What changed in Forian Inc.'s 10-K — 2023 vs 2024

Our Markets According to the Centers for Medicare & Medicaid Services, U.S. healthcare spending is roughly 17% of GDP and the market has been expanding and evolving rapidly over the past decade due to an aging population, innovations in treatments and a reimagining of service delivery.

The use of cannabis and alternative therapies for medical purposes is gaining momentum worldwide due to recent legalization and emerging research into therapeutic value and efficacy. Medical cannabis is used for the treatment of a growing array of diseases and chronic conditions, including but not limited to pain, inflammation, arthritis, anxiety, depression, epilepsy and Parkinson’s and Alzheimer’s diseases.

Life science companies’ understanding of the patient journey may be incomplete without extending the interaction of emerging therapeutics, including cannabis-based treatments into their research. Governments, manufacturers, cultivators and distributors as well as dispensaries need information on the safety and efficacy of cannabis in both medical and adult use settings.

As a result of our proprietary licensed data, we believe that we will be uniquely positioned to meet the needs of these markets as legalization and usage of alternate therapy’s expands.

Controls and Procedures,” we concluded that our disclosure controls and procedures were not effective as of December 31, 2023, and that we had, as of such date, material weaknesses in our internal control over financial reporting related to the lack of properly designed general information technology controls surrounding logical access, change management, and vendor application management.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim consolidated financial statements would not be prevented or detected on a timely basis. We intend to remediate these material weaknesses.

While we believe the steps we take to remediate these material weaknesses will improve the effectiveness of our internal control over financial reporting and will remediate the identified deficiencies, if our remediation efforts are insufficient to address the material weaknesses or we identify additional material weaknesses in our internal control over financial reporting in the future, our ability to analyze, record and report financial information accurately, to prepare our financial statements within the time periods specified by the rules and forms of the SEC and to otherwise comply with our reporting obligations under the federal securities laws may be adversely affected.

The occurrence of, or failure to remediate, these material weaknesses and any future material weaknesses in our internal control over financial reporting may adversely affect the accuracy and reliability of our financial statements and have other consequences that could materially and adversely affect our business, including an adverse impact on the market price of our common stock.

In addition, we could become subject to investigations by Nasdaq, the SEC or other regulatory authorities, which could require additional financial and management resources.

If our internal control over financial reporting or our disclosure controls and procedures are not effective, we may not be able to accurately report our financial results, prevent fraud or file our periodic reports in a timely manner, which may cause investors to lose confidence in our reported financial information and may lead to a decline in our stock price.

We rely on financial reporting and data analytics that must be accurate in order to make real-time management decisions, accurately manage our cash position, and maintain adequate inventory levels while conserving adequate cash to fund operations.

In the event of a systems failure, a process breakdown, the departure of key management or fraud, we would be unable to efficiently manage these items and may experience liquidity shortfalls that our cash position or revolving credit facility may not be able to accommodate.

In such a situation, we also may not be able to accurately report our financial results, prevent fraud or file our periodic reports in a timely manner, which may cause investors to lose confidence in our reported financial information and may lead to a decline in our stock price.

We may be unable to accurately forecast our operating results and growth rate, which may adversely affect our reported results and stock price. We may not be able to accurately forecast our operating results and growth rate.

We use a variety of factors in our forecasting and planning processes, including historical results, recent history and assessments of economic and market conditions. Our growth rates may not be sustainable, and our growth depends on the continued growth of demand for the products we offer.

Lower demand caused by changes in customer preferences, a weakening of the economy or other factors may result in decreased revenues or growth. Furthermore, many of our expenses and investments are fixed, and we may not be able to adjust our spending in a timely manner to compensate for any unexpected shortfall in our operating results.

Failure to accurately forecast our operating results and growth rate could cause our actual results to be materially lower than anticipated.

If our growth rate declines as a result, investors’ perceptions of our business may be adversely affected, and the market price of our common stock could decline. 15 Table of Contents Consolidation in the industries in which our customers operate may reduce the volume of services purchased by consolidated customers following an acquisition or merger, which could materially harm our operating results and financial condition.

Mergers or consolidations among our customers could in the future reduce the number of our customers and potential customers. When companies consolidate, overlapping services previously purchased separately are usually purchased only once by the combined entity, leading to loss of revenue.

Other services that were previously purchased by one of the merged or consolidated entities may be deemed unnecessary or cancelled. If our customers merge with or are acquired by other entities that are not our customers, or that use fewer of our services, they may discontinue or reduce their use of our services.

There can be no assurance as to the degree to which we may be able to address the revenue impact of such consolidation. Any of these developments could materially harm our operating results and financial condition.

Risks Related to Regulatory and Legal Matters Federal and state privacy and data protection laws are evolving and compliance with applicable requirements may increase our operating costs or adversely impact our ability to service our customers and market our products and services.

Federal and state laws and regulations regarding the collection, retention, security, use, disclosure and transfer of personal data (collectively, “Privacy Laws”) are changing, increasing in number and expanding in scope. Existing Privacy Laws include HIPAA, which regulates protected health information (“PHI”) created or received by or on behalf of health care providers, health plans, and other covered entities.

