1006-00008 · Crestline Packaging Solutions LLC · Diligence

healthcare-regulatory-diligence-memo.docx DOCUMENT M&A / Corporate

16 / 36 ← → ✕

CALDERWOOD & HARKNESS LLP 425 Lexington Avenue, 31st Floor New York, NY 10017

MEMORANDUM

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

TO: James Prentice, Responsible Partner — Mergers & Acquisitions Practice Group; Crestline Packaging Solutions LLC Deal Team

FROM: Derek Okonkwo, Lead Associate — Mergers & Acquisitions Practice Group; Tiffany Rosenthal, Working Associate — Mergers & Acquisitions Practice Group (with input from Marchand Healthcare Regulatory Advisors, LLC (Anne-Marie Marchand, Engagement Lead))

DATE: May 28, 2025

RE: Healthcare Regulatory Due Diligence — Proposed Acquisition of Lakewood Regional Health Partners, LLC (C&H Matter No. 1006-00008)

Right-click to update Table of Contents

I. EXECUTIVE SUMMARY

This memorandum summarizes the principal healthcare regulatory compliance findings arising from our ongoing due diligence review of Lakewood Regional Health Partners, LLC ("Lakewood" or "LRHP") in connection with the proposed acquisition of substantially all of Lakewood's assets by Crestline Packaging Solutions LLC ("Crestline" or "CPS"). The proposed transaction contemplates a total purchase price of One Hundred Forty Million Dollars ($140,000,000), with a target execution date for the definitive Asset Purchase Agreement ("APA") of June 16, 2025, and an estimated closing date of August 15, 2025.

Lakewood is a multi-site outpatient healthcare provider operating eleven clinic facilities across the states of New York and Pennsylvania. Eight of these facilities are located in New York — in Rochester, Brighton, Henrietta, Syracuse, Utica, Binghamtonhamton, Ithaca, and Albany — and three are located in Pennsylvania — in Scranton, Wilkes-Barre, and Towanda. As of the most recently available data, Lakewood employs approximately 410 full-time equivalent employees, including 38 licensed physicians and 24 nurse practitioners and physician assistants. Lakewood reported trailing twelve-month ("TTM") net revenue of approximately $78,400,000 and TTM Adjusted EBITDA of approximately $16,100,000 as of March 31, 2025. Lakewood was formed in 2014 as a New York limited liability company and is co-managed by Dr. Raymond Alcott, who holds a 60% membership interest, and Dr. Nadia Petrosian, who holds a 40% membership interest and serves as the organization's Medical Director.

Our due diligence review has identified five principal regulatory workstreams that require focused attention in connection with the transaction:

(a) Medicare and Medicaid enrollment and Change of Ownership ("CHOW") filings with the Centers for Medicare & Medicaid Services ("CMS") and applicable state Medicaid agencies;

(b) Compliance with the physician self-referral prohibition commonly known as the Stark Law (42 U.S.C. § 1395nn) and the federal Anti-Kickback Statute ("AKS") (42 U.S.C. § 1320a-7b(b)), particularly with respect to existing physician and mid-level provider compensation arrangements;

(c) Health Insurance Portability and Accountability Act ("HIPAA") and Health Information Technology for Economic and Clinical Health Act ("HITECH Act") covered-entity transition planning, including the novation or replacement of existing business associate agreements;

(d) State licensure requirements, specifically New York Public Health Law Article 28 Diagnostic and Treatment Center operating certificates and Pennsylvania outpatient clinic facility licenses; and

(e) A pending inquiry by the Office of Inspector General ("OIG") of the U.S. Department of Health and Human Services ("HHS") concerning the Syracuse facility, involving allegations of systematic upcoding of evaluation and management services.

Our overall assessment is that Lakewood's regulatory compliance posture is manageable, and the identified issues are of a character and scope that can be adequately addressed through appropriate transaction structuring, APA-level protections, and post-closing remediation efforts. However, we flag two matters as requiring particularly focused attention by the deal team: (i) the pending OIG inquiry at the Syracuse facility, which presents an estimated financial exposure range of $350,000 to $900,000 and requires robust contractual protections in the APA, and (ii) certain physician compensation arrangements that present potential Stark Law and Anti-Kickback Statute compliance concerns and will require restructuring in connection with the transition to Crestline's post-closing employment model. These matters are discussed in detail in Sections III and VII below.

The scope of our review has encompassed the following sources of information: (i) approximately 2,400 documents produced by Lakewood in the virtual data room maintained by Crestline Solutions (Project: "Veltara"), including organizational documents, regulatory filings, provider enrollment records, physician and mid-level provider compensation agreements, HIPAA compliance materials, and government correspondence; (ii) in-person and telephonic interviews with Gretchen Unger, Chief Operating Officer of Lakewood, conducted on May 5, 2025 and May 19, 2025; (iii) publicly available regulatory filings and databases, including the CMS Provider Enrollment, Chain, and Ownership System ("PECOS"), the New York State Department of Health Health Commerce System, and the Pennsylvania Department of Health facility license database; and (iv) extensive consultation with Marchand Healthcare Regulatory Advisors, LLC ("Marchand"), a Washington, D.C.-based healthcare regulatory consulting firm retained by Calderwood & Harkness to advise on federal program enrollment matters, the OIG inquiry, and related federal regulatory issues, with Anne-Marie Marchand serving as the engagement lead.

This memorandum should be read in conjunction with our separate contract diligence memorandum (C&H Matter No. 1006-00008, dated May 23, 2025), our employment and benefits diligence memorandum (in preparation), and the financial diligence report prepared by Granite Peak Advisory Group, LLC (dated May 15, 2025).

II. MEDICARE AND MEDICAID ENROLLMENT

A. Current Enrollment Status — CMS Certification Numbers

Lakewood maintains active Medicare enrollment for each of its eleven clinic facilities. We have verified the enrollment status of each facility through the CMS Provider Enrollment, Chain, and Ownership System (PECOS) and through review of enrollment documentation maintained in the data room. The following table sets forth the CMS Certification Number assigned to each Lakewood facility:

Our verification through PECOS confirms that all eleven CMS Certification Numbers are in active status as of the date of this memorandum. We note that the following facilities have revalidation dates approaching within the next twelve months:

• Syracuse (33-7024): Revalidation due November 30, 2025. Given the pendency of the OIG inquiry (discussed in Section VII below), careful coordination will be required to ensure that the revalidation application does not trigger additional scrutiny or delay.

• Scranton (39-6011): Revalidation due January 15, 2026. This facility's revalidation should be filed under Crestline's ownership following closing.

• Albany (33-7028): Revalidation due March 31, 2026. Similar to Scranton, this facility's revalidation will likely need to be filed post-closing under Crestline's enrollment.

We further confirm that Lakewood participates in Medicare Part B across all eleven facilities and is enrolled as a Medicaid provider in both New York (through the eMedNY system administered by the New York State Department of Health) and Pennsylvania (through the PROMISe™ system administered by the Pennsylvania Department of Human Services). Lakewood does not currently participate in Medicare Part A, which is consistent with its status as an outpatient-only provider organization.

