter claim for breach of contract arising out of Demetre's and Lewis's failure to indemnify us for costs, including attorney fees arising out of our defense of the KHS action described above and for fraud arising out of Demetre's and Lewis's misrepresentations concerning capabilities of their software platform. We believe we have a meritorious defense and will continue to defend this matter vigorously, although there are risks and uncertainties related to any litigation.

        Restrictive Covenants and Trade Secret Actions in Texas and New York:    We are the plaintiff in lawsuits filed in August 2014, entitled HMS Holdings Corp., et al. v. Public Consulting Group, Inc., James Gambino, and Jason Ramos, in the District Court of Dallas County, Texas, Cause No. DC-14-09047 (the "Texas Action"), and HMS Holdings Corp., et al. v. Matthew Arendt, Sean Curtin, and Danielle Lange, in New York State Supreme Court, Albany County, Index No. A00754/2014 (the "New York Action"). These suits allege that, in violation of their respective contractual, statutory and common law obligations to us, defendant Public Consulting Group, Inc. and defendant former HMS employees Gambino, Ramos, Arendt, Curtin, and Lange, unlawfully misappropriated our confidential, proprietary and trade secret information, as well as our employee and customer relationships. The lawsuits seek damages and injunctive relief and assert causes of action including breach of contract, breach of fiduciary duty and misappropriation of trade secrets. At the Texas Court's direction, an agreed temporary restraining order was entered, under which, inter alia, the defendants are prohibited from using our confidential information, and must return any of our information. Both the Texas and New York matters are currently in the discovery phase.

Item 4. Mine Safety Disclosures.
Disclosures

Not applicable.

Table of Contents

PART II

Item 5. Market for Registrant'sRegistrant’s Common Equity, Related StockholderShareholder Matters and Issuer Purchases of Equity Securities.
Securities

Market Information

Our common stock is included in the NASDAQ Global Select Market, under the symbol HMSY. The table below summarizes the market closing high and low sales prices per share for our common stock for the periods indicated, as reported on the NASDAQ Global Select Market.