hstm20241231

hstm20241231_10k.htm

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-K

☒	ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

FOR THE FISCAL YEAR ENDED December 31, 2024

☐	TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

FOR THE TRANSITION PERIOD FROM TO

Commission File Number 000-27701

HEALTHSTREAM, INC.

(Exact name of registrant as specified in its charter)

Tennessee		62-1443555
(State or other jurisdiction of		(I.R.S. Employer Identification No.)
incorporation or organization)

500 11th Avenue North, Suite 1000		37203
Nashville, Tennessee		(Zip Code)
(Address of principal executive offices)

(615) 301-3100

(Registrant’s telephone number, including area code)

Securities Registered Pursuant To Section 12(b) Of The Act:


Title of each class	Trading Symbol(s)	Name of each exchange on which registered
Common Stock (Par Value $0.00)	HSTM	Nasdaq Global Select Market

Securities Registered Pursuant To Section 12(g) Of The Act: None

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 of 15(d) of the Act. Yes ☐ No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15 (d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

Large accelerated filer ☐	Accelerated filer ☒	Non-accelerated filer ☐	Smaller reporting company ☐

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Table of Contents

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☒

If securities are registered pursuant to Section 12(b) of the Act, indicate by check mark whether the financial statements of the registrant included in the filing reflect the correction of an error to previously issued financial statements. ☐

Indicate by check mark whether any of those error corrections are restatements that required a recovery analysis of incentive-based compensation received by any of the registrant’s executive oﬃcers during the relevant recovery period pursuant to §240.10D-1(b). ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act). Yes ☐ No ☒

The aggregate market value of the Common Stock issued and outstanding and held by non-affiliates of the Registrant, based upon the closing sales price for the Common Stock on the Nasdaq Global Select Market on June 30, 2024 was $673.6 million. All executive officers and directors of the registrant have been deemed, solely for the purpose of the foregoing calculation, to be “affiliates” of the registrant.

As of February 21, 2025, there were 30,434,310 shares of the Registrant’s common stock outstanding.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the Registrant’s definitive Proxy Statement for its 2025 Annual Meeting of Shareholders are incorporated by reference into Part III hereof.

Table of Contents

HEALTHSTREAM, INC.

TABLE OF CONTENTS

ANNUAL REPORT ON FORM 10-K


		Page
PART I
Item 1.	Business.	1
Item 1A.	Risk Factors	11
Item 1B.	Unresolved Staff Comments	24
Item 1C.	Cybersecurity	24
Item 2.	Properties	25
Item 3.	Legal Proceedings	25
Item 4.	Mine Safety Disclosures	25

PART II
Item 5.	Market for Registrant’s Common Equity, Related Stockholder Matters and Issuer Purchases of Equity Securities	26
Item 6.	Reserved	28
Item 7.	Management’s Discussion and Analysis of Financial Condition and Results of Operations	28
Item 7A.	Quantitative and Qualitative Disclosures About Market Risk	36
Item 8.	Financial Statements and Supplementary Data	37
Item 9.	Changes in and Disagreements with Accountants on Accounting and Financial Disclosure	61
Item 9A.	Controls and Procedures	61
Item 9B.	Other Information	61
Item 9C.	Disclosure Regarding Foreign Jurisdictions that Prevent Inspections	61

PART III
Item 10.	Directors, Executive Officers and Corporate Governance	62
Item 11.	Executive Compensation	62
Item 12.	Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters	62
Item 13.	Certain Relationships and Related Transactions, and Director Independence	62
Item 14.	Principal Accounting Fees and Services	62

PART IV
Item 15.	Exhibits, Financial Statement Schedules	63
Item 16.	Form 10-K Summary	64
	Signatures	65

Table of Contents

PART I

This Annual Report on Form 10-K contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, Section 21E of the Securities Exchange Act of 1934, and the Private Securities Litigation Reform Act of 1995. Such forward-looking statements include, among others, those statements including the words “expects,” “anticipates,” “intends,” “believes,” “may,” “will,” “should,” “continue,” and similar language or the negative of such terms or other comparable terminology. Forward-looking statements involve known and unknown risks, uncertainties, and other factors that may cause our actual results, performance, or achievements to be materially different from future results, performance, or achievements expressed or implied by the forward-looking statements included herein. Factors that might cause or contribute to such differences include, but are not limited to, those discussed in the section Risk Factors in Item 1A of this Annual Report on Form 10-K and elsewhere in this document. In addition, factors that we are not currently aware of, or that we currently deem immaterial, could harm our future operating results. You should carefully review the risks described in other documents HealthStream files from time to time with the Securities and Exchange Commission. You are cautioned not to place undue reliance on forward-looking statements, which speak only as of the date of this Annual Report on Form 10-K. HealthStream undertakes no obligation to publicly release any revisions to the forward-looking statements to reflect future events or circumstances after the date of this document.

Item 1. Business

OVERVIEW AND HISTORY

HealthStream’s focus is and has always been on improving the quality of healthcare through the development and support of the dedicated individuals who deliver care. Like healthcare itself, our mission remains constant, but how we accomplish that mission continues to evolve and improve over time. Originally, we pioneered the use of online learning to hospitals, which began with courses specifically tailored to educate healthcare professionals and meet hospitals' required regulatory needs, and we remain a leading innovator in those areas today. Since our inception, the scope of HealthStream’s Software-as-a-Service (SaaS) solutions has expanded well beyond our governance, risk, and compliance (GRC) offerings to include a diverse ecosystem of applications that optimize and support the healthcare workforce and the students preparing to enter that workforce. Today, we are characterized by our single platform strategy, which is designed to create interoperability among the various applications in our ecosystem through our proprietary hStream technology platform. We believe that our single platform strategy, as represented by hStream, is the best way to realize our mission of improving the quality of care by developing the people who deliver care, and the best way to create value for our shareholders in the process.