B. Medicare Administrative Contractor

Lakewood's Medicare claims are processed by Keystone MAC Services, LLC ("Keystone MAC"), which serves as the Medicare Administrative Contractor responsible for Lakewood's jurisdictions in both New York and Pennsylvania. Keystone MAC handles claims processing, payment, and provider enrollment functions for CMS in these service areas. All CHOW notifications and CMS-855 enrollment applications for the eleven Lakewood facilities will be submitted through Keystone MAC's designated enrollment processing channels.

It is important to note that Keystone MAC has specific procedural requirements for processing CHOW transactions, including designated intake contacts and required supporting documentation. Marchand has identified the appropriate Keystone MAC enrollment contacts and has confirmed the submission procedures applicable to asset acquisitions of multi-site provider organizations. We will coordinate all CMS enrollment filings through Keystone MAC's CHOW processing unit to ensure consistency and minimize the risk of processing delays across the eleven facilities.

Keystone MAC also plays a role in claims review and audit activities, and we note that any post-closing billing inquiries related to pre-closing claims will need to be addressed in coordination with Keystone MAC. This is particularly relevant in light of the OIG inquiry at the Syracuse facility, as Keystone MAC may have provided claims data to the OIG in connection with that investigation.

C. Change of Ownership — CMS (Form CMS-855A/B)

The proposed asset acquisition will constitute a "change of ownership" ("CHOW") under 42 C.F.R. § 489.18 with respect to each of Lakewood's eleven facilities. Under the applicable CMS regulations, a CHOW occurs when there is a transfer of title and assets of a provider entity, and the regulatory treatment of such a transfer has significant implications for the continuity of Medicare billing authority.

Under 42 C.F.R. § 489.18(c), when a CHOW occurs, the existing provider agreement is automatically assigned to the new owner, provided that the new owner assumes all of the obligations under the existing provider agreement. This automatic assignment is a critical feature of the CHOW process because it preserves the existing CMS Certification Numbers and avoids the need for the acquiring entity to obtain entirely new Medicare certifications. The alternative — new enrollment rather than CHOW — would require Crestline to obtain new CMS Certification Numbers for each facility, which would result in a gap in billing authority during the enrollment processing period and could cause significant revenue disruption.

We strongly recommend that the transaction be structured to qualify as a CHOW under 42 C.F.R. § 489.18, rather than as a new enrollment, in order to preserve the existing CMS Certification Numbers listed above and to avoid gaps in Medicare billing authority. To this end, the APA should be structured such that Crestline assumes the existing Medicare provider agreements for all eleven facilities as part of the purchased assets, and the closing should be conditioned upon, or accompanied by, the timely submission of all required CHOW documentation to CMS through Keystone MAC.

Filing Timeline and Processing Risk. The CMS-855 enrollment applications (Form CMS-855B for each clinic facility) reflecting the change of ownership must be filed with Keystone MAC promptly following execution of the APA. Based on our experience and Marchand's guidance, we recommend that the CMS-855 applications be prepared in advance of APA execution so that they can be filed within five business days following the June 16, 2025 target execution date — i.e., no later than June 23, 2025.

CMS typically processes CHOW applications within 60 to 90 days of receipt, although processing times can vary based on the volume of pending applications, the completeness of the submission, and the complexity of the ownership structure. Given the August 15, 2025 estimated closing date, there is a meaningful risk that CMS will not have completed processing of all eleven CHOW applications prior to closing. This risk is heightened by the complexity of Crestline's ownership structure (discussed in Section V.C below in the context of NY DOH passive parent entity disclosure) and the number of facilities involved.

To mitigate this risk, we recommend that the APA include one or more of the following provisions:

(i) A condition precedent to closing requiring that CMS have acknowledged receipt and initiated processing of all eleven CMS-855 CHOW applications, with no indication from CMS or Keystone MAC that any application will be denied or that additional information is required that cannot reasonably be provided prior to closing;

(ii) An interim billing arrangement, pursuant to which Sellers agree that, in the event CMS has not completed processing of all CHOW applications by the closing date, Sellers will continue to bill Medicare and Medicaid on behalf of the acquired facilities for a transitional period (not to exceed 90 days following closing) under existing provider numbers, with all collections remitted to Crestline, subject to appropriate accounting and reconciliation procedures; and

(iii) A covenant requiring Sellers to cooperate fully with Crestline and Keystone MAC in the CHOW enrollment process, including responding promptly to any requests for additional information from CMS.

National Provider Identifiers. In addition to the CMS-855 CHOW filings, the transaction will require attention to National Provider Identifier ("NPI") assignments. Lakewood currently holds a Type 2 (organizational) NPI for each clinic facility. Upon closing, Crestline will need to either obtain new Type 2 NPIs for the acquired facilities or arrange for the reassignment of Lakewood's existing organizational NPIs. CMS guidance permits the reassignment of organizational NPIs in connection with a CHOW, and we recommend this approach to maintain continuity with payors.

With respect to individual providers, each of the 38 physicians and 24 NPs/PAs holds a Type 1 (individual) NPI that is not affected by the change of ownership. However, these individual NPIs will need to be reassigned to Crestline as the billing entity in the CMS enrollment system, and corresponding updates will need to be made with each commercial payor.

D. Medicaid Enrollment — New York and Pennsylvania

New York. In addition to the CMS CHOW filings, the eight New York facilities will require updated Medicaid provider enrollment with the New York State Department of Health ("NY DOH") Medicaid program. Lakewood's current Medicaid enrollment is maintained through the eMedNY electronic claims processing system. Upon closing, Crestline will need to submit updated Medicaid provider enrollment forms reflecting the change in ownership for each of the eight New York facilities. The eMedNY system requires submission of provider enrollment change forms, updated organizational information, and verification of the new operating entity's authority to participate in the New York Medicaid program. We note that NY DOH Medicaid enrollment is closely linked to the Article 28 operating certificate status discussed in Section V below, and the Medicaid enrollment changes cannot be finalized until the Article 28 change-of-ownership approval has been obtained.

Pennsylvania. The three Pennsylvania facilities (Scranton, Wilkes-Barre, and Towanda) will require analogous re-enrollment with the Pennsylvania Department of Human Services ("PA DHS") Medicaid program, which is administered through the PROMISe™ system. Upon closing, Crestline will need to submit new or updated provider enrollment applications for each Pennsylvania facility, reflecting Crestline as the new operating entity. Pennsylvania's Medicaid enrollment process is generally less complex than New York's and does not require a separate certificate of need or establishment action prior to enrollment; however, enrollment changes cannot take effect retroactively and must be coordinated with the facility license transfer discussed in Section VI below.

We recommend that Medicaid re-enrollment applications for both New York and Pennsylvania be prepared and submitted concurrently with the CMS-855 CHOW applications and the state licensure applications, to the extent practicable, in order to minimize any gaps in Medicaid billing authority.

III. STARK LAW AND ANTI-KICKBACK STATUTE COMPLIANCE

A. Overview of Applicable Law

The Stark Law, codified at 42 U.S.C. § 1395nn, generally prohibits a physician from making referrals for certain "designated health services" ("DHS") payable by Medicare to an entity with which the physician (or an immediate family member) has a financial relationship, unless the arrangement satisfies one of the statute's enumerated exceptions. DHS includes, among other categories, clinical laboratory services, physical therapy services, radiology and certain other imaging services, and outpatient prescription drugs — categories that are relevant to Lakewood's operations. The Stark Law is a strict liability statute, meaning that a violation does not require proof of intent to violate the law. Violations of the Stark Law can result in denial or refund of claims, civil monetary penalties of up to $15,000 per service, and exclusion from federal healthcare programs. Claims submitted in violation of the Stark Law may also give rise to liability under the federal False Claims Act, 31 U.S.C. § 3729 et seq.

