Company: EVCM
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001853145-25-000009
Chunk: 78

Company: EverCommerce Inc.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1A
Chunk 78
---
 fines and penalties, including civil, criminal and administrative penalties, damages, exclusion from Medicare, Medicaid or other government-funded healthcare programs, integrity oversight and reporting obligations to resolve allegations of non-compliance, disgorgement, imprisonment, contractual damages, reputational harm, diminished profits and the curtailment or restructuring of our operations. Any investigation or proceeding related to these laws, even if unwarranted or without merit, may have a material adverse effect on our business, results of operations and financial condition.

Security and Privacy of Health-Related Information. Federal, state and local laws regulate the privacy and security of health-related information and the circumstances under which such health-related information may be used, disclosed, transmitted and maintained. For example, HIPAA regulations require the use of uniform electronic data transmission standards and code sets for certain health care claims and payment transactions submitted or received electronically. The privacy and security regulations promulgated under HIPAA regulate the use and disclosure of individually identifiable health information, and impose privacy and security requirements on covered entities and their business associates. HIPAA requires covered entities and business associates to develop and maintain policies with respect to the protection of, use and disclosure of PHI, including the adoption of administrative, physical and technical safeguards to protect electronic PHI and certain notification requirements in the event of a data breach. The Company’s operations could be negatively impacted by a violation of the HIPAA privacy, security or breach notification rules. Additionally, if the Company or any of its downstream / subcontractor business associates fails to comply with HIPAA or contractual requirements, or create or are otherwise involved in a HIPAA data breach, the Company may face significant fines and penalties, ongoing compliance requirements, reputational harm, contractual reimbursement, recoupment or other obligations and private litigation brought by impacted individuals.

Promoting Interoperability Programs and Health IT Certification. We are subject to laws and regulations governing our use of health record technology. While a combination of our solutions has been certified as meeting standards for certified electronic health record technology, the regulatory standards to achieve certification will continue to evolve over time. We may incur increased development 

I-35

costs and delays in delivering solutions if we need to upgrade our software or healthcare devices to be in compliance with these varying and evolving standards. In addition, further delays in interpreting these standards may result in postponement or cancellation of our clients’ decisions to purchase our software solutions. If our software solutions are not compliant with these evolving standards, our relationships with current customers, market position and sales could be impaired and we may have to invest significantly