For healthcare organizations—our primary customers—HealthStream’s solutions help to effectively onboard, retain, engage, educate, manage, and develop workforce talent; meet rigorous GRC requirements; optimize staff scheduling and capacity management; and automate the management of medical staff credentialing, privileging, and enrollment.

For healthcare professionals and students—our primary end users—HealthStream’s solutions help them to professionally develop their knowledge and skills, manage and fulfill their required continuing education and certifications, manage their schedules, including swapping and filling shifts, engage with peers, provide personalized competency development, and optimize their career pathways.

For both healthcare organizations and healthcare professionals and students, HealthStream’s solutions are generally accessed through SaaS application suites that are increasingly enhanced through our hStream technology platform. Our learning, credentialing, and scheduling application suites are designed to help solve the most critical problems facing the healthcare workforce today. They accomplish this by utilizing a combination of established and cutting-edge technologies, such as initiative and workflow management capabilities; proprietary taxonomy engines; dynamic engagement models; artificial intelligence and machine learning (AI/ML) driven clinical assessments; physical-based simulations; healthcare-specific benchmarks; and automated license monitoring and validation.

HealthStream’s success in offering the largest, most diverse ecosystem of workforce solutions in healthcare has made it a thought leader and barometer of innovation for the industry. From its roots in originating online learning for healthcare organizations to the Company's more recent release of "Competency Suite" the first AI/ML-driven clinical competency development system, HealthStream continues to believe that the key to quality patient care lies in the people who deliver care. To that end, we are solely dedicated to providing solutions for the healthcare workforce and for those about to enter it.

The Company was incorporated in 1990. It began providing its SaaS-based workforce solutions in 1999, its provider solutions in 2012, and launched the hStream technology platform in 2018. Since January 2023, the Company’s operations have been streamlined around a consolidated, enterprise approach such that the Company ceased having two reportable business segments (Workforce Solutions and Provider Solutions). As such, beginning January 1, 2023, the Company has had a single reportable segment and presents financial information on a single segment basis. HealthStream is headquartered in Nashville, Tennessee and had 1,083 full-time and 10 part-time employees as of December 31, 2024.

Table of Contents

INDUSTRY BACKGROUND

According to the Centers for Medicare & Medicaid Services (CMS), spending in the healthcare industry reached over $4.9 trillion in 2023, or 17.6% of the U.S. gross domestic product. The growth in 2023 was an increase of 4.6% over the prior year and reflected growth in non-price factors, such as increased use and intensity of healthcare goods and services, influencing strong growth in both Medicare and private health insurance spending. Hospital care expenditures reached over $1.5 trillion in 2023 accounting for over 30% of the $4.9 trillion healthcare industry. Hospital care expenditures increased 10.4% over 2022, driven by strong growth in spending for hospital care by all major payors and the factors discussed above. According to the Bureau of Labor Statistics, as of January 2024, approximately 22 million professionals are employed in the healthcare and social assistance sector of the domestic economy, with approximately 5.4 million employed in acute-care hospitals and, according to CMS, approximately 5.9 million employed in other healthcare organizations throughout the continuum of care, the primary target markets for our products. Organizations in the continuum of care employ approximately 2.2 million employees in post-acute care facilities and over 0.9 million employees in health and human services facilities.

All of the approximately 5.65 million hospital-based healthcare professionals that work in the nation’s approximately 6,100 inpatient hospitals that are registered with Medicare are required by federal and state mandates and accrediting bodies to complete training in a number of areas. This training includes safety training mandated by both the Occupational Safety and Health Administration (OSHA) and The Joint Commission (an independent, not-for-profit organization that accredits and certifies healthcare organizations and programs in the United States), as well as training on patient information confidentiality required under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

In hospitals, staffing issues and personnel shortages have contributed to the need for more effective and efficient workflows, including scheduling and capacity management as well as credentialing and privileging. Staffing shortages have also increased the need for facility-based workforce development as well as additional assessment and competency-based training. The ongoing nursing shortage, for example, is resulting in skill gaps and rising costs. According to the National Center for Health Workforce Analysis (2024), there is a projected 10% shortage of registered nurses (RNs) in 2027. By 2037, the shortage projected is 6%, a shortage of 207,980 full-time equivalent RNs. We believe that offering training and education and other engagement solutions for hospital personnel is increasingly being utilized as a retention and recruitment incentive. We also believe that offering training to nursing schools and nursing students can help address personnel shortages and lead to more efficient and effective transition from school to employment.

Many healthcare professionals use continuing education to keep abreast of clinical and other industry developments as well as to meet licensing and certification requirements. Continuing education is required for nurses, emergency medical services personnel, first responder personnel, radiologic personnel, and physicians, among many other healthcare professionals. Pharmaceutical and medical device companies must also provide their medical industry sales representatives with training mandated for the healthcare industry and training for new products. Such companies also provide support and content for education and training of audiences that use their products in healthcare organizations.

The healthcare education and training industry is highly fragmented, varies significantly in delivery methods (i.e., online products, live events, written materials, and technology-enabled manikins for simulation-based training), and is composed of a wide variety of entities competing for customers. The sheer volume of healthcare information available to satisfy continuing education needs, rapid advances in medical developments, and the time constraints that healthcare professionals face can make it difficult to quickly and efficiently access the continuing education content most relevant to an individual’s practice or profession. Historically, healthcare professionals have received continuing education and training through offline publications, such as medical journals or by attending conferences and seminars. Other healthcare workers and pharmaceutical and medical device manufacturers’ sales and internal regulatory personnel usually fulfill their training from external vendors or internal training departments. While these approaches satisfy the ongoing education and training requirements, they are typically costly and inconvenient. In addition, live courses are often limited in the breadth of offerings and do not provide an automated method for tracking training completion. The effectiveness of these traditional methods, both from a business and compliance standpoint, is difficult to track and measure.