The federal Anti-Kickback Statute, codified at 42 U.S.C. § 1320a-7b(b), makes it a criminal offense to knowingly and willfully offer, pay, solicit, or receive any remuneration to induce or reward the referral of items or services payable by a federal healthcare program, or the purchasing, leasing, or ordering of any item or service payable by a federal healthcare program. Unlike the Stark Law, the AKS requires proof of intent (i.e., that the remuneration was offered, paid, solicited, or received "knowingly and willfully"). The OIG has established a series of regulatory "safe harbors" (42 C.F.R. § 1001.952) that, if fully satisfied, provide protection from prosecution under the AKS. Failure to satisfy a safe harbor does not necessarily mean that an arrangement violates the AKS, but it does mean that the arrangement must be evaluated on its facts and circumstances. Violations of the AKS can result in criminal penalties (fines and imprisonment), civil monetary penalties, treble damages under the False Claims Act, and exclusion from federal healthcare programs. Notably, under the 2010 Affordable Care Act amendments, a claim submitted in connection with an AKS violation is deemed a false claim for purposes of the False Claims Act.

Both the Stark Law and the AKS are particularly relevant to Lakewood's operations given that Lakewood is a multi-site outpatient provider organization that bills Medicare and Medicaid for DHS and that maintains numerous financial relationships with referring physicians.

B. Existing Physician Compensation Arrangements

Ownership Compensation — Dr. Alcott and Dr. Petrosian. Lakewood's two co-managing members, Dr. Raymond Alcott and Dr. Nadia Petrosian, hold direct equity interests in Lakewood — 60% and 40%, respectively. Both physicians are actively practicing at Lakewood facilities and make referrals for DHS that are billed by Lakewood to Medicare and Medicaid. Both physicians receive compensation through distributions based on Lakewood's net income, which constitutes a financial relationship with the entity to which they refer for DHS.

This ownership-based compensation structure requires careful analysis under the Stark Law. The most commonly applicable exception for physician-owned outpatient practices is the "in-office ancillary services" exception (42 C.F.R. § 411.355(b)), which permits referrals for DHS furnished in the same building as the referring physician's office, or in another building used by the physician's group practice, provided certain conditions are met, including that the services are billed by the group practice. Additionally, the "physician services" exception (42 C.F.R. § 411.355(a)) may apply to certain services personally performed by the referring physician. These exceptions are subject to detailed requirements, including the "group practice" definition set forth in 42 C.F.R. § 411.352, which imposes specific requirements regarding the distribution of income and compensation to group physicians.

Under the AKS, the ownership interests held by Dr. Alcott and Dr. Petrosian must be analyzed under the investment interest safe harbor for small entity investments (42 C.F.R. § 1001.952(a)(2)), if applicable, or under the personal services and management contracts safe harbor (42 C.F.R. § 1001.952(d)). We note that Lakewood does not appear to qualify for the small entity investment safe harbor because the entity has more than $2,000,000 in undivided ownership interests.

Our review of the data room documentation indicates that, while Lakewood has generally operated in a manner consistent with the in-office ancillary services exception and the physician services exception, there are documentation deficiencies that create compliance risk. Specifically, we have not been able to confirm from the available documentation that Lakewood satisfies all elements of the "group practice" definition under 42 C.F.R. § 411.352, including the requirement that substantially all of the services of each physician member be furnished through the group practice. We recommend that the deal team obtain additional documentation from Sellers to confirm compliance with the group practice definition.

Other Physician and Mid-Level Provider Arrangements. In addition to the ownership interests of Dr. Alcott and Dr. Petrosian, Lakewood maintains compensation arrangements with 38 physicians and 24 nurse practitioners and physician assistants. Based on our review of the data room documentation, these arrangements fall into the following categories:

(i) Employment Agreements: Approximately 28 of the 38 physicians and all 24 NPs/PAs are compensated under written employment agreements. Our review of a sample of these agreements (approximately 15 physician employment agreements and 10 NP/PA employment agreements) indicates that the agreements generally contain the terms necessary to satisfy the Stark Law employment exception (42 C.F.R. § 411.357(c)) and the AKS employment safe harbor (42 C.F.R. § 1001.952(i)). However, we identified several employment agreements in which the compensation formula includes a productivity bonus component that is calculated, in whole or in part, based on the volume of referrals generated by the physician, rather than solely on personally performed services. Such arrangements require further analysis to confirm that the productivity bonus does not take into account the volume or value of referrals in a manner that would fail to satisfy the Stark employment exception or the AKS employment safe harbor.

(ii) Independent Contractor Agreements: Approximately seven of the 38 physicians are engaged under independent contractor agreements. Our review indicates that at least three of these agreements have expired by their terms and are operating on a month-to-month or holdover basis without current written agreements. The absence of a current written agreement is a compliance concern under both the Stark Law personal services exception (42 C.F.R. § 411.357(d)), which requires a written agreement signed by the parties, and the AKS personal services and management contracts safe harbor (42 C.F.R. § 1001.952(d)), which has a similar writing requirement.

(iii) Medical Directorships and Administrative Services Agreements: Three physicians hold medical directorship or administrative services arrangements in addition to their clinical compensation. Our review of these arrangements has identified concerns regarding whether the compensation paid under these arrangements reflects fair market value for the actual administrative services rendered, or whether the compensation may be viewed as a premium above fair market value that could be characterized as remuneration for referrals in violation of the AKS.

We have requested complete copies of all physician and mid-level provider compensation arrangements from Sellers' counsel, Whitfield, Ames & Greer LLP (Tomás Delgado, Lead Associate), but have not yet received the complete universe of documents. Our preliminary findings set forth in this section are therefore subject to supplementation upon receipt of the outstanding documents.

C. Arrangements Requiring Restructuring Under Crestline Employment Model

Following closing, Crestline intends to convert all existing Lakewood physician and mid-level provider compensation arrangements to the Crestline employment model. This conversion will require the termination of existing arrangements and the execution of new agreements on Crestline's standard terms. The following specific categories of arrangements require particular attention during the restructuring process:

1. Equity-Based Compensation of Dr. Alcott and Dr. Petrosian. Upon closing of the asset acquisition, the equity interests held by Dr. Alcott and Dr. Petrosian in Lakewood will be extinguished, and both physicians will receive their respective portions of the purchase price consideration. Post-closing, both physicians have agreed to provide consulting and transitional services to Crestline pursuant to individual consulting agreements. The proposed terms are as follows:

• Dr. Raymond Alcott: Consulting agreement for a term of two years (through August 15, 2027) at annual compensation of $450,000, for services including clinical oversight, referral source relationship management, and operational transition assistance.

• Dr. Nadia Petrosian: Consulting agreement for a term of two years (through August 15, 2027) at annual compensation of $375,000, for services including medical directorship, clinical quality assurance, and provider credentialing transition support.

