Health Catalyst, Inc. - Annual Report: 2019 (Form 10-K)

---

---

•	Data Platform: integrate data in a flexible, open, and scalable platform to power healthcare’s digital transformation;

•	Analytics Applications: deliver insights on how to measurably improve through the use of analytics applications;

•	Services Expertise: enable data-informed improvement by providing analytical, clinical, financial, and operational experts; and

•	Engagement: attract, develop, and retain world-class team members by being a best place to work.

---

•	We are deeply committed to enabling our customers to achieve and sustain measurable clinical, financial, and operational improvements

•	We nurture deep, long-term customer partnerships because achieving and sustaining improvement is a transformational journey (not a quick trip)

---

•	We pragmatically balance the vision, priority, and pace of innovation for data and analytics technology. We prioritize innovations that accelerate improvement

•	We attract, develop, and retain experts who know best practices in their domain, leverage analytics for insight, and accelerate adoption for sustained improvement

•	We are accountable, as owners, to enable our customers’ measurable improvements

•	We make decisions that balance and optimize the interests of our teammates, customers, patients, and owners

•	We avoid an entitlement mentality and are good stewards of our assets

•	We don’t micro-manage and we encourage autonomy while also supporting scalable consistency

•	We recognize the immeasurable value of every individual

•	We listen carefully to one another and learn from each of our colleagues

•	We care deeply about our colleagues, including teammates, customers, patients, and owners

•	We benefit from one another’s diverse backgrounds and experiences

•	We courageously tell the truth and we face the truth

•	We are the same company, culture, and people in all settings

•	We treat confidential information appropriately, and we protect the private data of our customers’ patients

•	We recommend the best solutions for our customers, whether or not those solutions come from Health Catalyst

•	I can learn from anyone

•	I love to learn, and I am a lifelong student

•	I recognize my mistakes and correct them quickly; I fail fast

•	I am open to and respond favorably to feedback and coaching

•	I value my autonomy and use it to gain new knowledge and skills

•	I recognize that diversity of perspectives leads to better decisions

•	I am self-aware and seek improvement, personally and professionally

•	I watch, listen, and learn from others; thank them for their teachings; and apply the teachings to the mastery of my profession

---

•	I have a deep commitment to massive healthcare improvement

•	I stick to the task until the job is completed, then take on new work

•	I lead a balanced, healthy life that enables me to sustain my pace

•	I am willing to contribute more than my fair share to a project

•	I make personal sacrifices, as needed, to get the work done

•	I recognize that not every part of my job will be fun

•	I listen first

•	I assume positive intent

•	I ask for help when I need it

•	I serve others without looking for recognition

•	I am secure in my own abilities (quiet self-confidence)

•	I seek to improve myself before trying to improve others

•	I am excited when others succeed and I offer sincere praise

•	I often acknowledge others for their contributions to my success

•	I frequently express gratitude and appreciation to those around me

•	I strive to be the best in the world at what I do by continuously learning

•	I recognize the importance of excellence in pursuit of our mission

•	I am well informed about events and trends in healthcare, data, and analytics

•	I actively contribute to the company’s pursuit of excellence - in the data and analytics technology we build, in the domain expertise we provide, and in the functions that support this important work

•	Data platform. DOS is a healthcare-specific, cloud-based, open, flexible, and scalable data platform that provides customers a single comprehensive environment to integrate and organize data from their disparate software systems. It has been built with modern technology and is deeply embedded with healthcare domain knowledge, enabling a broad range of analytics.

---

•

Analytics applications. Our analytics applications build on top of our data platform and are designed to analyze the most common problems our customers face. These analytics applications allow our customers to pinpoint opportunities for measurable improvement across their entire enterprise and are employed by a broad range of users from healthcare executives to front-line clinicians providing care. We developed this suite of foundational and domain-specific software analytics applications over the last few years based on thoughtful measurement of the most critical analytics needs faced by our customers. The majority of our foundational and domain-specific software applications became generally available for deployment in 2018, with more to be released in the coming years. Our software analytics applications are further enhanced by a broad range of analytics accelerators, which are pre-built, configurable data models with customizable visualizations that can be tailored to specific customer needs.

•

Services expertise. Our world-class team consists of both analytics experts, such as data analysts, data engineers, and data scientists, and domain experts, such as healthcare administrators, physicians, and nurses. Our services are comprised of data & analytics services, domain expertise services, outsourcing services, and implementation services. Our services team members leverage our technology to help our customers shorten time-to-value and achieve sustainable measurable improvements. Examples of the services expertise we provide include opportunity analysis and prioritization, data governance, data modeling and analysis, quality and process improvement strategy, cost accounting, data abstraction, and population health strategies. Our approach to integrate data, analytics, and expertise into a holistic Solution is differentiated and has been recognized as among the best in the industry by multiple third parties, including KLAS, Chilmark Research, and Black Book. Our customers achieve sustainable measurable improvements through our Solution.

---

---

•

Grow our overall customer base. We have a substantial opportunity to continue growing our customer base through our active sales and marketing strategy and significant word-of-mouth references. We currently estimate our total core addressable market to include more than 1,200 healthcare organizations, including health systems and risk-bearing entities. We believe there is ample room to win new business and deepen market penetration in our core market. Further, healthcare providers outside of the United States face similar challenges to those in the United States and can implement our Solution to address them. We plan to opportunistically pursue international markets by expanding our business in the United Kingdom, Canada, and Southeast Asia.

