What dominates the section
- Healthcare regulation, privacy, cybersecurity, and technology-integration failures dominate Phreesia’s risk disclosures.
The risks most specific to Phreesia
- Risks relating to our business and industry
Privacy concerns, cyber-attacks, data breaches or cybersecurity incidents relating to our SaaS-based solutions could result in economic loss, damage to our reputation, deterring users from using our products, and exposure to legal penalties and liability
Cyberattacks or breaches could expose patients’ payment data and protected health information, causing legal penalties, reputational damage, and user loss.
- Risks relating to our business and industry
If we cannot implement our solutions for clients or resolve any technical issues in a timely manner, we may incur costs in the form of service credits or other remedial steps and/or lose clients, and our reputation may be harmed
Failures to integrate with clients’ varied EHR, practice-management, data, and infrastructure systems could cause service credits, client losses, and reputational harm.
- Risks relating to our payments business
If our payments platform is limited, restricted, curtailed or degraded in any way, or if we fail to continue to grow and develop our payments platform, our business may be materially and adversely affected
The payments platform generates 24% of fiscal 2025 revenue, so degradation or failure to expand it could materially damage the business.
- Risks relating to our payments business
If we fail to comply with the applicable requirements of card networks, they could seek to fine us, suspend us or terminate our payment facilitator status. If our clients or sales partners incur fines or penalties that we cannot collect from them, we may have to bear the cost of such fines or penalties
Violating Visa, Mastercard, American Express, Discover, or other card-network rules could trigger fines, payment-facilitator suspension, or termination.
- Risks relating to laws and regulations applicable to our industry
compliance or violations of any applicable privacy and data protection laws and believe we are in compliance with such laws, there can be no assurance that we will not receive notices of non-compliance or violations in the future
Privacy-law violations, including inadequate security under HIPAA or FTC standards, could produce noncompliance notices, penalties, and costly remediation.
- Risks relating to laws and regulations applicable to our industry
The healthcare regulatory and political framework is uncertain and evolving
Changing healthcare rules, including the 21st Century Cures Act framework, could require product changes, increase costs, or restrict operations.
- Risks relating to laws and regulations applicable to our industry
While these rules benefit us in that certain EHR vendors will no longer be permitted to interfere with our attempts at integration, they may also make it easier for other similar companies to enter the market, creating increased competition and reducing our market share
A proposed HIPAA Security Rule would require stronger protections for electronic protected health information, while interoperability rules could attract more competitors.
- Risks relating to laws and regulations applicable to our industry
Individuals may claim our calling or text messaging services are subject to, and are not compliant with, the Telephone Consumer Protection Act or similar state laws
Patient calls and texts made through Phreesia or its clients could trigger TCPA or state-law claims and penalties.
- Risks relating to our business and industry
The growth of our business relies, in part, on the growth and success of our clients and certain revenues from our engagements, which is difficult to predict and is subject to factors outside of our control
Variable client fees depend on subscribed features and patient use of payment tools, making revenue dependent on clients’ growth and behavior.
All 58 risk factors
Headings as the filing states them, in filing order.