Provider data management has become more complex and arduous for healthcare organizations. Credentialing and privileging is now a continuous, evidence-driven analysis of professional competency and provider performance that requires automatic monitoring of licenses, sanctions, and exclusions, as well as a broad scope of review at initial credentialing and re-credentialing. In addition, provider enrollment processes have compounded in difficulty. For example, a single provider may need to enroll annually with some 30 to 40 payers, with each payer application often taking two to four hours to complete.

Healthcare organizations continue to operate under ongoing pressure to reduce costs as a result of actual and potential reductions in reimbursement rates and increased focus on cost containment consistent with participation of patients in managed care programs, among other factors. In addition, many care settings, including hospitals, surgery centers, telehealth companies, outpatient centers, and skilled nursing facilities, have experienced and may continue to experience rising operating costs and increased pressure to measure and report on the outcomes of the dollars spent on training. Our products and services are designed to meet these needs by reducing healthcare organizations’ costs of training while improving learning outcomes, enhancing reporting capabilities, and supporting customers’ business objectives.

Table of Contents

HEALTHSTREAM’S SOLUTIONS

HealthStream’s products, services, and operations are organized and managed under our One HealthStream approach. Through this One HealthStream approach, we collectively help healthcare organizations meet their ongoing learning, clinical development, credentialing, and scheduling needs. HealthStream’s solutions are provided to a wide range of customers within the healthcare industry.

Our underlying solutions are comprised primarily of SaaS, subscription-based applications that are used by healthcare organizations to meet a broad range of their workforce development needs around learning, clinical development, credentialing, and scheduling. Nursing schools, nursing students, as well as individual healthcare professionals are also beginning to utilize our training and education solutions. Our numerous content libraries allow customers to subscribe to a wide array of courseware, which includes content from leading healthcare and nursing associations, medical and healthcare publishers, and other ecosystem partners. Our scheduling solutions provide customers with real-time visibility into clinical staff scheduling that enables them to optimize their workforce, reduce costs, and improve care. Our SaaS-based credentialing, privileging, and enrollment solution, CredentialStream, provides customers an intuitive, modern user experience, evidence-based content, and curated data, all which provides healthcare organizations with tools to support the provider lifecycle management from recruiting, application submission, verification of licensure and other credentials, privileging, appointments by credentialing committees, enrollment, network, management, onboarding, and performance evaluations of providers.

Pricing for hStream and HealthStream’s products is primarily subscription-based, with fees based on the number of subscriptions, solutions provided, and other factors. We offer implementation, training, and account management services to facilitate adoption of our subscription-based solutions. Fees for implementation services are based on the time and efforts of the personnel involved. Training fees vary based on the size, scope, and complexity of the project. Our platform and subscription-based solutions are hosted on a combination of private-cloud infrastructure and public-cloud infrastructure, leveraging Amazon Web Services and Azure, which allows authorized personnel access to our services through the Internet, thereby eliminating the need for onsite local implementations of installed workforce development products. HealthStream also sells a growing number of products directly to individuals in the healthcare industry and these products are primarily based on per-unit retail price.

Other Applications on our Platform — HealthStream offers an array of other applications on our platform, each serving a unique function for healthcare customers. Each application on our platform has its own value. Examples of individual applications that are offered on our platform include applications for performance appraisal, competency management, disclosure management, clinical competency, assessment, development, simulation-based education, clinical rotation and onboarding management, quality management, and industry training.

BUSINESS ACQUISITIONS

As part of our overall growth strategy, we evaluate opportunities for mergers and acquisitions, and since the beginning of 2022, we have completed four acquisitions. In May 2022, we acquired the remaining ownership interest (representing approximately 82% of the outstanding equity interests) of CloudCME, LLC (CloudCME), and in December 2022, we acquired substantially all of the assets of Electronic Education Documentation System (d/b/a eeds) (eeds). In October and November 2024, we acquired substantially all of the assets of Total Clinical Placement System (d/b/a TCPS) (TCPS) and The Clinical Hub, Inc. (d/b/a The Clinical Hub) (The Clinical Hub), respectively. For additional information regarding acquisitions, please see Note 8 to the Consolidated Financial Statements included elsewhere in this report.

CUSTOMERS

We provide our solutions to customers across a broad range of individuals and entities within the healthcare industry, including private, not-for-profit, and government entities, as well as pharmaceutical and medical device companies and nursing schools and their students. We derive a substantial portion of our revenues from a relatively small number of customers that are healthcare providers. However, during the year ended December 31, 2024, no single customer accounted for 10 percent or more of our annual revenue.

SALES AND MARKETING

We market our products and services primarily through our direct sales teams, who are located throughout the United States and who reach out to a wide range of healthcare organizations throughout the full continuum of care. HealthStream has also expanded its e-commerce sales capabilities, building on its existing sales channels and establishing new online sales channels. This has enabled the Company to begin extending beyond its traditional business-to-business sales model to also include functionality to support sales made directly to healthcare professionals and students, including those direct sales that can be made by the buyer.