•

Expand within our current customer base. We intend to deepen and expand the relationships we have with our existing customer base. Our relationship with a new customer oftentimes starts through the use of targeted analytics applications and services to pinpoint and achieve a single measurable clinical, financial, or operational improvement. As we deliver measurable improvements, trust builds, and our customers engage with us more broadly and purchase additional applications and services. We have achieved continued DOS Subscription customer growth in part due to strong customer retention and customer referrals. This is evidenced by our positive Dollar-based Retention Rates of 109%, 107%, and 108% for the years ended December 31, 2019, 2018, and 2017, respectively. This is also evidenced by a continued increase in documented improvements achieved by our customers over time. Recent customers have already started achieving measurable improvements, while customers who began working with us in 2017 and 2018 on average experienced approximately 6 improvements over the 12 months ended December 31, 2019, customers who began working with us in 2015 and 2016 on average experienced approximately 11 improvements over the 12 months ended December 31, 2019, and customers who began working with us before 2015 on average experienced approximately 25 improvements over the 12 months ended December 31, 2019. We will continue to invest in helping customers identify additional uses for our Solution, ensuring they achieve measurable improvements throughout our relationship with them.

•

Add new analytics applications and services offerings. The expansion of our Solution and enhancement of our applications library will accelerate as we deepen our customer relationships and add to our dataset. Because our platform is open and we partner with our customers, we are able to identify new opportunities for further improvements and leverage that insight with other customers across our core market to develop new analytics applications and services offerings. We have used this process to build eight new software applications over the past few years, and we will continue to invest in product development, particularly at the analytics applications layer of our technology stack.

•

Grow our addressable market through additional healthcare business segment adjacencies. We believe there are significant applications for our Solution outside of our core market, as evidenced by our recent expansion into the life sciences market. Other business segment adjacencies include serving the employer space and additional types of providers and risk-bearing entities. While we believe there are significant opportunities in our core market, these business segment agencies have the potential to significantly grow our addressable market and business.

•

Selectively pursue acquisitions and partnerships. We plan to continue identifying and evaluating opportunities where we can leverage our platform to scale and consolidate both data assets and best-of-breed applications. We believe that competing point solutions vendors will have difficulty in growing their offerings into sustainable businesses, which we believe translates into a robust mergers and acquisitions pipeline for us. We have a track record of identifying and integrating new and complementary capabilities, including our acquisitions of Healthcare Data Works, Medicity, and Able Health. Moreover, we believe the companies we partner with and acquire choose us because of our collaborative, best-in-class culture which we view as a differentiating factor in sourcing acquisitions and partnerships.

---

•	Data warehouse. We believe our innovative late-binding architecture has a proven track record of agility and adaptability to new rules, vocabularies, and data content. Our open and flexible platform enables database-level querying and custom analytics use-cases.

•	Source connectors. Our platform is designed to quickly ingest data from the numerous information systems and siloed data sources our customers possess. We have prebuilt connectors to the most common transactional software systems used by healthcare organizations. The DOS data management console enables customers to manage robust ETL processes and scheduling.

•	Cloud-based. Modern cloud-based architecture is secure and scalable. Being cloud-based enables quicker product iteration and innovation.

•	Reusable data logic. Registries, value sets, and other data logic sit on top of the raw data and can be accessed, reused, and updated through open APIs, enabling customer and third-party application development. We update hundreds of registries,

---

•	Machine learning. Embedded within DOS are machine learning algorithms that our customers can easily leverage for predictive analytics. Customers can also build their own machine learning data pipelines within DOS.

•	Terminology services. By standardizing the complex language used to code entries in various health records and clinical systems, DOS facilitates decision support, consistent reporting, and analytics and interoperability.

•	Closed-loop EHR integration. Bridges the gap between insight and action by reducing data lag, interjecting knowledge at the point of decision-making, including back into the workflow of source systems, such as an EHR.

•	Text processing. Enables the extraction of additional data currently trapped in various unstructured text blocks. The ability to gather insight from clinical notes remains an area of untapped healthcare intelligence with tremendous potential.

•	Real-time streaming and interoperability. Near or real-time data streaming from the source all the way to the expression of that data through DOS, supporting both transaction-level exchange of data and analytic processing.

•	Big data. Ability to access, organize, and analyze massive and unique, structured and unstructured, data sets allows us to drive differentiated analytic insights for our customers.

•

Registry and Measures Authoring (Population Builder). Enables non-SQL writers like clinicians and administrators to dynamically author, manage, view, and publish pre-built and custom population ruleset definitions using an elegant drag-and-drop interface. Rulesets can be published as a registry, leveraged across the DOS analytics platform and augmented with summary metrics using our tools. These registries can be used for internal quality improvement and research efforts or for reporting to external organizational registries.

•	Benchmarking (Touchstone). Uses artificial intelligence to proactively identify where a customer is performing relative to benchmark sets composed of proprietary and publicly-available data; subsequently recommends and prioritizes opportunities for improvement.

•

Dashboards and Reporting (Leading Wisely). Enables users to quickly and easily add clinical, financial, and operational measures in an executive dashboard format. Measures are trended over time and updated on a near real-time basis from DOS. Users can customize information, share it with others, and set their own alerts and notifications. As a result, executives and their teams are empowered to take control of the data deluge to plan, prioritize improvement projects, create alignment among groups, strategize the best products and services, and communicate decisions more effectively.

•	Activity-Based Costing (CORUS). Activity-based costing software application that leverages clinical and operational data from DOS to calculate a true cost of clinical processes and patients on the most granular level. Enables CFOs, physicians, service line leaders, and clinical and financial analysts to understand the true cost of providing care and relate those costs to patient outcomes.