Risks relating to our business and industry
- 01We operate in a highly competitive industry, and if we are not able to compete effectively, including with the EHR and PM systems with which we integrate, our business and results of operations may be harmed
- 02and would adversely affect our results of operations. Additionally, if we do not maintain our current client network, or if we have to renegotiate existing contracts, our business, financial condition and results of operations may be harmed
- 03If we fail to manage our future growth effectively, our revenue may not increase, and we may be unable to implement our business strategy
- 04Our operating results have fluctuated and may continue to fluctuate significantly, and if we fail to meet the expectations of analysts or investors, our stock price and the value of your investment could decline substantially
- 05Privacy concerns, cyber-attacks, data breaches or cybersecurity incidents relating to our SaaS-based solutions could result in economic loss, damage to our reputation, deterring users from using our products, and exposure to legal penalties and liability
- 06Our operations in India subject us to additional risks which could have an adverse effect on our business, operating results, and financial condition
- 07We typically incur significant upfront costs in our client relationships, and if we are unable to develop or grow these relationships over time, we are unlikely to recover these costs and our operating results may suffer
- 08As a result of our variable sales and implementation cycles, we may be unable to recognize revenue to offset expenditures, which could result in fluctuations in our quarterly results of operations or otherwise harm our future operating results
- 09The growth of our business relies, in part, on the growth and success of our clients and certain revenues from our engagements, which is difficult to predict and is subject to factors outside of our control
- 10If our existing clients are not satisfied with our services, it could have a material adverse effect on our business, financial condition, results of operations and reputation
- 11The estimates and assumptions we use to determine the size of our target market may prove to be inaccurate, and even if the markets in which we compete meet our size estimates and forecasted growth, our business may not grow at similar rates, or at all
- 12If we cannot implement our solutions for clients or resolve any technical issues in a timely manner, we may incur costs in the form of service credits or other remedial steps and/or lose clients, and our reputation may be harmed
- 13We historically derive a significant portion of our revenues from our largest clients
- 14We have experienced net losses in the past and we may not achieve positive net income in the future
- 15We depend on our senior management team and certain key employees, and the loss of one or more of our executive officers or key employees or an inability to attract and retain highly skilled employees could adversely affect our business
- 16We have made, and may in the future make, acquisitions and investments which may be difficult to integrate, divert management resources, result in unanticipated costs or dilute our stockholders
- 17Certain of our operating results and financial metrics, including the key metrics included in this report, may be difficult to predict as a result of seasonality
- 18Business or economic disruptions or global health concerns could harm our business and increase our costs and expenses
- 19From time to time, we are subject to various legal proceedings that could adversely affect our business, financial condition and results of operations
- 20We are a fully remote company that does not maintain a physical office presence, which subjects us to unique operational risks
Risks relating to our payments business
- 21If our payments platform is limited, restricted, curtailed or degraded in any way, or if we fail to continue to grow and develop our payments platform, our business may be materially and adversely affected
- 22Increases in card network fees and other changes to fee arrangements may result in the loss of clients who use our payment processing services or a reduction in our earnings
- 23If we fail to comply with the applicable requirements of card networks, they could seek to fine us, suspend us or terminate our payment facilitator status. If our clients or sales partners incur fines or penalties that we cannot collect from them, we may have to bear the cost of such fines or penalties
- 24Changes in laws and regulations relating to interchange fees on payment card transactions would adversely affect our revenue and results of operations
Risk relating to our data and intellectual property
- 25If our intellectual property is not adequately protected, we may not be able to build name recognition, protect our technology and products, and our business may be adversely affected
- 26Any restrictions on our use of, or ability to license and integrate, third-party technologies could have a material adverse effect on our business, financial condition and results of operations
- 27Third parties may initiate legal proceedings alleging that we are infringing or otherwise violating their intellectual property rights, the outcome of which would be uncertain and could have a material adverse effect on our business, financial condition and results of operations
- 28Interruption or failure of our information technology and communications systems could impair our ability to effectively deliver our products and services, which could cause us to lose clients and harm our operating results
- 29If our services fail to provide accurate and timely information, or if our content or any other element of our service is associated with errors or malfunctions, we could have liability to clients or patients which could adversely affect our results of operations
- 30We may be liable for use of incorrect or incomplete data we provide, which could harm our business, financial condition and results of operations
- 31Our use of “open source” software could adversely affect our ability to offer our services and subject us to possible litigation