We conduct a variety of marketing programs to promote our products and services, including via our hStream content marketplace, user groups, trade shows, social media, Internet promotion and demonstrations, digital marketing campaigns, public relations, distribution of product-specific literature, direct mail, advertising, and in partnership with third parties. We have marketing teams that are responsible for these initiatives and for working with and supporting our product management and sales teams.

Table of Contents

OPERATIONS AND TECHNOLOGY

We believe our ability to establish and maintain long-term customer relationships, obtain recurring sales, and develop and maintain new and existing products are dependent on the strength of our operations, customer service, product development and maintenance, training, and other support teams. Our operations teams are primarily associated with technical support, customer implementation and training, product management, software development and quality assurance, and other functions.

Our services are designed to be reliable, secure, and scalable. Our software is a combination of proprietary and commercially available software and operating systems. We designed the applications that provide our services to allow each component to be independently scaled by adding commercially available hardware and a combination of commercially available and proprietary software components.

Our software applications, servers, and network infrastructure that deliver our services are hosted by a combination of third-party data center providers and cloud-based infrastructure. We maintain redundant disaster recovery data centers that are located in geographically separate locations. Our technology equipment is maintained in secure, limited access environments, supported by redundant power, environmental conditioning, and network connectivity.

For information on our cybersecurity risk management, strategy, and governance, see Item 1C. Cybersecurity.

COMPETITION

A number of companies offer competitive learning, scheduling, and credentialing solutions, some of which are focused on multiple industries and some of which are focused on the healthcare industry. We compete with companies such as Cornerstone OnDemand, Ultimate Kronos Group, Degreed, Oracle, SAP, Infor, and Workday, which provide their services to multiple industries, including healthcare. We also compete with companies that are dedicated to, or have operating units focused on healthcare, such as Relias Learning, RLDatix, Symplr, Verisys, MD-Staff, AMN Healthcare, as well as with an array of smaller companies.

We believe our hStream technology platform and the interoperability it has begun to enable provides us a competitive advantage by facilitating education, training, assessment, engagement, scheduling, credentialing, privileging, validation, and development for healthcare professionals through a wide assortment of content, functionality, and applications. We also believe that our hStream platform technology is accelerating the scope and quality of our products, has the capability to connect medical staff credentialing with provider enrollment, and provide innovative predictive analytics, all of which we believe provide us with a competitive advantage. We believe that the principal competitive factors affecting the marketing of our solutions to the healthcare industry include:

•

our hStream technology platform, which combines SaaS-based capabilities and certain Platform-as-a-Service (PaaS) capabilities to help capture, track, manage, and report on activities, such as learning, performance, scheduling, credentialing, and privileging across various modalities, provides interoperability with external systems such as HRIS and other systems utilized by our customers;

•

scope and variety of Internet-based solutions available, including, without limitation, learning and education, clinical, GRC, resuscitation, revenue cycle, talent management, scheduling, credentialing, and privileging solutions;

•

our singular focus on the healthcare industry and our deep healthcare expertise;

•

scope and quality of professional services offered, including implementation, benchmarking, and training;

•

competitive pricing, which supports a return on investment to customers;

•

customer service and support;

•

mobility, security, uniqueness, and value of underlying data sets and embedded content;

•

effectiveness of sales and marketing efforts; and

•

company reputation.

We believe these factors provide us with the ability to improve the quality of healthcare by developing the people who deliver care.

Table of Contents

GOVERNMENT REGULATION OF THE INTERNET AND THE HEALTHCARE INDUSTRY

Regulation of the Internet and the Privacy and Security of Personal Information

We are subject to various legal requirements related to the Internet and the privacy and security of personal information, which legal requirements may change rapidly. The following are areas of law in this regard that are significant to our business:

•

Privacy and Security Laws. Federal, state, and foreign privacy and security laws and regulations governing the collection, use, retention, deletion, security, disclosure, and other processing of personal information limit our ability to collect information or use and disclose the information in our databases or that we derive from other sources to generate revenues. These laws and regulations are rapidly evolving and could have an adverse effect on our operations. For example, various states have passed privacy laws that restrict the use and disclosure of personal information, some of which were recently enacted and will be implemented over the course of 2025. Additional states are considering similar legislation, and privacy laws have been proposed at the federal level as well. We have expanded our business in recent years into new markets and jurisdictions (including foreign jurisdictions), which may subject our business to additional privacy and data protections laws and regulations, such as the Family Educational Rights and Privacy Act (FERPA), the Canadian Personal Information Protection and Electronic Documents Act, the New Zealand Privacy Act 2020, the Australia Privacy Act 1988, and the European Union’s General Data Protection Regulation. Many of the data privacy requirements in foreign jurisdictions are more stringent than those imposed by the U.S. federal and state governments. The significant differences among various privacy and security laws introduce complexity in our compliance efforts. It may be costly to implement measures (such as certain security requirements, contracting terms, assessments, and registrations with authorities) that are designed to comply with new legal requirements, changes to existing legal requirements, or legal requirements in jurisdictions into which we have recently expanded or are planning to expand. The obligations and requirements applicable to companies under these laws and regulations are subject to uncertainty in how they may be interpreted by government authorities and regulators. We may be audited or subject to an investigation by a federal, state, or foreign regulator regarding our compliance with privacy and security laws and regulations and may incur substantial costs as a result. If a court or other governmental authority determines the Company has failed to comply with such laws and regulations, the Company may become subject to penalties, and the Company’s business and reputation could be negatively impacted.