•	Patient Safety (Patient Safety Monitor). Trigger-based surveillance system enabled by DOS. This application monitors patient-level data and applies machine learning algorithms to predict whether a patient is currently at risk for a safety event so that clinicians can intervene to prevent harm events.

---

•	Care Management. Patient-centric population health service that utilizes data integration, patient stratification and intake, care coordination, patient engagement, and performance measurement to optimize care delivery for high-risk patients.

•	Population Health Foundations. Product suite designed to help health systems manage risk-based contracts and bundled payment models and allow providers to tailor patient care based upon population metrics and benchmarks.

•

Quality and Regulatory Measures. Foundational product for integrating hundreds of measures across financial, regulatory, and quality departments and reporting those measures to third-party entities like CMS. Enables proactive measures surveillance to enhance outcomes and facilitates monitoring behaviors, interventions, and activities needed to influence, manage, or change outcomes. The acquisition of Able Health will further strengthen our existing Quality and Regulatory Measures capabilities.

•

To further enhance our analytics applications we have also developed a library of tailored analytics accelerators. Analytics accelerators are pre-built data models and customizable visualizations that leverage the broad set of integrated data stored within our DOS platform for a specific analytic use-case. Customers who utilize our analytics accelerators achieve a much faster time-to-value compared to building an analytic model from the ground up. Our customers frequently rely on our analytics expertise to customize our analytics accelerators, as well as our domain expertise in order to successfully leverage our analytics accelerators to drive data-informed improvement. The breadth of our analytics accelerators facilitates analytic insights across clinical, financial, and operational use-cases. Our suite of more than 30 analytics accelerators provides highly-specific clinical, financial, and operational insights. Examples of these accelerators include:

•	Clinical: Sepsis, Readmissions, Heart Failure, Joint Replacement, CLABSI, and COPD;

•	Financial: Payment Model Analyzer, Financial Management, Revenue Cycle, and Hierarchical Condition Categories; and

•	Operational: Supply Chain, Patient Flow, Surgical Services, Labor Management, and Practice Management.

•	Data Engineering Services: Help customers ingest data sources and provide consulting around DOS best practice and strategy around leveraging new DOS features.

•	Analytic Engineer Services: Partner with clients to generate meaningful insights produced from Health Catalyst technology that lead improvement efforts. Guides best practice and training.

•	Implementation Services: Implement and configure analytics applications.

•	Data Science Services: Work with client teams to apply scientific methods, processes, algorithms, and systems to ask and answer questions using data.  In addition, build software tools to enable self-service capabilities for customers.

•	Analytics Strategy Services: Provide agile development workshops, continued data architecture and Extract Transform Load support, documentation and training, measure reporting efficiency, and prioritization and staff augmentation.

•	Data Governance Services: Offer advisory services related to leveraging customers’ unique, strategic data assets, managing data access and security, and establishing cross-functional governance structures.

---

•	Quality and Process Improvement Strategy: Organizational readiness assessments and opportunity analysis. Clinical pathways, best practices, and protocol implementation. Lean methodology and clinical variation reduction recommendations.

•	Patient Safety Services: Transition from voluntary under-reporting to proactive prevention using data-driven triggers.

•	Cost Accounting Services: Expert analysis of fine-grain activity-based costing methods and cost-saving improvement opportunities.

•	Population Health and Value-Based Care Services: Organizational transformation services to enhance abilities to take on cost risk for patient populations.

•	Abstraction Data Submission Services: Support in collecting quality and regulatory information and submitting it to various associations.

•	Health Catalyst University - Educational Services: Hands-on courses, programs, and customizable training opportunities to provide our customers with knowledge, practical skills, and take-home tools needed to drive improvement efforts.

---

•	level of customer satisfaction;

•	ease of deployment and use of solutions and applications;

•	breadth and depth of solution and application functionality;

---

•	access to, and ability to glean insights from, large data sets;

•	brand awareness and reputation;

•	modern and adaptive technology platform;

•	capability for customization, configurability, integration, security, scalability, and reliability of applications;

•	total cost of ownership;

•	ability to innovate and respond to customer needs rapidly;

•	size of customer base and level of user adoption;

•	regulatory compliance verification and functionality;

•	domain expertise with respect to healthcare; and

•	ability to integrate with legacy enterprise infrastructures and third-party applications.

•	as to how we will use and disclose PHI;

•	that we will enter into similar agreements with our agents and subcontractors that have access to the information;

---

•	that we will report security incidents and other inappropriate uses or disclosures of PHI; and

•	that we will assist the covered entity with certain of its duties under the Privacy Rule.

•

The federal civil and criminal false claims laws and civil monetary penalties laws, such as the federal False Claims Act, impose criminal and civil penalties and authorizes civil whistleblower or qui tam actions, against individuals or entities for, among other things: knowingly presenting, or causing to be presented, to a federal government healthcare program, claims for payment that are false or fraudulent; making, using or causing to be made or used, a false statement or record material to payment of a false or fraudulent claim or obligation to pay or transmit money or property to the federal government; or knowingly concealing or knowingly and improperly avoiding or decreasing an obligation to pay money to the federal government. The government may deem entities to have “caused” the submission of false or fraudulent claims by, for example, providing inaccurate billing or coding information to our customers.