These post-closing consulting agreements must be carefully structured to satisfy both the Stark Law personal services exception (42 C.F.R. § 411.357(d)) and the AKS personal services and management contracts safe harbor (42 C.F.R. § 1001.952(d)). To satisfy these requirements, each agreement must: (a) be set forth in a written agreement signed by both parties; (b) specify the services to be provided with sufficient detail; (c) set forth the aggregate compensation to be paid over the term, with such compensation set in advance, consistent with fair market value, and not determined in a manner that takes into account the volume or value of any referrals or business otherwise generated between the parties; and (d) have a term of at least one year.

We recommend that Crestline obtain independent fair market value opinions for the compensation proposed under both consulting agreements prior to execution. We further recommend that the consulting agreements include detailed schedules of duties, time commitments, and deliverables, and that Crestline maintain contemporaneous records of the services actually performed by each physician.

2. Independent Contractor Physician Agreements. As noted above, approximately seven physicians are currently engaged under independent contractor agreements, at least three of which have expired and are operating without current written agreements. All of these arrangements must be either converted to Crestline employment agreements or restructured under new independent contractor agreements that fully comply with the applicable Stark Law exceptions and AKS safe harbors. Given Crestline's preference for an employment model, we anticipate that most or all of these physicians will be offered employment agreements on Crestline's standard terms.

For all post-closing physician compensation arrangements — whether employment or independent contractor — we recommend that Crestline engage an independent valuation firm to provide fair market value opinions. Marchand has recommended Stonebridge Actuarial & Benefits Consulting, Inc., which has significant experience in physician compensation valuation. We concur with this recommendation and suggest that Gregory Faulkner, a senior principal at Stonebridge, be engaged for this purpose. The fair market value opinions should be obtained prior to closing to the extent practicable, or no later than 60 days following closing, to ensure that all post-closing arrangements are defensible from inception.

3. Medical Directorship and Administrative Services Agreements. The three existing medical directorship and administrative services agreements must be reviewed for compliance with the AKS personal services and management contracts safe harbor. As noted above, we have identified potential concerns regarding whether the compensation under these arrangements reflects fair market value for the services actually rendered. These arrangements should be restructured post-closing to ensure that: (a) the compensation is consistent with fair market value; (b) the compensation does not take into account the volume or value of referrals or other business generated; (c) the services to be performed are clearly specified; and (d) the agreements are reduced to writing and signed by both parties. If any of the physicians serving in medical directorship or administrative roles also provide clinical services under separate employment or contractor agreements, the aggregate compensation across all arrangements must be analyzed for fair market value and referral-volume independence.

D. Recommendations for APA Protections

Based on the foregoing analysis, we recommend the following APA-level protections related to Stark Law and Anti-Kickback Statute compliance:

(i) Seller Representations and Warranties. The APA should include specific representations and warranties from Sellers regarding compliance with the Stark Law and the Anti-Kickback Statute. These representations should cover: (a) the existence and terms of all financial relationships between Lakewood and referring physicians; (b) the specific Stark Law exceptions and AKS safe harbors upon which Lakewood relies for each such relationship; (c) confirmation that Lakewood has not received any notice of investigation, audit, or inquiry related to Stark Law or AKS compliance (other than the OIG matter disclosed pursuant to Section VII); and (d) confirmation that Lakewood has not made, nor is aware of any obligation to make, any refunds, disclosures, or repayments related to claims submitted in connection with arrangements that potentially violate the Stark Law or the AKS.

(ii) Seller Disclosure Schedule. The APA should require Sellers to deliver, as a condition to execution, a complete schedule of all physician and mid-level provider compensation arrangements, including all employment agreements, independent contractor agreements, medical directorships, administrative services agreements, and any other arrangements pursuant to which compensation or other remuneration is paid to or received from any physician or mid-level provider who refers or generates business for Lakewood. This schedule should identify the specific Stark Law exception and AKS safe harbor upon which Lakewood relies for each arrangement.

(iii) Indemnification. The APA should provide indemnification coverage for any pre-closing Stark Law or AKS violations, with a survival period coterminous with the applicable statute of limitations. Under the False Claims Act, the statute of limitations for civil enforcement actions is six years from the date of the violation, or three years from the date when the material facts are known or reasonably should have been known by the government official charged with responsibility to act, but in no event more than ten years from the date of the violation. 31 U.S.C. § 3731(b). We recommend that the survival period for Stark/AKS-related representations be set at a minimum of 36 months (through August 15, 2028), consistent with the survival period for Fundamental Representations, though the deal team should consider whether a longer survival period is warranted.

(iv) R&W Insurance Coverage. The representations and warranties insurance policy being placed through Northern Crest Insurance Brokers, LLC (Michael Torrance, Account Executive) with Keystone Mutual Assurance Company ($35,000,000 policy limit; $2,100,000 retention) should be reviewed carefully to confirm that Stark Law and AKS representations are not excluded from coverage. Healthcare regulatory representations are frequently subject to specific exclusions or limitations in R&W policies, and the policy form should be negotiated to provide the broadest available coverage for these matters. To the extent the R&W policy excludes or limits coverage for Stark/AKS matters, the specific indemnity from Sellers becomes correspondingly more important.

IV. HIPAA AND HITECH ACT COMPLIANCE

A. Covered Entity Status

Lakewood qualifies as a "covered entity" under HIPAA, specifically as a "health care provider" that conducts certain standard electronic transactions, including the electronic submission of claims for payment to Medicare, Medicaid, and commercial health plans. 45 C.F.R. § 160.103. As a covered entity, Lakewood is subject to the HIPAA Privacy Rule (45 C.F.R. Part 164, Subpart E), the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C), and the HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D), as modified and strengthened by the HITECH Act (Pub. L. No. 111-5, Title XIII).

Upon closing, the acquired operations will need to be integrated into Crestline's HIPAA compliance framework. The specific structure for this integration — whether Crestline will designate the acquired operations as part of an organized health care arrangement ("OHCA") under 45 C.F.R. § 164.501, as an affiliated covered entity under 45 C.F.R. § 164.105(b), or as a component of a hybrid entity — should be determined in consultation with Crestline's Chief Privacy Officer and outside privacy counsel. The choice of structure will have implications for the scope of Crestline's privacy and security obligations, the permissible uses and disclosures of protected health information ("PHI") across organizational units, and the requirements for internal organizational policies and procedures.

We recommend that the determination of the post-closing HIPAA organizational structure be made as early as practicable, and in any event no later than closing, to facilitate the orderly transition of HIPAA compliance obligations and to avoid any gaps in coverage during the transition period.

B. Business Associate Agreements — Reassignment and Novation

Lakewood, as a covered entity, has entered into business associate agreements ("BAAs") with various third-party service providers that create, receive, maintain, or transmit PHI on Lakewood's behalf. Upon closing, these BAAs must be terminated, assigned, novated, or replaced to reflect Crestline as the covered entity. The following are the key BAAs identified in our review, though a comprehensive inventory of all BAAs has not yet been completed (see Section X, Open Items):

Clearpath Health Systems, Inc. — Clearpath is Lakewood's electronic health record ("EHR") platform provider under License Agreement No. CP-ENT-2022-0487. The license carries an annual fee of $840,000 and has a term extending through December 31, 2027. The existing BAA between Lakewood and Clearpath must be novated or replaced to reflect Crestline as the covered entity. This is particularly important because the EHR system contains the most comprehensive repository of patient PHI across all eleven Lakewood facilities. We note that the Clearpath License Agreement contains an assignment clause that requires Clearpath's prior written consent to any assignment, whether by operation of law or otherwise. Accordingly, Crestline must obtain Clearpath's consent to the assignment of the License Agreement (which is addressed in our separate contract diligence memorandum) and must simultaneously execute a new or novated BAA with Clearpath. We flag that Clearpath may seek to impose additional terms or conditions, or to renegotiate pricing, as a condition to its consent.