The recently enacted Washington My Health My Data Act gives Washington consumers rights with respect to consumer health data, which is defined expansively. In recent years, several states have adopted Privacy Laws that regulate the privacy and security of personal data much more broadly than U.S. laws have in the past.

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Colorado Privacy Act, the Virginia Consumer Data Protection Act and the Utah Consumer Privacy Act all went into effect in 2023.

Nine additional states ( i.e. , Delaware, Florida, Iowa, Indiana, Montana, New Jersey, Oregon, Tennessee and Texas) have passed comprehensive Privacy Laws that will go into effect from 2024 through 2026, and several additional states are considering similar laws.

It is possible that these Privacy Laws may be interpreted and applied in a manner that is inconsistent with our data practices. Establishing and maintaining compliance with these various Privacy Laws could cause us or the third parties that license us data to incur substantial costs or require changes in business practices that are adverse to our business.

The products and services we offer include the license of information products that contain data that have been de-identified in accordance with the requirements of applicable Privacy Laws, including HIPAA, and therefore are largely beyond the scope of current Privacy Laws.

However, we may receive personal data, including PHI, for purposes of de-identifying such information prior to integrating the de-identified data into the environment that informs our information products. These state Privacy Laws are very recent and thus far there has been little interpretation of these laws by regulators or courts.

Accordingly, there is uncertainty as to whether the de-identification requirements under the more recent Privacy Laws conform with the HIPAA de-identification standards. Compliance with state Privacy Laws could require additional investment and management attention and may subject us to significant liabilities if we or our data suppliers do not comply appropriately with new and potentially conflicting laws and regulations.

If there is a future change in Privacy Laws, we may also face limitations on our ability to use de-identified information that could harm our business.

There is also a risk that the third parties that license us data and de-identification software may fail to properly de-identify PHI under HIPAA or personal data under applicable state Privacy Laws, some of which may impose different standards for de-identification than those required by HIPAA. 16 Table of Contents The privacy, security and breach notification rules promulgated under HIPAA establish a set of national privacy and security standards for the protection of PHI by health plans, health care clearinghouses and certain health care providers, referred to as “covered entities,” and the third parties with which such covered entities contract for services, referred to as “business associates,” that engage in creating, receiving, maintaining or transmitting PHI.

While we generally do not consider our products and services to subject us to HIPAA, both because the healthcare data contained within our information products are de-identified to remove PHI before being ingested into our environments and because we do not constitute a covered entity, in certain scenarios, we may nevertheless be contractually obligated to comply with certain HIPAA obligations as a business associate of a covered entity, including the various requirements of the HIPAA de-identification rules.

Additionally, if PHI is inadvertently introduced into our environments without being properly de-identified, we may be directly liable for failing to meet the obligations of a business associate under HIPAA. The U.S. Department of Health and Human Services Office for Civil Rights may impose penalties for a failure to comply with applicable requirement of HIPAA.

Penalties will vary significantly depending on factors such as the date of the violation, whether the business associate knew or should have known of the failure to comply, or whether the business associate’s failure to comply was due to willful neglect. Mandatory penalties for HIPAA violations can be significant. A single breach incident can result in violations of multiple standards.

If a person knowingly or intentionally obtains or discloses PHI in violation of HIPAA requirements, criminal penalties may also be imposed.

We have implemented practices and procedures to facilitate our continued compliance with applicable Privacy Laws, which steps include engaging third parties to provide guidance with respect to the de-identification of the data that informs our information products and certification at least annually as to the privacy and security frameworks we have established ( e.g. , with respect to de-identification under HIPAA and system and organization controls).

In addition to our reliance on those third parties, we are dependent on the third parties that license us data to deliver information to us in a form and in a manner that complies with applicable Privacy Laws.

There is no assurance that the safeguards and controls employed by us or the third parties that license us data and de-identification software will be sufficient to prevent a breach of applicable Privacy Laws, or that claims will not be filed against us or these third parties despite such safeguards and controls.

Data suppliers might decide to modify or discontinue their services without adequate notice, which may cause additional expense in arranging new services and could harm our reputation, business, operating results and financial condition.

Many Privacy Laws protect more than health-related information, and although they vary by jurisdiction, these laws can extend to employee information, business information, healthcare provider information and other information relating to identifiable individuals.

Recently enacted comprehensive state Privacy Laws impose enhanced data privacy obligations for entities that fall within the scope of these laws and create individual privacy rights for residents, including the right to access and delete their personal information, the right to opt-out of certain sharing and sales of their personal information and the right to opt-in to the sharing of sensitive personal information, including information about health and race.

These regulations and legislative developments have potentially far-reaching consequences and may require us to modify our data management practices and to incur substantial expense in order to comply. Failure to comply with these laws may result in, among other things, civil and criminal liability, negative publicity, damage to our reputation and liability under contractual provisions.

These Privacy Laws may also increase our compliance costs and influence or limit the types of products and services that we can provide.

Our management works closely with their information technology and security counterparts to evaluate and address cybersecurity threats in alignment with our business objectives and operational needs. We also maintain an enterprise-wide information systems security program that applies to all employees.