---

•

HIPAA also contains a provision that imposes criminal and civil liability for knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program (including private payors) or obtain, by means of false or fraudulent pretenses, representations, or promises, any of the money or property owned by, or under the custody or control of, any healthcare benefit program, regardless of the payor (e.g., public or private) and knowingly and willfully falsifying, concealing or covering up by any trick or device a material fact or making any materially false statements in connection with the delivery of, or payment for, healthcare benefits, items, or services. Similar to the federal Anti-Kickback Statute, a person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation. Similarly, the federal false statements statute prohibits knowingly and willfully falsifying, concealing, or covering up a material fact or making any materially false statement in connection with the delivery of or payment for healthcare benefits, items, or services.

---

•	registration and device listing with FDA;

•	the Quality System Regulation (QSR), which requires manufacturers, including third-party or contract manufacturers, to follow stringent design, testing, control, documentation, and other quality assurance procedures during all aspects of manufacturing;

•	labeling regulations and FDA prohibitions against the advertising and promotion of products for uncleared, unapproved off-label uses and other requirements related to advertising and promotional activities;

•	medical device reporting regulations, which require that manufacturers report to the FDA if their device may have caused or contributed to a death or serious injury or malfunctioned in a way that would likely cause or contribute to a death or serious injury if the malfunction were to recur;

•	corrections and removal reporting regulations, which require that manufacturers report to the FDA field corrections and product recalls or removals if undertaken to reduce a risk to health posed by the device or to remedy a violation of the FDCA that may present a risk to health; and

•	post-market surveillance regulations, which apply when necessary to protect the public health or to provide additional safety and effectiveness data for the device.

---

---

---

---

---

---

•	the extent to which our Solution achieves or maintains market acceptance;

•	our ability to introduce new applications, updates, and enhancements to our existing applications on a timely basis;

•	new competitors and the introduction of enhanced products and services from new or existing competitors;

•	the length of our contracting and implementation cycles and our fulfillment periods for our Solution;

•	the mix of revenue generated from professional services as compared to technology subscriptions;

•	the financial condition of our current and future customers;

•	changes in customer budgets and procurement policies;

•	changes in regulations or marketing strategies;

•	the amount and timing of our investment in research and development activities;

•	the amount and timing of our investment in sales and marketing activities;

•	technical difficulties or interruptions to our DOS platform or analytics applications;

•	our ability to hire and retain qualified personnel;

•	changes in the regulatory environment related to healthcare;

•	regulatory compliance costs;

•	the timing, size, and integration success of potential future acquisitions;

•	unforeseen legal expenses, including litigation and settlement costs; and

•	buying patterns of our customers and the related seasonality impacts on our business.

---

---

---

•	damage from fire, power loss, and other natural disasters;

•	communications failures;

•	software and hardware errors, failures, and crashes;

•	security breaches, computer viruses, ransomware, and similar disruptive problems; and

•	other potential interruptions.

---

---

---

---

---

•	inability to integrate or benefit from acquired technologies or services in a profitable manner;

•	unanticipated costs or liabilities associated with the acquisition;

•	difficulty integrating the accounting systems, operations, and personnel of the acquired business;

•	difficulties and additional expenses associated with supporting legacy products and hosting infrastructure of the acquired business;

•	difficulty converting the customers of the acquired business onto our platform and contract terms, including disparities in the revenue, licensing, support, or professional services model of the acquired company;

---

•	diversion of management’s attention from other business concerns;

•	adverse effects on our existing business relationships with business partners and customers as a result of the acquisition;

•	the potential loss of key employees;

•	use of resources that are needed in other parts of our business; and

•	use of substantial portions of our available cash to consummate the acquisition.

---

---

---

---

---

•

False Claims Laws. There are numerous federal and state laws that prohibit submission of false information, or the failure to disclose information, in connection with submission and payment of physician claims for reimbursement. For example, the federal civil False Claims Act prohibits, among other things, individuals or entities from knowingly presenting, or causing to be presented, to the U.S. federal government, claims for payment or approval that are false or fraudulent, or knowingly making, using or causing to be made or used, a false record or statement material to a false or fraudulent claim. In addition, the government may assert that a claim including items and services resulting from a violation of the U.S. federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the civil False Claims Act. If our advisory services to customers are associated with action by customers that is determined or alleged to be in violation of these laws and regulations, it is possible that an enforcement agency would also try to hold us accountable. Any determination by a court or regulatory agency that we have violated these laws could subject us to significant civil or criminal penalties, invalidate all or portions of some of our customer contracts, require us to change or terminate some portions of our business, require us to refund portions of our services fees, subject us to additional reporting requirements and oversight under a corporate integrity agreement or similar agreement to resolve allegations of noncompliance with these laws, cause us to be disqualified from serving customers doing business with government payors, and have an adverse effect on our business. Our customers’ failure to comply with these laws and regulations in connection with our services could result in substantial liability (including, but not limited to, criminal liability), adversely affect demand for our Solution, and force us to expend significant capital, research and development, and other resources to address the failure.