Redstone Diagnostics, Inc. — Redstone is a reference laboratory that provides clinical laboratory services to Lakewood facilities. Lakewood's annual spend with Redstone is approximately $1,600,000. Redstone receives PHI in the form of test orders and returns results containing PHI. The existing BAA with Redstone must be reassigned to or replaced by a new BAA naming Crestline as the covered entity. Unlike the Clearpath arrangement, we understand that the Redstone services agreement may not contain an anti-assignment clause, though this remains subject to confirmation.

Keystone MAC Services, LLC — As the Medicare Administrative Contractor, Keystone MAC processes Medicare claims on behalf of Lakewood and necessarily has access to significant volumes of patient information. Keystone MAC operates under CMS-mandated data use agreements and is subject to CMS privacy and security requirements that parallel, and in some cases exceed, HIPAA BAA requirements. We recommend confirming whether Lakewood has a separate BAA with Keystone MAC or whether the CMS data use agreement framework is the operative privacy arrangement.

Other Third-Party Service Providers. Based on our review of the data room materials and our interview with Gretchen Unger, we have identified the following additional categories of third-party service providers that have access to PHI and with whom BAAs are likely in place or should be in place:

• Medical billing and coding services (currently provided by an internal department, but with certain outsourced overflow functions);

• IT managed services and network security (provider not yet identified in the data room);

• Cloud hosting and data storage services for backup and disaster recovery;

• Document shredding and destruction services;

• Transcription services;

• Patient communication and appointment reminder platforms; and

• Collection agencies for patient balance recovery.

We recommend that a comprehensive inventory of all BAAs be compiled as part of the closing checklist and that a transition plan be developed for each BAA, identifying whether the agreement will be assigned, novated, replaced, or terminated. This inventory should be completed no later than 30 days prior to the estimated closing date to allow adequate time for counterparty communications and execution of new or revised agreements.

C. HIPAA Security and Privacy Compliance Posture

We have reviewed the following HIPAA compliance documentation produced by Lakewood in the data room:

(i) HIPAA Privacy and Security Policies and Procedures Manual (last updated March 2023); (ii) HIPAA Security Risk Assessment (conducted October 2021); (iii) Workforce HIPAA training records (2022 and 2023; 2024 records not provided); (iv) Breach Notification Log (covering the period from January 2020 through December 2024); and (v) Notice of Privacy Practices (current version dated January 2022).

Based on our review, we note the following deficiencies in Lakewood's HIPAA compliance posture:

Outdated Risk Assessment. The most recent HIPAA Security Risk Assessment in the data room is dated October 2021, which is more than three and a half years old. While HIPAA does not specify a mandatory frequency for security risk assessments, the Office for Civil Rights ("OCR") of HHS has consistently indicated that risk assessments should be conducted on a regular and ongoing basis, and industry best practice is to conduct a comprehensive risk assessment at least annually. The 2021 assessment predates several material changes in Lakewood's operations and technology environment, including the deployment of an updated EHR module in 2023 and the opening of the Towanda, Pennsylvania facility in late 2022. The absence of a current risk assessment is a significant compliance gap and could be a point of vulnerability in the event of an OCR investigation.

Gaps in Workforce Training Documentation. The data room contains workforce HIPAA training records for 2022 and 2023 but does not contain training records for 2024 or 2025. We have requested these records from Sellers and have been informed by Ms. Unger that training was conducted in 2024 but that the documentation has not been compiled for production. HIPAA requires covered entities to provide training to all workforce members regarding the entity's privacy and security policies and procedures, and to maintain documentation of such training. The absence of documented training records for the most recent periods creates compliance risk.

Absence of Documented Incident Response Plan. While the Breach Notification Log appears to be maintained in an organized fashion and reflects a total of three minor breaches over the five-year period reviewed (all of which appear to have been reported to affected individuals within the required timeframes), we did not identify a formal, written incident response plan in the data room. A documented incident response plan is an important component of a HIPAA compliance program and should address the procedures for identifying, investigating, and mitigating security incidents, as well as the process for determining whether a reportable breach has occurred.

Policy Manual Currency. The HIPAA Privacy and Security Policies and Procedures Manual was last updated in March 2023. While not critically outdated, this manual should be reviewed and updated to reflect current regulatory requirements, including any changes resulting from the 2024 HIPAA Security Rule NPRM, and should be aligned with Crestline's corporate HIPAA policies following closing.

We recommend that the APA include a pre-closing covenant requiring Sellers to commission and deliver an updated HIPAA Security Risk Assessment prior to closing. This assessment should be conducted by a qualified independent firm and should cover all eleven Lakewood facilities and all systems that create, receive, maintain, or transmit PHI. The updated risk assessment will serve as a baseline for Crestline's post-closing integration of the Lakewood operations into its corporate HIPAA compliance framework and will help identify any critical vulnerabilities that should be remediated promptly following closing.

D. Data Transition and PHI Handling

The handling of PHI during the transaction process and at closing requires careful attention to HIPAA requirements. We address below the key considerations for each phase of the transaction:

Due Diligence Phase. During the due diligence phase, access to PHI has been limited in accordance with the HIPAA Privacy Rule's minimum necessary standard and the terms of the Confidentiality Agreement executed between the parties. The data room has been configured with access controls that restrict access to patient-level data, and where patient information has been provided (e.g., for purposes of claims analysis and coding review), it has been provided in de-identified or limited dataset format to the extent practicable. Where access to identifiable PHI has been necessary (e.g., in connection with the review of the OIG inquiry at the Syracuse facility), such access has been limited to individuals who have signed the requisite confidentiality agreements and who have a need to review such information in connection with the transaction.

Closing and Post-Closing Data Migration. At closing, Crestline will assume responsibility for the PHI maintained by the Lakewood facilities as part of the acquired assets. The data migration plan should address the following: (i) secure transfer of electronic PHI from Lakewood's systems to Crestline's systems, including data stored in the Clearpath EHR platform and any other systems containing PHI; (ii) transfer or secure disposition of paper-based medical records; (iii) retention obligations for medical records under applicable state law (New York requires retention of adult patient records for at least six years from the date of last treatment; Pennsylvania requires retention for at least seven years for adult patients); and (iv) any patient notification requirements under state law arising from the change in ownership of the provider entity.

With respect to patient notification, we note that neither HIPAA nor New York or Pennsylvania law specifically requires patient notification in connection with a change of ownership of a healthcare provider, provided that the acquiring entity continues to maintain the privacy and security of PHI in accordance with applicable law. However, best practice suggests that Crestline issue a notice to patients of the affected facilities informing them of the change in ownership and providing updated Notice of Privacy Practices reflecting Crestline's policies. We recommend that this notice be distributed within 60 days following closing.