•

Content Regulation and Artificial Intelligence. Both foreign and domestic governments have adopted and proposed laws and regulations governing content and materials transmitted over the Internet. These include laws relating to obscenity, indecency, libel, and defamation. We could be liable if content we create, store, or deliver is determined to be in violation of these laws and regulations. In addition, various U.S. and foreign jurisdictions have enacted and/or are considering laws and regulations applicable to the use of AI/ML applications and tools, particularly on the use of AI to facilitate healthcare, education, employment, or hiring decisions. Any failure to comply with those laws and regulations may result in the Company being subject to fines, penalties, or negative publicity.

•

Information Security Accountability Regulation. As a HIPAA business associate of certain of our customers, we are required to report breaches of protected health information to our customers, who must in turn notify affected individuals, the U.S. Department of Health and Human Services (HHS) and/or other governmental agencies, and, in certain situations, the media. In addition, we are subject to various foreign and state laws and regulations that relate to data security, some of which require reporting of security breaches. For example, California law requires notification of security breaches involving personal information and medical information. We may incur costs to comply with these notification requirements that are difficult to estimate.

•

Sales and Use Tax. We collect sales, use, or other taxes on taxable transactions in states and foreign jurisdictions in which we have employees, have a significant level of sales activity, or otherwise determine that such collection is appropriate. While HealthStream believes that this approach is appropriate, other states or foreign jurisdictions may seek to impose tax collection obligations on companies like us that engage in online commerce. If they do, these obligations could limit the growth of electronic commerce in general and adversely impact our business.

Laws and regulations directly applicable to content regulation, e-commerce, Internet communications, the privacy and security of personal information, and artificial intelligence are becoming more prevalent and/or broader in scope. The dynamic nature of this regulatory environment increases the uncertainty regarding the marketplace impact of such regulation. New or changes to existing laws or regulations may increase our cost of conducting business or otherwise harm our business, financial condition, and operating results.

Table of Contents

Regulation of Education, Training, and Other Services for Healthcare Professionals and Students

Occupational Safety and Health Administration. OSHA regulations require certain employers to provide training to certain employees to minimize the risk of injury from various potential workplace hazards. Employers in the healthcare industry may be required to provide training with respect to various topics, including, but not limited to, blood borne pathogens exposure control, laboratory safety, proper use of personal protective equipment, and tuberculosis infection control. OSHA regulations further require employers to keep records of their employees’ completion of training with respect to these workplace hazards, as applicable.

The Joint Commission. The Joint Commission accreditation and certification standards require employers in the healthcare industry to provide certain workplace safety and patient interaction training to employees. Training required by The Joint Commission may include programs on infection control, patient bill of rights, medication safety, radiation safety, and incident reporting. Healthcare organizations are required to provide and document training on these topics to receive accreditation from The Joint Commission. In addition, The Joint Commission imposes continuing education requirements on physicians that relate to each physician’s specific staff appointments.

HIPAA. HIPAA and its implementing regulations restrict how certain organizations (known as covered entities), including most healthcare providers and health plans, use and disclose protected health information. HIPAA requires these organizations to provide reasonable and appropriate safeguards to protect the privacy, integrity, and confidentiality of protected health information, whether in paper, oral, or electronic form. Covered entities are required to establish, maintain, and provide training with regard to their policies and procedures for protecting the integrity and confidentiality of protected health information and must document training on these topics to support their compliance. Certain HIPAA privacy and security requirements apply to entities (known as business associates) that handle protected health information on behalf of covered entities or other business associates. Covered entities, business associates, and their subcontractors may be directly subject to criminal and civil sanctions for violations of HIPAA privacy and security standards.

FERPA. FERPA and its implementing regulations prohibit institutions of higher learning that receive funds through an applicable program of the U.S. Department of Education, such as nursing schools, from disclosing personally identifiable information from a student’s record without the student’s consent. Third parties acting on behalf of an educational institution are indirectly subject to FERPA and, as such, may not transfer or otherwise disclose any personally identifiable information from a student’s record to another party other than as permitted by FERPA. Institutions and organizations subject to FERPA may be subject to an enforcement action by the U.S. Department of Education, which may include, among other things, financial penalties.

The American Nurses Credentialing Center (ANCC). ANCC, a subsidiary of the American Nurses Association (ANA), provides individuals and organizations throughout the nursing profession with resources intended to assist with achieving practice excellence. ANCC’s credentialing programs certify nurses in specialty practice areas; recognize healthcare organizations for promoting safe, positive work environments through the Magnet Recognition Program^® and the Pathway to Excellence^® Program; and accredit providers of continuing nursing education. ANCC maintains seventeen certification exams to validate nurses’ skills, knowledge, and abilities. The ANCC Magnet Recognition Program recognizes healthcare organizations that provide the best in nursing care and professionalism in nursing practice. The program also provides a vehicle for disseminating best practices and strategies among nursing systems. The ANCC Magnet Recognition Program is a highly regarded standard for nursing excellence. The Pathway to Excellence Program recognizes the essential elements of a high standard nursing practice environment. The designation is earned by healthcare organizations that create work environments where nurses can develop professionally. The award substantiates the professional satisfaction of nurses and identifies best places to work.

Continuing Nursing Education (CNE). State nurse practice laws generally authorize a state’s board of nursing to establish CNE requirements for professional nurses to maintain valid licensure. CNE requirements vary widely from state to state, with reporting generally required on a bi-annual basis. In some states, the CNE requirement only applies to re-licensure of advance practice nurses, while in other states, additional CNEs may be required of this category of nurses. Board certifications (e.g., Certified Nurse Operating Room (CNOR) – certification of perioperative nursing) also require CNE hours/credits, with certain percentages required in specific categories based on the certification type. Failure to obtain the requisite CNE could result in non-renewal of the license or certification. The ANCC Commission on Accreditation is responsible for accrediting or approving organizations to award ANCC nursing continuing professional development (NCPD) credit (contact hours) to activities for a national audience of nurses. State boards of nursing approve individual CNE activities or continuing education providers that offer CNE activities primarily for nurses within the state. ANCC NCPD credit for online activities is accepted by all state boards of nursing within the United States and each of its territories. Our HealthStream CNE Provider Unit is accredited as a provider of NCPD by ANCC. We are also approved by the California Board of Registered Nursing and the Florida Board of Nursing.