•

Health Data Privacy Laws. There are numerous federal and state laws related to health information privacy. In particular, the federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH) and their implementing regulations, which we collectively refer to as HIPAA, include privacy standards that protect individual privacy by limiting the uses and disclosures of PHI and implementing data security standards that require covered entities to implement administrative, physical, and technological safeguards to ensure the confidentiality, integrity, availability, and security of PHI in electronic form. HIPAA also specifies formats that must be used in certain electronic transactions, such as admission and discharge messages. By processing and maintaining PHI on behalf of our covered entity customers, we are a HIPAA business associate and mandated by HIPAA to enter into written agreements with our covered entity clients – known as BAAs – that require us to safeguard PHI. BAAs typically include:

•	a description of our permitted uses of PHI;

•	a covenant not to disclose that information except as permitted under the BAA and to require that our subcontractors, if any, are subject to the substantially similar restrictions;

•	assurances that reasonable and appropriate administrative, physical, and technical safeguards are in place to prevent misuse of PHI;

•	an obligation to report to our customer any use or disclosure of PHI other than as provided for in the BAA;

•	a prohibition against our use or disclosure of PHI if a similar use or disclosure by our customer would violate the HIPAA standards;

•	the ability of our customers to terminate the underlying support agreement if we breach a material term of the BAA and are unable to cure the breach;

•	the requirement to return or destroy all PHI at the end of our services agreement; and

•	access by the Department of Health and Human Services (HHS) to our internal practices, books, and records to validate that we are safeguarding PHI.

---

•

Anti-Kickback and Anti-Bribery Laws. There are federal and state laws that prohibit payment for patient referrals, patient brokering, remuneration of patients, or billing based on referrals between individuals or entities that have various financial, ownership, or other business relationships with healthcare providers. In particular, the federal Anti-Kickback Statute prohibits offering, paying, soliciting, or receiving anything of value, directly or indirectly, for the referral of patients covered by Medicare, Medicaid, and other federal healthcare programs or the leasing, purchasing, ordering, or arranging for or recommending the lease, purchase, or order of any item, good, facility, or service covered by these programs. A person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation. Some enforcement activities focus on below or above market payments for federally reimbursable health care items or services as evidence of the intent to provide a kickback. Many states also have similar anti-kickback laws that are not necessarily limited to items or services for which payment is made by a federal healthcare program. In addition, the federal anti-referral law—the Stark Law—is very complex in its application, and prohibits physicians (and certain other healthcare professionals) from making a referral for a designated health service to a provider in which the referring healthcare professional (or spouse or any immediate family member) has a financial or ownership interest, unless an enumerated exception applies. The Stark Law also prohibits the billing for services rendered resulting from an impermissible referral. Many states also have similar anti-referral laws that are not necessarily limited to items or services for which payment is made by a federal healthcare program and may include patient disclosure requirements. Moreover, both federal and state laws prohibit bribery and similar behavior. Any determination by a state or federal regulatory agency that we or any of our customers, vendors, or partners violate or have violated any of these laws could subject us to significant civil or criminal penalties, require us to change or terminate some portions of our business, require us to refund portions of our services fees, subject us to additional reporting requirements and oversight under a corporate integrity agreement or similar agreement to resolve allegations of noncompliance with these laws, cause us to be disqualified from serving customers doing business with government payors, and have an adverse effect on our business. Even an unsuccessful challenge by regulatory authorities of our activities could result in adverse publicity and could require a costly response from us.

•

Corporate Practice of Medicine Laws and Fee-Splitting Laws. Many states have laws prohibiting physicians from practicing medicine in partnership with non-physicians, such as business corporations. In some states, including New York, these take the form of laws or regulations prohibiting splitting of physician fees with non-physicians or others. Any determination by a state court or regulatory agency that our service contracts with our clients violate these laws could subject us to civil or criminal penalties, invalidate all or portions of some of those contracts, require us to change or

---

•

Medical professional regulation. The practice of most healthcare professions requires licensing under applicable state law. In addition, the laws in some states prohibit business entities from practicing medicine. We employ and contract with physicians who assist our customers with the customers’ care coordination, care management, population health management, and patient safety activities. We do not intend to provide medical care, treatment, or advice. However, any determination that we are acting in the capacity of a healthcare provider and acted improperly as a healthcare provider may result in additional compliance requirements, expense, and liability to us, and require us to change or terminate some portions of our business.

•

Medical Device Laws. The FDA may regulate medical or health-related software, including machine learning functionality and predictive algorithms, if such software falls within the definition of a “device” under the federal Food, Drug, and Cosmetic Act (FDCA). However, the FDA exercises enforcement discretion for certain low-risk software, as described in its guidance documents for Mobile Medical Applications, General Wellness: Policy for Low Risk Devices, and Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices. In addition, in December of 2016, President Obama signed into law the 21st Century Cures Act, which included exemptions for certain medical-related software, including software used for administrative support functions at a healthcare facility, software intended for maintaining or encouraging a healthy lifestyle, EHR software, software for transferring, storing, or displaying medical device data or in vitro diagnostic data, and certain clinical decision support software. The FDA has also issued draft guidance documents to clarify how it intends to interpret and apply the new exemptions under the 21st Century Cures Act. Although we believe that our software products are currently not subject to active FDA regulation, we continue to follow the FDA’s developments in this area. There is a risk that the FDA could disagree with our determination or that the FDA could develop new final guidance documents that would subject our Solution to active FDA oversight. If the FDA determines that any of our current or future analytics applications are regulated as medical devices, we would become subject to various requirements under the FDCA and the FDA’s implementing regulations. Depending on the functionality and FDA classification of our analytics applications, we may be required to:

•	register and list our analytics applications with the FDA;

•	notify the FDA and demonstrate substantial equivalence to other products on the market before marketing our analytics applications;

•	submit a de novo request to the FDA to down-classify our analytics applications prior to marketing; or

•	obtain FDA approval by demonstrating safety and effectiveness before marketing our analytics applications.