V. NEW YORK STATE LICENSURE — ARTICLE 28 DIAGNOSTIC AND TREATMENT CENTER LICENSES

A. Current License Status

Lakewood operates eight outpatient clinic facilities in the State of New York under Diagnostic and Treatment Center ("D&TC") operating certificates issued by the New York State Department of Health ("NY DOH") pursuant to New York Public Health Law Article 28 and 10 NYCRR Part 600 et seq. The following table sets forth the operating certificate number for each New York facility:

We have confirmed through the NY DOH Health Commerce System that all eight operating certificates are currently in active status. We note the following with respect to expiration, renewal, and enforcement actions:

• The Rochester Main (D&TC-4821), Brighton (D&TC-4822), and Henrietta (D&TC-4823) operating certificates were most recently renewed in 2023 and are current through their respective renewal dates.

• The Syracuse (D&TC-4824) operating certificate is current but is subject to the pending OIG inquiry discussed in Section VII below. While the OIG inquiry is a federal matter, any adverse finding or sanction resulting from the inquiry could have implications for the facility's state licensure, including potential referral to NY DOH for state enforcement action. We are not aware of any current NY DOH enforcement action or condition on the Syracuse operating certificate related to the OIG inquiry, but we recommend monitoring this situation closely.

• The remaining operating certificates (Utica, Binghamtonhamton, Ithaca, and Albany) are current with no pending enforcement actions or conditions on licensure, based on our review of available records and our interview with Ms. Unger.

B. NY DOH Change-of-Ownership Approval

Under New York Public Health Law Article 28 and the implementing regulations at 10 NYCRR Part 600, a change in the "operator" of a Diagnostic and Treatment Center requires prior written approval from the NY DOH through its Public Health and Health Planning Council ("PHHPC"). This requirement applies regardless of whether the transaction is structured as an asset purchase or a change in ownership interests, because the concept of "operator" under Article 28 focuses on the entity that exercises operational control over the licensed facility.

The proposed acquisition by Crestline constitutes a change of operator under Article 28, and Crestline must obtain PHHPC approval prior to assuming operational control of the eight New York facilities. The approval process involves the following steps:

(a) Certificate of Need Application. Crestline must submit a Certificate of Need ("CON") application to the NY DOH for an "establishment action" — specifically, a change in the ownership and operation of the eight D&TC facilities. The CON application will be reviewed by the NY DOH Bureau of Project Management and the PHHPC to determine whether the proposed change is consistent with the public interest and whether the acquiring entity satisfies the applicable requirements for licensure.

(b) Character and Competence Review. The PHHPC will conduct a character and competence review of the acquiring entity and its principals. This review examines the professional qualifications, experience, and regulatory compliance history of the individuals who will exercise control over the licensed facilities. For this purpose, all "controlling persons" — defined to include individuals and entities with a 10% or greater direct or indirect ownership or control interest — must submit detailed character and competence questionnaires, including disclosure of any prior licensure denials, revocations, or disciplinary actions, any criminal convictions, and any pending or prior government investigations.

(c) Financial Feasibility Review. The NY DOH will review the financial feasibility of the proposed acquisition, including the acquiring entity's financial capacity to operate the facilities in compliance with applicable standards. This review will include examination of Crestline's financial statements, the terms of the acquisition financing, and the projected financial performance of the acquired facilities.

Filing Deadline. We recommend that the CON application be filed with the NY DOH no later than June 26, 2025, which is ten business days following the target APA execution date of June 16, 2025. This timeline is necessary to maximize the likelihood of obtaining PHHPC approval (or at minimum, contingent approval) as close to the August 15, 2025 estimated closing date as practicable.

Required Submission Materials. The CON application submission will include the following materials, among others:

• Completed CON application form (Schedule 1: Establishment Actions);

• Disclosure of ownership and control, identifying all persons and entities with a 10% or greater direct or indirect ownership interest in the applicant entity (Crestline) and each entity in the ownership chain up to and including the ultimate parent;

• Organizational documents for Crestline, CPS Holdings, Inc., Pinnacle River Capital Partners, LP, and Pinnacle River GP IV, LLC;

• Audited financial statements for Crestline and its parent entities;

• Character and competence questionnaires for all controlling persons, including officers, directors, and managing members of each entity in the ownership chain;

• Pro forma financial projections for the acquired operations; and

• A narrative description of the proposed transaction, the acquiring entity's operational plans, and the anticipated impact on services and staffing at the affected facilities.

Processing Timeline and Closing Risk. The typical NY DOH processing timeline for Article 28 change-of-ownership applications is three to six months, and in some cases longer, depending on the complexity of the application and the PHHPC meeting schedule. Given the August 15, 2025 estimated closing date, it is unlikely that full PHHPC approval will be obtained prior to closing. However, it may be possible to obtain contingent approval or "approval with conditions" on an expedited basis, depending on the completeness of the application and the responsiveness of NY DOH staff.

We recommend the following approach to address the NY DOH approval timeline:

(i) APA Condition Precedent. The APA should include NY DOH Article 28 change-of-ownership approval as a condition precedent to closing. Alternatively, if the parties determine that a hard condition precedent is impracticable given the timeline, the APA should provide for a mechanism to operate under an interim management agreement pending final PHHPC approval.

(ii) Interim Management Agreement. If PHHPC approval has not been obtained by the estimated closing date, the parties may consider entering into an interim management agreement pursuant to which Crestline would manage the day-to-day operations of the eight New York facilities on behalf of Lakewood, pending receipt of final approval. This structure would allow Crestline to begin integrating the operations while preserving Lakewood's status as the licensed operator during the interim period. Any interim management agreement must be carefully structured to comply with Article 28 requirements and should be reviewed by the NY DOH prior to implementation.

(iii) Extension Right. The APA should include a provision permitting either party to extend the outside closing date by a specified period (e.g., 90 days) if NY DOH approval has not been obtained by the initial estimated closing date, provided that the application is pending and no indication of denial has been received.

C. Passive Parent Entity Disclosure

The NY DOH CON application will require full disclosure of the acquiring entity's ownership chain, from Crestline up through the ultimate parent. Based on organizational documents reviewed in the data room, the ownership chain is as follows:

Lakewood Regional Health Partners, LLC (Target) → acquired by Crestline Packaging Solutions LLC ("CPS") (Acquiring Entity) → wholly owned by CPS Holdings, Inc. (Intermediate Parent) → controlled by Pinnacle River Capital Partners, LP ("Pinnacle River Fund IV") (Ultimate Parent) → managed by Pinnacle River GP IV, LLC (General Partner of Pinnacle River Fund IV).

Pinnacle River Capital Partners, LP is a private equity fund with total committed capital of approximately $2,600,000,000. The involvement of a private equity sponsor as the ultimate parent of the acquiring entity will subject the application to heightened scrutiny under recently tightened NY DOH review standards for private equity-backed healthcare transactions.

In recent years, the NY DOH and PHHPC have adopted an increasingly rigorous posture toward healthcare acquisitions by private equity-backed entities, driven by concerns about the impact of PE ownership on healthcare quality, access, and cost. The PHHPC has, in several recent proceedings, imposed specific conditions on approvals of PE-backed healthcare transactions, including requirements related to staffing levels, service continuity, capital expenditure commitments, and restrictions on management fees, dividends, and related-party transactions.