Continuing Medical Education (CME). State licensing boards, professional organizations, and employers require physicians to certify that they have accumulated a minimum number of CME hours to maintain their licenses. Generally, each state’s medical practice laws authorize the state’s board of medicine to establish and track CME requirements. Medical licensing boards in most U.S. states and territories currently have CME requirements, and certain state medical societies and practice specialty boards also require CME. The failure to obtain the requisite amount and type of CME could result in non-renewal of the physician’s license to practice medicine and/or membership in a medical or practice specialty society. The American Medical Association (AMA) classifies CME activities as either Category 1, which includes formal CME activities, or Category 2, which includes self-designated credit for informal activities that meet certain requirements. Most boards of medical examiners nationwide that require CME participation specify AMA PRA Category 1 Credit. Only institutions and organizations accredited to provide CME can designate an activity for AMA PRA Category 1 Credit. The Accreditation Council for Continuing Medical Education (ACCME) is responsible for awarding accreditation status to state medical societies, medical schools, and other institutions and organizations that provide CME activities, typically for a national audience of physicians. State medical societies, operating under the aegis of the ACCME, accredit institutions and organizations that provide CME activities primarily for physicians within the state or bordering states. We are recognized as an accredited provider of CME for physicians by the ACCME.

Table of Contents

Centers for Medicare & Medicaid Services (CMS) Quality Efforts. CMS is increasingly focused on arrangements, which generally aim to hold providers accountable for delivering high quality, efficient clinical care in part by tying provider reimbursement to patient outcomes or related measures. Through a number of public reporting programs, demonstration projects, pilot programs, and other initiatives, some voluntary and some mandatory, CMS has implemented value-based care programs for various provider-types, including hospitals, physician offices, nursing homes, home health providers, and dialysis facilities. CMS promotes innovation and modernization of quality measures, which are central to value-based care, through its Meaningful Measures Initiative.

Interoperability Initiatives. CMS interoperability programs encourage eligible professionals, eligible hospitals, and critical access hospitals to adopt electronic health record (EHR) technology by imposing payment reductions for failure to demonstrate meaningful use of certified EHR technology. EHR technology can be used to reduce errors, increase the availability of records and data, and provide reminders, alerts, clinical decision support, and e-prescribing/refill automation. Further, healthcare providers and industry participants are subject to a growing number of requirements intended to promote interoperability and the exchange of patient health information. For example, under the 21st Century Cures Act, healthcare providers, health IT developers, and certain other entities are subject to information blocking restrictions. Information blocking is generally defined as engaging in activities that are likely to interfere with the access, exchange, or use of electronic health information, subject to limited exceptions. Violations may result in penalties or other significant disincentives.

Allied Disciplines. Various allied health professionals are required to obtain continuing education to maintain their licenses. For example, emergency medical technician (EMT) personnel may be required to attain a minimum number of continuing education hours per year, all or a portion of which can be fulfilled online. These requirements vary by state and depend on the professional classification of the individual. HealthStream is an organization accredited and/or approved by the Commission on Accreditation for Prehospital Continuing Education (CAPCE) and the Florida Department of Health.

Regulation of Educational Program Sponsorship and Support

There are a variety of laws and regulations that affect the relationships between our medical device and pharmaceutical customers and the users of our products and services, including the sponsorship and support of educational programs. For example, the Physician Payments Sunshine Act (Sunshine Act) requires manufacturers of drugs, biological devices, and medical devices covered by Medicare, Medicaid, or the Children’s Health Insurance Program to report annually to CMS payments and other transfers of value given by such manufacturers to physicians, certain other healthcare professionals, and teaching hospitals, including educational programs, with limited exceptions. CMS regulations generally require manufacturers to report the recipient’s name, business address, and national provider identifier as well as other information about the payment or transfer of value including the amount, date, form, and nature of what is offered. CMS publishes the information on its Open Payments website. Manufacturers that do not meet the reporting obligations are subject to significant monetary penalties.

Further, the Office of Inspector General (OIG) has issued Compliance Program Guidance for Pharmaceutical Manufacturers and for the Durable Medical Equipment, Prosthetics, Orthotics, and Supply Industry (collectively, the Guidelines). The Guidelines address compliance risks raised by the support of continuing educational activities by pharmaceutical and medical device companies. The Guidelines have affected and may continue to affect the type and extent of commercial support we receive for our continuing education activities. The trade associations for the pharmaceutical and medical device industries (PhRMA and AdvaMed, respectively) have also promulgated their own codes of ethics that further restrict the interactions between industry and health care professionals. In addition, the AMA has established its own code of ethics that provides standards of conduct for physicians, addressing professional-self regulation and including a policy regarding Gifts to Physicians from Industry.

Some continuing education organizations issue related standards applicable to our services. For example, we comply with the ACCME’s Standards for Integrity and Independence in Accredited Continuing Education to ensure that our CME and CNE activities are evidence-based, designed to improve patient care and/or community health, and free from commercial influence. We follow all standards/criteria/guidelines set-forth by ACCME, ANCC, and other continuing education organizations regarding the regulation of educational program sponsorship and support.