---

---

•

Antitrust Laws. Our national cloud-based network allows us access to cost and pricing data for a large number of providers in most regional markets, as well as to the contracted rates for third-party payors. To the extent that our Solution enables providers to compare their cost and pricing data with those of their competitors, those providers could collude to increase the pricing for their services, to reduce the compensation they pay their employees, or to collectively negotiate agreements with third parties. Similarly, if payors are able to compare their contracted rates of payment to providers, those payors may seek to reduce the amounts they might otherwise pay. Such actions may be deemed to be anti-competitive and a violation of federal antitrust laws. To the extent that we are deemed to have enabled such activities, we could be subject to fines and penalties imposed by the U.S. Department of Justice or the FTC and be required to curtail or terminate the services that permitted such collusion.

•

Consumer Protection Regulation. Federal and state government bodies and agencies have adopted or are considering adopting laws and regulations regarding the collection, use, and dissemination of data, and the presentation of website or other electronic content, which may require compliance with certain standards for notice, choice, security, and access. California adopted the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020. The CCPA has been characterized as the first “GDPR-like” privacy statute to be enacted in the United States because it mirrors a number of the key provisions of the GDPR (discussed below). The CCPA establishes a new privacy framework for covered businesses by creating an expanded definition of personal information, establishing new data privacy rights for consumers in the state of California, imposing special rules on the collection of consumer data from minors, and creating a new and potentially severe statutory damages framework for violations of the CCPA and for businesses that fail to implement reasonable security procedures and practices to prevent data breaches. If we fail to comply with any of these privacy laws that apply to us, and are subject to the aforementioned penalties, our business and financial results could be adversely affected.

•

Foreign Corrupt Practices Act (FCPA) and Foreign Anti-Bribery Laws. The FCPA makes it illegal for U.S. persons, including U.S. companies, and their subsidiaries, directors, officers, employees, and agents, to promise, authorize or make any corrupt payment, or otherwise provide anything of value, directly or indirectly, to any foreign official, any foreign political party or party official, or candidate for foreign political office to obtain or retain business. Violations of the FCPA can also result in violations of other U.S. laws, including anti-money laundering, mail and wire fraud, and conspiracy laws. There are severe penalties for violating the FCPA. In addition, the Company may also be subject to other non-U.S. anti-corruption or anti-bribery laws, such as the U.K. Bribery Act 2010. If our employees, contractors, vendors, or partners fail to comply with the FCPA and/or foreign anti-bribery laws, we may be subject to penalties or sanctions, and our ability to develop new prospects and retain existing customers could be adversely affected.

•

Economic Sanctions and Export Controls. Economic and trade sanctions programs that are administered by the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) prohibit or restrict transactions to or from, and dealings with specified countries and territories, their governments, and in certain circumstances, with individuals and entities that are specially designated nationals of those countries, and other sanctioned persons, including narcotics traffickers and terrorists or terrorist organizations. As federal, state and foreign legislative regulatory scrutiny and enforcement actions in these areas increase, we expect our costs to comply with these requirements will increase as well. Failure to comply with any of these requirements could result in the limitation, suspension or termination of our services, imposition of significant civil and criminal penalties, including fines, and/or the seizure and/or forfeiture of our assets. Further, our Solution incorporates encryption technology. This encryption technology may be exported from the United States only with the required export authorizations, including by a license, a license exception or other appropriate government authorizations. Such solutions may also be subject to certain regulatory reporting requirements. Various countries also regulate the import of certain encryption technology, including through import permitting and licensing requirements, and have enacted laws that could limit our customers’ ability to import our Solution into those countries. Governmental regulation of encryption technology and of exports and imports of encryption products, or our failure to obtain required approval for our Solution, when applicable, could harm our international sales and adversely affect our revenue. Compliance with applicable regulatory requirements regarding the provision of our Solution, including with respect to new applications, may delay the introduction of our Solution in various markets or, in some cases, prevent the provision of our Solution to some countries altogether.

•

GDPR and Foreign Data Privacy Protection Laws - In addition, several foreign governments have regulations dealing with the collection and use of personal information obtained from their residents. For example, in the European Union, (EU), the General Data Protection Regulation (GDPR) went into effect on May 25, 2018. If we or our vendors fail to comply with the applicable EU privacy laws, we could be subject to government enforcement actions and significant penalties against us. GDPR introduced new data protection requirements in the EU relating to the consent of the individuals to whom the personal data relates, the information provided to the individuals, the documentation we must retain, the security and confidentiality of the personal data, data breach notification and the use of third-party processors in connection

---

•

Regulatory Certification. We must obtain certification from governmental agencies, such as the Agency for Healthcare Research and Quality (AHRQ) to sell certain of our analytics applications and services in the United States. We cannot be certain that our Solution will continue to meet these standards. The failure to comply with these certification requirements could result in the loss of certification, which could restrict our Solution offerings and cause us to lose customers.

---

•	overall performance of the equity markets and/or publicly-listed technology companies;

•	actual or anticipated fluctuations in our net revenue or other operating metrics;

•	changes in the financial projections we provide to the public or our failure to meet these projections;

•	failure of securities analysts to initiate or maintain coverage of us, changes in financial estimates by any securities analysts who follow our company, or our failure to meet the estimates or the expectations of investors;

•	the economy as a whole and market conditions in our industry;

•	rumors and market speculation involving us or other companies in our industry;

•	announcements by us or our competitors of significant innovations, acquisitions, strategic partnerships, joint ventures, or capital commitments;

---

•	new laws or regulations or new interpretations of existing laws or regulations applicable to our business;

•	lawsuits threatened or filed against us;

•	recruitment or departure of key personnel;

•	other events or factors, including those resulting from war, incidents of terrorism, or responses to these events; and

•	the expiration of contractual lock-up or market standoff agreements.