Marchand Healthcare Regulatory Advisors has provided guidance on the current PHHPC posture and has recommended that the CON application proactively address the PHHPC's likely areas of concern, including:

• A detailed description of Pinnacle River's investment thesis, investment horizon, and track record in healthcare investments;

• A commitment to maintain current staffing levels and service offerings for a specified period following closing;

• Disclosure of the acquisition financing structure, including the proportion of debt financing and any security interests in the assets of the licensed facilities;

• Disclosure of any proposed management fees, advisory fees, or monitoring fees payable to Pinnacle River or its affiliates; and

• A commitment to provide annual financial reports to the NY DOH for a specified period following closing.

We recommend that the CON application narrative be prepared in close coordination with Marchand and that a draft be circulated for review by Crestline's management team and Pinnacle River's compliance function prior to submission.

VI. PENNSYLVANIA STATE LICENSURE — OUTPATIENT CLINIC LICENSES

A. Current License Status

Lakewood operates three outpatient clinic facilities in the Commonwealth of Pennsylvania under facility licenses issued by the Pennsylvania Department of Health ("PA DOH"). The following table sets forth the license number for each Pennsylvania facility:

We have confirmed the current active status of each of these licenses through the PA DOH facility license verification database. None of the three Pennsylvania facilities is subject to any pending enforcement action, condition on licensure, or outstanding deficiency citation, based on our review of available records and our interview with Ms. Unger. The Towanda facility was licensed in 2022, making it the most recently opened of Lakewood's eleven facilities.

B. PA DOH Change-of-Ownership Requirements

Pennsylvania's regulatory framework for outpatient clinic facility licensure is governed by 28 Pa. Code Chapter 51 and applicable facility-specific regulations. Unlike New York, Pennsylvania does not require pre-approval of a change of ownership of a licensed outpatient clinic facility. Rather, Pennsylvania requires prompt notification of the change of ownership and submission of new license applications by the acquiring entity.

Specifically, upon a change of ownership of a licensed health care facility in Pennsylvania, the new owner must submit new facility license applications to the PA DOH, together with updated ownership disclosure forms and proof of professional liability insurance coverage. The PA DOH will review the applications and, upon satisfaction of all applicable requirements, issue new facility licenses to the acquiring entity.

Filing Deadline. Consistent with our recommendation for the NY DOH filing, we recommend that the PA DOH license applications be prepared and filed no later than June 26, 2025 — ten business days following the target APA execution date of June 16, 2025. While Pennsylvania does not impose a strict pre-closing approval requirement, early filing is advisable to ensure that the PA DOH has adequate time to process the applications and issue new licenses on or before the August 15, 2025 estimated closing date.

Required Submission Materials. The PA DOH license application submission will include:

• Completed facility license application forms for each of the three Pennsylvania facilities;

• Updated ownership disclosure forms, identifying Crestline as the new owner and disclosing the full ownership chain;

• Proof of professional liability insurance coverage for the acquired facilities (to be obtained from Ridgeline Specialty Insurance Company or Crestline's existing insurer);

• Evidence of compliance with applicable physical plant and operational requirements; and

• Any additional documentation required by the PA DOH for new license issuance.

The PA DOH processing timeline for outpatient clinic license applications is generally less complex and less time-consuming than the NY DOH Article 28 process. Based on our experience, PA DOH license applications for change-of-ownership transactions can typically be processed within 30 to 60 days, which is well within the timeline to the August 15, 2025 estimated closing date.

We recommend that the APA include, as a closing condition or covenant, receipt of the PA DOH facility licenses for all three Pennsylvania facilities, or, at minimum, evidence that the applications have been filed and accepted by the PA DOH with no indication of denial or material deficiency.

VII. PENDING OIG INQUIRY — SYRACUSE FACILITY (CMS CERTIFICATION NO. 33-7024)

A. Background and Current Status

The Syracuse facility (NY Article 28 Operating Certificate No. D&TC-4824; CMS Certification No. 33-7024) is the subject of a pending inquiry by the Office of Inspector General ("OIG") of the U.S. Department of Health and Human Services. The inquiry relates to allegations of systematic upcoding of evaluation and management ("E/M") services at the Syracuse facility, specifically the allegation that services rendered at the facility were routinely billed under CPT code 99214 (office or other outpatient visit, established patient, moderate complexity) when the documentation supported coding at CPT code 99213 (office or other outpatient visit, established patient, low complexity) or lower.

Based on our review of the data room documentation and our consultation with Marchand, the following is a summary of the timeline and current procedural posture of the inquiry:

• September 12, 2024: Lakewood received a civil investigative demand ("CID") from the OIG's Office of Investigations, requesting production of medical records, billing records, coding worksheets, and related documentation for all E/M services billed under CPT code 99214 at the Syracuse facility during the period from January 1, 202

