An independent contractor is generally distinguished from an employee by his or her degree of autonomy and independence in providing services. A high degree of autonomy and independence is generally indicative of a contractor relationship, while a high degree of control is generally indicative of an employment relationship. Although we believe that these physical therapists are properly characterized as independent contractors, tax or other regulatory authorities may in the future challenge our characterization of these relationships. If such regulatory authorities or state, federal, or foreign courts were to determine that these providers or experts are employees and not independent contractors, PPTG would be required to withhold income taxes, to withhold and pay social security, Medicare, and similar taxes and to pay unemployment and other related payroll taxes. PPTG would also be liable for unpaid past taxes and subject to penalties and could also potentially face claims for overtime or benefits. The costs of defending, settling, or resolving any claims relating to the independent contractor status of the physical therapists could be material. Further, any such reclassification could force us to restructure our relationship with PPTG, could force PPTG to modify its relationships with physical therapists, and could add complexity to our business model. As a result, any determination that these physical therapists are employees could have a material adverse effect on our business, financial condition, and results of operations.
Risks Relating to Cybersecurity, Information Systems, and Intellectual Property
Our information technology (“IT”) systems and those of our affiliated professional entities, or those used by our third-party service providers, vendors, business partners, or other contractors or consultants, may fail or suffer cybersecurity incidents, data breaches, and other disruptions, which could result in a material disruption of our systems or programs, compromise confidential information related to our business or of our customers or channel partners, including protected health information (“PHI”) and other sensitive or personal information of employees, covered individuals, and members, or prevent us from accessing critical information, potentially exposing us to liability or otherwise materially and adversely affecting our business, financial condition, results of operations, and prospects.
We collect and maintain information in digital form that is necessary to conduct our business, and we are increasingly dependent on IT systems and infrastructure to operate our business, including our member-facing mobile and web-based applications, any customer-facing aspects of our platform, and the systems we use for our own operations. In the ordinary course of our business, we collect, store, and transmit large amounts of confidential information, including intellectual property, proprietary business information, and personal information (including PHI) of our affiliated professional entities, customers, channel partners, members, employees (including with respect to our self-insured ERISA plans), consultants, contractors, third-party payers, business partners, and others. We have also outsourced elements of our IT systems and infrastructure, and as a result, a number of third-party service providers and vendors have access to our confidential information, the confidential information of customers and channel partners, and/or sensitive or personal information of covered individuals and members. We cannot conduct audits or formal evaluations of all aspects of all of our third-party service providers’ and vendors’ IT systems, and even where we do conduct audits or evaluations, we cannot be sure that our audits or evaluations will be comprehensive or that third-party service providers and vendors have sufficient measures in place to ensure the confidentiality, integrity, and availability of their IT systems and confidential information.
We face evolving cybersecurity risks that threaten the confidentiality, integrity, and availability of our IT systems and those of our affiliated professional entities, third-party service providers, vendors, business partners, and other contractors or consultants, and confidential information and data stored therein, including from diverse threat actors and attack vectors, including attack, damage, and interruption from computer viruses and malware (e.g., ransomware), natural disasters, terrorism, war, telecommunication, network, and electrical failures, hacking, cyberattacks, phishing attacks, and other social engineering schemes, malicious code, employee theft or misuse, human or technological error, fraud, denial or degradation of service attacks, sophisticated nation-state and nation-state-supported actors, or unauthorized access or use by persons inside our organization, or persons with access to systems inside our organization. These risks may be exacerbated in the remote work environment. Moreover, the risk of a cybersecurity incident, breach, or disruption, particularly through cyberattacks or cyber
42