•	not being required to have our independent registered public accounting firm attest to our internal control over financial reporting under Section 404 of the Sarbanes Oxley Act;

•	reduced disclosure obligations regarding executive compensation in our periodic reports and annual report on Form 10-K; and

•	exemptions from the requirements of holding a non-binding advisory vote on executive compensation and stockholder approval of any golden parachute payments not previously approved.

•	the last day of the fiscal year in which we have more than $1.07 billion in annual revenue;

•	the date we qualify as a “large accelerated filer,” with at least $700 million of equity securities held by non-affiliates;

•	the date on which we have issued, in any three-year period, more than $1.0 billion in non-convertible debt securities; or

•	the last day of the fiscal year ending after the fifth anniversary of the completion of this offering.

---

---

•	provide that our board of directors is classified into three classes of directors with staggered three-year terms;

•	permit the board of directors to establish the number of directors and fill any vacancies and newly-created directorships;

•	require super-majority voting to amend some provisions in our amended and restated certificate of incorporation and amended and restated bylaws;

•	authorize the issuance of “blank check” preferred stock that our board of directors could use to implement a stockholder rights plan;

•	provide that only a majority of our board of directors will be authorized to call a special meeting of stockholders;

---

•	prohibit stockholder action by written consent, which requires all stockholder actions to be taken at a meeting of our stockholders;

•	provide that the board of directors is expressly authorized to make, alter, or repeal our bylaws; and

•	advance notice requirements for nominations for election to our board of directors or for proposing matters that can be acted upon by stockholders at annual stockholder meetings.

•	any derivative action or proceeding brought on our behalf;

•	any action asserting a breach of fiduciary duty;

•	any action asserting a claim against us arising pursuant to the Delaware General Corporation Law, our amended and restated certificate of incorporation, or our amended and restated bylaws; or

•	any action asserting a claim against us that is governed by the internal affairs doctrine.

---

---

(1)	Base period

---

(1)	Includes stock-based compensation expense, as follows:

---

---

(1)	Working capital is calculated as current assets less current liabilities, excluding current deferred revenue. See our consolidated financial statements and the related notes included elsewhere in this Annual Report on Form 10-K for further details regarding our current assets, current liabilities, and deferred revenue.

(1)	These measures are not calculated in accordance with GAAP. See “Reconciliation of Non-GAAP Financial Measures” for more information about these financial measures, including the limitations of such measures and a reconciliation of each measure to the most directly comparable measure calculated in accordance with GAAP.

(1)	See “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Other Key Metrics” for more information about this metric.

(1)	See “Management’s Discussion and Analysis of Financial Condition and Results of Operations - Other Key Metrics” for more information about this metric.

---

(1)	Tender offer payments deemed compensation relate to employee compensation from repurchases of common stock at a price in excess of its estimated fair value. For additional details refer to Note 12 in the consolidated financial statements.

(2)	Post-acquisition restructuring costs related to severance charges following the acquisition of Medicity.

---

(1)	Tender offer payments deemed compensation relate to employee compensation from repurchases of common stock at a price in excess of its estimated fair value. For additional details refer to Note 12 in the consolidated financial statements.

(2)	Post-acquisition restructuring costs relate to severance charges following the acquisition of Medicity.

---

---

---

•

Add new customers. We believe that our ability to increase our customer base will enable us to drive growth. Our potential customer base is generally in the early stages of data and analytics adoption and maturity. We expect to further penetrate the market over time as potential customers invest in commercial data and analytics solutions. As one of the first data platform and analytics vendors focused specifically on healthcare organizations, we have an early-mover advantage and strong brand awareness. Our customers are large, complex organizations who typically have long procurement cycles which may lead to declines in the pace of our new customer additions.

•

Leverage recent product and services offerings to drive expansion. We believe that our ability to expand within our customer base will enable us to drive growth. Over the last few years, we have developed and deployed several new analytics applications including CORUS, Touchstone, Patient Safety Monitor, Population Builder, and others. Because we are in the early stages of certain of our applications’ lifecycles and maturity, we do not have enough information to know the impact on revenue growth by upselling these applications and associated services to current and new customers.

•

Impact of Medicity acquisition on growth. Our customer base includes over 50 health systems and regional healthcare information exchanges added in the Medicity acquisition, representing an opportunity for us to cross-sell our Solution to Medicity customers. We are in the early phases of that cross-selling initiative and do not have full visibility into the incremental growth opportunities from that effort. Historically, Medicity customers have generated a lower Dollar-based Retention Rate than DOS Subscription Customers and we expect flat to declining revenue from Medicity customers in the foreseeable future. If our cross-sell efforts and technology integration strategies are successful, this could offset revenue declines from Medicity customers. Overall, the impact of the Medicity acquisition could negatively impact our revenue growth rates over time.

---

•

Changing revenue mix. Our technology and professional services offerings have materially different gross margin profiles. While our professional services help our customers achieve measurable improvements and make them stickier, they have lower gross margins than technology revenue. In 2019, our technology revenue and professional services revenue represented 54% and 46% of total revenue, respectively. Changes in our revenue mix between the two offerings would impact future Total Adjusted Gross Margin. Furthermore, changes within the types of professional services we offer over time can have a material impact on our Adjusted Professional Services Gross Margin, impacting our future Total Adjusted Gross Margin. See “Selected Consolidated Financial and Other Data—Reconciliation of Non-GAAP Financial Measures” for more information.