Risks relating to laws and regulations applicable to our industry
- 32compliance or violations of any applicable privacy and data protection laws and believe we are in compliance with such laws, there can be no assurance that we will not receive notices of non-compliance or violations in the future
- 33Existing laws regulate our ability to engage in direct marketing, and changes in privacy laws could adversely affect our ability to market our products effectively and could impact our results from operations or result in costs and fines
- 34Any failure by us to comply fully with website accessibility standards could result in us being subject to considerable fines and penalties
- 35The healthcare regulatory and political framework is uncertain and evolving
- 36While these rules benefit us in that certain EHR vendors will no longer be permitted to interfere with our attempts at integration, they may also make it easier for other similar companies to enter the market, creating increased competition and reducing our market share
- 37In addition, we are subject to various other laws and regulations, including, among others, anti-kickback laws, antitrust laws and the privacy and data protection laws described below
- 38We may be subject to risks related to government contracts and related procurement regulations
- 39The U.S. Food and Drug Administration (“FDA”) may in the future determine that our technology solutions are subject to the Federal Food, Drug, and Cosmetic Act and we may face additional costs and risks as a result
- 40Individuals may claim our calling or text messaging services are subject to, and are not compliant with, the Telephone Consumer Protection Act or similar state laws
- 41dollar settlements to the plaintiffs. Even an unsuccessful challenge by consumers or regulatory authorities of our activities could result in adverse publicity and could require a costly response from us
- 42Our business is dependent in part on phone, email and text messaging channels, and any technical, legal or other restrictions on the sending of such correspondence or a decrease in consumer willingness to receive such correspondence could adversely affect our business
- 43Artificial intelligence (“AI”) presents risks and challenges that can impact our business, including by posing security risks to our confidential information, proprietary information and personal data
- 44We may be adversely affected by the operation of laws in non-U.S. jurisdictions
- 45Due to the particular nature of certain services we provide or the manner in which we provide them, we may be subject to additional government regulation and foreign government regulation
- 46reporting requirements. While we believe our products meet certain exceptions that reduce the scope of export control restrictions applicable to such products, these exceptions may be determined not to apply to our products and our products and underlying technology may become subject to export control restrictions
Risks relating to our dependence on third parties
- 47We rely on a limited number of third-party suppliers and contract manufacturers to support our products, and a loss or degradation in performance of these suppliers and contract manufacturers could have a negative effect on our business, financial condition and results of operations
Risks relating to taxes and accounting standards
- 48Our financial results are based in part on our estimates or judgments relating to our critical accounting policies. Changes in related judgments or assumptions, or changes in accounting standards and tax regulations could materially impact our financial position and results of operations
- 49Our ability to use our net operating losses to offset future taxable income may be subject to certain limitations
Risks relating to our financing needs
- 50Our cash and cash equivalents could be adversely affected if the financial institutions in which we hold our cash and cash equivalents fail
- 51In order to support the growth of our business, we may need to incur additional indebtedness under our current credit facilities or seek capital through new equity or debt financings, which sources of additional capital may not be available to us on acceptable terms or at all
- 52Restrictive covenants in the agreements governing our Capital One Credit Facility may restrict our ability to pursue our business strategies
- 53could adversely affect our current and projected business operations and our financial condition and results of operations
Risks relating to ownership of our common stock
- 54Our share price has been and may in the future be volatile, and you could lose all or part of your investment
- 55We do not currently intend to pay dividends on our common stock and, consequently, your ability to achieve a return on your investment will depend on appreciation in the price of our common stock
- 56We cannot guarantee that our stock repurchase program will enhance long-term stockholder value. Share repurchases could also increase the volatility of our stock price and diminish our cash reserves
Risks relating to our bylaws and certificate of incorporation
- 57Anti-takeover provisions under our incorporation documents and Delaware law could delay or prevent a change of control, which could limit the market price of our common stock and may prevent or frustrate attempts by our stockholders to replace or remove our current management
- 58Our bylaws designate certain specified courts as the sole and exclusive forums for certain disputes between us and our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers or employees
Other Phreesia 10-Ks
- 2026 10-K risk factors
56 risks. Phreesia faces significant integration, regulatory, and competitive risks in the fragmented digital healthcare market.
Filed Mar 31, 2026
About this page
Item 1A of the 10-K on EDGAR was split into its risk factors and, where the company's previous 10-K is on file, each heading was matched to last year's and the text compared word for word. The headings are the filing's own. The one-line readings and the overview were written by a language model from the text of the new, dropped, and rewritten risks; they refer to risks by position and cannot misquote a heading.