The U.S. Food and Drug Administration (FDA) and the Federal Trade Commission (FTC)

Current FDA and FTC rules and enforcement actions and regulatory policies, or those that the FDA or the FTC may develop in the future, could have a material adverse effect on our ability to provide existing or future applications or services to our end users or obtain the necessary corporate sponsorship to do so. The FDA and the FTC regulate the form, content, and dissemination of labeling, advertising, and promotional materials, including direct-to-consumer prescription drug and medical device advertising, prepared by, or for, pharmaceutical, biotechnology, or medical device companies. The FTC regulates over-the-counter drug advertising and, in some cases, medical device advertising. Generally, regulated companies must limit their advertising and promotional materials to discussions of the FDA-approved indications. Therefore, any information that promotes the use of pharmaceutical or medical device products that is presented with our services is subject to the FDA and FTC requirements and regulatory oversight including criminal, civil, and administrative actions. We believe that banner advertisements, sponsorship links, and any educational programs we may present with our services, even if we lack independent editorial control over it, could subject us to FDA or FTC regulation. While the FDA and the FTC place the principal burden of compliance with advertising and promotional regulations on the advertiser, if the FDA or FTC finds that any regulated information presented with our services violates FDA or FTC regulations, they may take regulatory action against us or the advertiser or sponsor of that information. In addition, the FDA may adopt new regulatory policies that more tightly regulate the format and content of promotional information on the Internet.

Table of Contents

ENVIRONMENTAL MATTERS

We are subject to a number of federal, state, and local environmental laws, rules, and regulations. In addition, we could be affected by climate change to the extent that climate change results in severe weather conditions or other disruptions impacting the communities in which we have office locations and/or where we have network infrastructure or adversely impacts general economic conditions. Moreover, legal requirements regulating greenhouse gas emissions and energy inputs or otherwise associated with the transition to a lower carbon economy could increase in the future, which could increase our costs associated with compliance and otherwise disrupt and adversely affect our operations.

At the current time, our compliance with environmental legal requirements, including legal requirements relating to climate change, does not have a material effect on our capital expenditures, financial results, or operations, and we did not incur material capital expenditures with respect to environmental matters during the year ended December 31, 2024. However, future environmental-related developments may impact us, including as a result of climate change and/or legal requirements associated with the transition to a lower carbon economy in a manner that we are currently unable to predict.

INTELLECTUAL PROPERTY AND OTHER PROPRIETARY RIGHTS

To protect our proprietary rights, we rely generally on copyright, trademark, patent, and trade secret laws; confidentiality agreements, contracts, and procedures with employees, consultants and other third parties; contractual provisions in license agreements with consultants, vendors, and customers; and use measures designed to control access to our software, documentation, and other proprietary information. We own federal trademark and service mark registrations for several marks, including, without limitation “HEALTHSTREAM”, "HSTREAM", “HEALTHSTREAM LEARNING CENTER”, "CREDENTIALSTREAM", "JANE", “HEALTHSTREAM EPORTFOLIO”, and “COMPLYQ”. We also have obtained registration of the “HEALTHSTREAM” mark in certain other countries. Additionally, we hold a number of patents related to the solutions we provide. Applications for several trademarks and patents are currently pending. However, there can be no assurance that we will be successful in obtaining registration of trademarks and patents for which we have applied.

The content we license to our customers is developed through a combination of license agreements with publishers and authors, assignments and work-for-hire arrangements with third parties, and development by employees. We require publishers, authors, and other third parties to represent and warrant that their content does not infringe on or misappropriate any third-party intellectual property rights and that they have the right to provide their content and have obtained all third-party consents necessary to do so. Our publishers, authors, and other third parties also agree to indemnify us against certain liability we might sustain due to the content they provide.

If a third party asserts a claim that we or our third party partners have infringed its patents or other intellectual property right, we may incur costs to defend against that claim, and we may be required to redesign or discontinue products that we currently offer or enter into royalty or licensing agreements, which may result in negative publicity, harm to our reputation, or an adverse effect on our results of operations. In addition, we license technologies from third parties for incorporation into our services. Licensing agreements with these third parties may not be available on terms acceptable to us, if at all. Additionally, despite the steps we have taken to protect our intellectual property and proprietary rights, our efforts may not be adequate. Third parties may infringe or misappropriate our intellectual property, and such violations of our intellectual property are difficult to detect and police. Competitors may also independently develop technologies that are substantially equivalent or superior to the technologies we employ in our products or services. If we are unable to safeguard our proprietary rights adequately, our competitors could offer similar services, potentially significantly harming our competitive position and decreasing our revenues.

We hold inbound licenses for certain intellectual property that is used internally, and in some cases, utilized in HealthStream’s products or services. While it may be necessary in the future to seek or renew licenses relating to various aspects of our products and services, we believe, based upon past experience and industry practice, such licenses generally can be obtained on commercially reasonable terms. We believe our operations and products and services are not materially dependent on any single license or other agreement with any third party.

AVAILABLE INFORMATION

The Company files reports with the SEC, including annual reports on Form 10-K, quarterly reports on Form 10-Q, and other reports from time to time. The SEC maintains an Internet site at http://www.sec.gov that contains the reports, proxy, and other filings made by us electronically. Our website address is www.healthstream.com. Please note that our website address is provided as an inactive textual reference only. We make available, free of charge through our website, our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, all amendments to those reports, and other filings made by us with the SEC, as soon as reasonably practicable after such material is electronically filed with or furnished to the SEC. The information provided on our website is not part of this report and is not incorporated by reference herein.

Table of Contents

HUMAN CAPITAL RESOURCES

As of December 31, 2024, the Company had 1,083 full-time and 10 part-time employees.