•

Transitions to Microsoft Azure as DOS hosting provider. We incur hosting fees related to providing DOS through a cloud-based environment hosted by Microsoft Azure. We also operate a private data center where we host DOS for certain customers and we maintain a small number of customers that have deployed DOS on-premise. We are in the process of transitioning customers we host in our private data center and who deployed DOS on-premise to Azure-hosted environments. The Azure cloud provides customers with more advanced DOS product functionality and a more seamless customer experience; however, hosting customers in Azure is more costly than our private data center and on-premise deployments on a per-customer basis. This transition will result in higher cost of technology revenue and provide a headwind against increases in Adjusted Technology Gross Margin.

•

Refinement of pricing for our Solution. In the past, we have adjusted our prices as a result of offering new applications and services and customer demand. In the fourth quarter of 2018, we began to introduce new pricing for our Solution for new customers to account for the addition of new analytics applications and associated services. We expect to realize fully the effect of this pricing adjustment in future years as new customers renew their technology and services subscription contracts. Because these price adjustments were primarily related to new applications and services added to our Solution, our prior experience pricing these offerings is limited. As we gain more experience marketing and delivering these new analytics applications and associated services, we may need to further refine our pricing, which could result in either increases or decreases to the price of our Solution. During the years ended December 31, 2019 and 2018, there were no material revenue increases from the pricing adjustments made in 2018 as the increase in technology revenue from current customers is primarily attributable to contractual, annual escalators as opposed to pricing changes.

---

---

---

(1)	Includes stock-based compensation expense, as follows:

---

---

---

---

(1)	Not meaningful.

(1)	Not meaningful.

---

---

(1)	Includes stock-based compensation expense, as follows:

---

---

---

---

---

(1)	On February 6, 2019, we borrowed $50.0 million under the OrbiMed Debt Agreement, and simultaneously repaid our $20.0 million term loan from SVB in full. We also repaid in full our $1.3 million SVB revolving line of credit. The contractual commitment amounts above include interest payments of $18.5 million and a 5% exit fee.

(2)	We lease our facilities under long-term operating leases, which expire at various dates through 2024.

•	Identification of the contract, or contracts, with a customer;

•	Identification of the performance obligations in the contract;

•	Determination of the transaction price;

•	Allocation of the transaction price to the performance obligations in the contract; and

•	Recognition of revenue when, or as, we satisfy the performance obligation.

---

---

•

Expected volatility.    Since a public market for our common stock did not exist prior to our IPO and, therefore, we did not have a sufficient trading history of our common stock, we estimated the expected volatility based on the volatility of similar publicly-held entities (guideline companies) over a period equivalent to the expected term of the pre-IPO awards. In evaluating the similarity of guideline companies to us, we considered factors such as industry, stage of life cycle, size, and financial leverage. We intend to primarily use the volatility history of the share price of our common stock as it becomes available.

•

Expected term.    We estimate the expected term using the simplified method, as we do not have sufficient historical exercise activity to develop reasonable expectations about future exercise patterns and post-vesting employment termination behavior. The simplified method calculates the average period the stock options are expected to remain outstanding as the midpoint between the vesting date and the contractual expiration date of the award.

•	Risk-free interest rate.    The risk-free interest rate is based on the U.S. Treasury yield curve in effect at the time of grant for maturities corresponding with the expected term of the award.

•	Expected dividend yield.    We have never declared or paid any dividends and do not presently plan to pay dividends in the foreseeable future. Consequently, we use an expected dividend yield of zero.

---

---

---

---

---

(1)	Includes amounts attributable to related party transactions. See Note 18 for further details.

---

---

---

---

---

•	Identification of the contract, or contracts, with a customer;

•	Identification of the performance obligations in the contract;

•	Determination of the transaction price;

•	Allocation of the transaction price to the performance obligations in the contract; and

•	Recognition of revenue when, or as, we satisfy the performance obligation.

---

---

---

---

---

•	Level 1- Quoted prices in active markets for identical assets or liabilities.

•	Level 2- Observable inputs other than quoted prices in active markets for identical assets and liabilities, quoted prices for identical or similar assets or liabilities in inactive markets, or other inputs that are observable or can be corroborated by observable market data for substantially the full term of the assets or liabilities.

•	Level 3- Inputs that are generally unobservable and typically reflect management’s estimate of assumptions that market participants would use in pricing the asset or liability.

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

•	Technology - Our technology segment (Technology) includes our data platform, analytics applications and support services. Technology generates revenues primarily from contracts that are cloud-based subscription arrangements, time-based license arrangements, and maintenance and support fees; and

•	Professional Services - Our professional services segment (Professional Services) is generally the combination of analytics, implementation, strategic advisory, outsource, and improvement services to deliver expertise to our customers to more fully configure and utilize the benefits of our Technology offerings.

---

(1)	Tender offer payments deemed compensation included in the Adjusted Gross Profit reconciliation above relate to employee compensation from repurchases of common stock at a price in excess of its estimated fair value. For additional details refer to Note 12 in the consolidated financial statements.

(2)	Post-acquisition restructuring costs included in the Adjusted Gross Profit reconciliation above relate to severance charges following the acquisition of Medicity.

---

---

---

---

---

---

#	Indicates management contract or compensatory plan.

^

The certifications attached as Exhibit 32.1 accompanying this Annual Report on Form 10-K, are deemed furnished and not filed with the Securities and Exchange Commission and are not to be incorporated by reference into any filing of Health Catalyst, Inc. under the Securities Act of 1933, as amended, or the Securities Exchange Act of 1934, as amended, whether made before or after the date of this Annual Report on Form 10-K, irrespective of any general incorporation language contained in such filing.

---