The Company operates under a hybrid work policy that allows employees to work remotely if they so choose and if the scope of their job duties is suitable for remote work. As of December 31, 2024, approximately 39% of employees worked within a commutable distance from one of the Company's two offices, while the remaining 61% did not.

HealthStream’s culture is both exemplified and driven by our Constitution, which is a living document and the lens through which we endeavor to view and shape our actions. Our Constitution is comprised of the Company’s vision statement, values, and business principles. Upon being hired at HealthStream, each employee completes a course on our Constitution, which we view to be an important step in engagement, development, and training of our employees. Our Constitution is available on our website on the Investor Relations page. This and other information on our website are not a part of this Annual Report on Form 10-K and is not incorporated by reference herein.

HealthStream is committed to recruiting, maintaining, and growing a diverse, equitable, and inclusive workforce that helps us live our Constitutional values as we strive to achieve positive results for our shareholders, employees, customers, and community.

The labor market for personnel, including technical personnel, continues to be competitive. For additional information regarding risks related to the current competitive labor market, see Item 1A. Risk Factors — “We operate in a challenging market for talent and may fail to attract and retain qualified personnel, including key management personnel.”

INFORMATION ABOUT OUR EXECUTIVE OFFICERS

The following is a brief summary of the business experience of each of the executive officers of the Company. Executive officers of the Company are elected by the Board of Directors and serve at the pleasure of the Board of Directors. The following table sets forth certain current information regarding the executive officers of the Company:

Name	Age	Position
Robert A. Frist, Jr.	57	Chief Executive Officer and Chairman of the Board of Directors
Michael M. Collier	49	Executive Vice President, Corporate Strategy, Development, and Operations
Michael Sousa *	56	Executive Vice President, Enterprise Applications
Trisha L. Coady	49	Executive Vice President, Workforce Solutions
Kevin O’Hara	55	Executive Vice President, Enterprise Workforce Platform
Scott A. Roberts	48	Senior Vice President and Chief Financial Officer
Jeffrey D. Cunningham	58	Senior Vice President and Chief Technology Officer
M. Scott McQuigg	57	Senior Vice President, Digital & Network Development
Scott Fenstermacher	56	Senior Vice President, Sales

* As previously announced in the Company's Form 8-K filed February 24, 2025, Michael Sousa will be resigning from his position as EVP, Enterprise Applications effective March 31, 2025.

Table of Contents

Robert A. Frist, Jr., one of our co-founders, has served as our chief executive officer and chairman of the board of directors since 1990. Mr. Frist is the company’s chief operating decision maker. He graduated with a Bachelor of Science in Business with concentrations in Finance, Economics, and Marketing from Trinity University.

Michael M. Collier joined the Company in August 2011 as vice president and general counsel, began serving as the vice president of business development and general counsel shortly thereafter, was promoted to senior vice president in July 2017, and was promoted to executive vice president, corporate strategy and development in April 2022. As of February 2025, Mr. Collier was promoted to executive vice president, corporate strategy, development, and operations. From August 2011 through the end of 2022, Mr. Collier also served as the Company’s Corporate Secretary. He graduated with both a Bachelor of Arts and Master of Arts in Philosophy and Religion from University of Tennessee-Knoxville and earned a Juris Doctorate (J.D.) from University of California, Berkeley – School of Law.

Michael Sousa joined the Company in October 2004 and served as senior vice president of sales from January 2010 to June 2014. In June 2014, he was promoted to senior vice president of business development. In February 2015, he was named president of HealthStream’s Provider Solutions business segment, while continuing to serve as a senior vice president of the Company. In February 2023, he was promoted to executive vice president, Enterprise Applications. He earned a Bachelor of Science degree from Boston College and a Master of Business Administration from Boston University.

Trisha L. Coady joined the Company in January 2014 and served as associate vice president and subsequently vice president and general manager of clinical development solutions from June 2015 to November 2018. In November 2018, she was promoted to senior vice president and general manager of clinical solutions. As of February 2025, Ms. Coady was promoted to executive vice president, workforce solutions. She earned a Bachelor of Science in Nursing degree from Université de Moncton.

Kevin O’Hara joined the Company in January 2021 as senior vice president and general manager of platform solutions and was promoted in August 2024 to senior vice president of Platform Solutions and Product Strategy. As of February 2025, Mr. O’Hara was promoted to executive vice president, Enterprise Workforce Platform. Prior to joining the Company, he served as chief product officer for Caresyntax for one year and as chief executive officer for Syus, a predecessor entity, for eight years. He earned a Bachelor of Arts in Public Policy Studies and a J.D. from Vanderbilt University.

Scott A. Roberts joined the Company in January 2002 and served as vice president of accounting and finance beginning in January 2015, following service in multiple positions to which he was promoted. Thereafter, Mr. Roberts was appointed as interim chief financial officer in February 2019 and was appointed as chief financial officer and senior vice president of the Company in September 2019. He earned a Bachelor of Business Administration degree from Middle Tennessee State University.

Jeffrey D. Cunningham joined the Company in July 2017 as senior vice president and chief technology officer. Prior to joining the Company, he founded and served as chief technology officer and chief strategy officer for Informatics Corporation of America for twelve years. He earned a Bachelor of Science in Computer Science from University of North Texas.

M. Scott McQuigg joined the Company in January 2019 as senior vice president of hStream solutions and then served as general manager of scheduling solutions. Mr. McQuigg currently serves as senior vice president of digital & network development. Prior to joining the Company, he co-founded and served as chief executive officer for GoNoodle for thirteen years. Before this role, he co-founded and served as chief executive officer of HealthLe

SEC Form 10-K filed by HealthStream Inc.