CALDERWOOD & HARKNESS LLP 425 Lexington Avenue, 31st Floor New York, NY 10017
MEMORANDUM
PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
TO: James Prentice, Responsible Partner — Mergers & Acquisitions Practice Group; Crestline Packaging Solutions LLC Deal Team
FROM: Derek Okonkwo, Lead Associate — Mergers & Acquisitions Practice Group; Tiffany Rosenthal, Working Associate — Mergers & Acquisitions Practice Group (with input from Marchand Healthcare Regulatory Advisors, LLC (Anne-Marie Marchand, Engagement Lead))
DATE: May 28, 2025
RE: Healthcare Regulatory Due Diligence — Proposed Acquisition of Lakewood Regional Health Partners, LLC (C&H Matter No. 1006-00008)
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
This memorandum summarizes the principal healthcare regulatory compliance findings arising from our ongoing due diligence review of Lakewood Regional Health Partners, LLC ("Lakewood" or "LRHP") in connection with the proposed acquisition of substantially all of Lakewood's assets by Crestline Packaging Solutions LLC ("Crestline" or "CPS"). The proposed transaction contemplates a total purchase price of One Hundred Forty Million Dollars ($140,000,000), with a target execution date for the definitive Asset Purchase Agreement ("APA") of June 16, 2025, and an estimated closing date of August 15, 2025.
Lakewood is a multi-site outpatient healthcare provider operating eleven clinic facilities across the states of New York and Pennsylvania. Eight of these facilities are located in New York — in Rochester, Brighton, Henrietta, Syracuse, Utica, Binghamtonhamton, Ithaca, and Albany — and three are located in Pennsylvania — in Scranton, Wilkes-Barre, and Towanda. As of the most recently available data, Lakewood employs approximately 410 full-time equivalent employees, including 38 licensed physicians and 24 nurse practitioners and physician assistants. Lakewood reported trailing twelve-month ("TTM") net revenue of approximately $78,400,000 and TTM Adjusted EBITDA of approximately $16,100,000 as of March 31, 2025. Lakewood was formed in 2014 as a New York limited liability company and is co-managed by Dr. Raymond Alcott, who holds a 60% membership interest, and Dr. Nadia Petrosian, who holds a 40% membership interest and serves as the organization's Medical Director.
Our due diligence review has identified five principal regulatory workstreams that require focused attention in connection with the transaction:
(a) Medicare and Medicaid enrollment and Change of Ownership ("CHOW") filings with the Centers for Medicare & Medicaid Services ("CMS") and applicable state Medicaid agencies;
(b) Compliance with the physician self-referral prohibition commonly known as the Stark Law (42 U.S.C. § 1395nn) and the federal Anti-Kickback Statute ("AKS") (42 U.S.C. § 1320a-7b(b)), particularly with respect to existing physician and mid-level provider compensation arrangements;
(c) Health Insurance Portability and Accountability Act ("HIPAA") and Health Information Technology for Economic and Clinical Health Act ("HITECH Act") covered-entity transition planning, including the novation or replacement of existing business associate agreements;
(d) State licensure requirements, specifically New York Public Health Law Article 28 Diagnostic and Treatment Center operating certificates and Pennsylvania outpatient clinic facility licenses; and
(e) A pending inquiry by the Office of Inspector General ("OIG") of the U.S. Department of Health and Human Services ("HHS") concerning the Syracuse facility, involving allegations of systematic upcoding of evaluation and management services.
Our overall assessment is that Lakewood's regulatory compliance posture is manageable, and the identified issues are of a character and scope that can be adequately addressed through appropriate transaction structuring, APA-level protections, and post-closing remediation efforts. However, we flag two matters as requiring particularly focused attention by the deal team: (i) the pending OIG inquiry at the Syracuse facility, which presents an estimated financial exposure range of $350,000 to $900,000 and requires robust contractual protections in the APA, and (ii) certain physician compensation arrangements that present potential Stark Law and Anti-Kickback Statute compliance concerns and will require restructuring in connection with the transition to Crestline's post-closing employment model. These matters are discussed in detail in Sections III and VII below.
The scope of our review has encompassed the following sources of information: (i) approximately 2,400 documents produced by Lakewood in the virtual data room maintained by Crestline Solutions (Project: "Veltara"), including organizational documents, regulatory filings, provider enrollment records, physician and mid-level provider compensation agreements, HIPAA compliance materials, and government correspondence; (ii) in-person and telephonic interviews with Gretchen Unger, Chief Operating Officer of Lakewood, conducted on May 5, 2025 and May 19, 2025; (iii) publicly available regulatory filings and databases, including the CMS Provider Enrollment, Chain, and Ownership System ("PECOS"), the New York State Department of Health Health Commerce System, and the Pennsylvania Department of Health facility license database; and (iv) extensive consultation with Marchand Healthcare Regulatory Advisors, LLC ("Marchand"), a Washington, D.C.-based healthcare regulatory consulting firm retained by Calderwood & Harkness to advise on federal program enrollment matters, the OIG inquiry, and related federal regulatory issues, with Anne-Marie Marchand serving as the engagement lead.
This memorandum should be read in conjunction with our separate contract diligence memorandum (C&H Matter No. 1006-00008, dated May 23, 2025), our employment and benefits diligence memorandum (in preparation), and the financial diligence report prepared by Granite Peak Advisory Group, LLC (dated May 15, 2025).
II. MEDICARE AND MEDICAID ENROLLMENT
A. Current Enrollment Status — CMS Certification Numbers
Lakewood maintains active Medicare enrollment for each of its eleven clinic facilities. We have verified the enrollment status of each facility through the CMS Provider Enrollment, Chain, and Ownership System (PECOS) and through review of enrollment documentation maintained in the data room. The following table sets forth the CMS Certification Number assigned to each Lakewood facility:
Our verification through PECOS confirms that all eleven CMS Certification Numbers are in active status as of the date of this memorandum. We note that the following facilities have revalidation dates approaching within the next twelve months:
• Syracuse (33-7024): Revalidation due November 30, 2025. Given the pendency of the OIG inquiry (discussed in Section VII below), careful coordination will be required to ensure that the revalidation application does not trigger additional scrutiny or delay.
• Scranton (39-6011): Revalidation due January 15, 2026. This facility's revalidation should be filed under Crestline's ownership following closing.
• Albany (33-7028): Revalidation due March 31, 2026. Similar to Scranton, this facility's revalidation will likely need to be filed post-closing under Crestline's enrollment.
We further confirm that Lakewood participates in Medicare Part B across all eleven facilities and is enrolled as a Medicaid provider in both New York (through the eMedNY system administered by the New York State Department of Health) and Pennsylvania (through the PROMISe™ system administered by the Pennsylvania Department of Human Services). Lakewood does not currently participate in Medicare Part A, which is consistent with its status as an outpatient-only provider organization.
B. Medicare Administrative Contractor
Lakewood's Medicare claims are processed by Keystone MAC Services, LLC ("Keystone MAC"), which serves as the Medicare Administrative Contractor responsible for Lakewood's jurisdictions in both New York and Pennsylvania. Keystone MAC handles claims processing, payment, and provider enrollment functions for CMS in these service areas. All CHOW notifications and CMS-855 enrollment applications for the eleven Lakewood facilities will be submitted through Keystone MAC's designated enrollment processing channels.
It is important to note that Keystone MAC has specific procedural requirements for processing CHOW transactions, including designated intake contacts and required supporting documentation. Marchand has identified the appropriate Keystone MAC enrollment contacts and has confirmed the submission procedures applicable to asset acquisitions of multi-site provider organizations. We will coordinate all CMS enrollment filings through Keystone MAC's CHOW processing unit to ensure consistency and minimize the risk of processing delays across the eleven facilities.
Keystone MAC also plays a role in claims review and audit activities, and we note that any post-closing billing inquiries related to pre-closing claims will need to be addressed in coordination with Keystone MAC. This is particularly relevant in light of the OIG inquiry at the Syracuse facility, as Keystone MAC may have provided claims data to the OIG in connection with that investigation.
C. Change of Ownership — CMS (Form CMS-855A/B)
The proposed asset acquisition will constitute a "change of ownership" ("CHOW") under 42 C.F.R. § 489.18 with respect to each of Lakewood's eleven facilities. Under the applicable CMS regulations, a CHOW occurs when there is a transfer of title and assets of a provider entity, and the regulatory treatment of such a transfer has significant implications for the continuity of Medicare billing authority.
Under 42 C.F.R. § 489.18(c), when a CHOW occurs, the existing provider agreement is automatically assigned to the new owner, provided that the new owner assumes all of the obligations under the existing provider agreement. This automatic assignment is a critical feature of the CHOW process because it preserves the existing CMS Certification Numbers and avoids the need for the acquiring entity to obtain entirely new Medicare certifications. The alternative — new enrollment rather than CHOW — would require Crestline to obtain new CMS Certification Numbers for each facility, which would result in a gap in billing authority during the enrollment processing period and could cause significant revenue disruption.
We strongly recommend that the transaction be structured to qualify as a CHOW under 42 C.F.R. § 489.18, rather than as a new enrollment, in order to preserve the existing CMS Certification Numbers listed above and to avoid gaps in Medicare billing authority. To this end, the APA should be structured such that Crestline assumes the existing Medicare provider agreements for all eleven facilities as part of the purchased assets, and the closing should be conditioned upon, or accompanied by, the timely submission of all required CHOW documentation to CMS through Keystone MAC.
Filing Timeline and Processing Risk. The CMS-855 enrollment applications (Form CMS-855B for each clinic facility) reflecting the change of ownership must be filed with Keystone MAC promptly following execution of the APA. Based on our experience and Marchand's guidance, we recommend that the CMS-855 applications be prepared in advance of APA execution so that they can be filed within five business days following the June 16, 2025 target execution date — i.e., no later than June 23, 2025.
CMS typically processes CHOW applications within 60 to 90 days of receipt, although processing times can vary based on the volume of pending applications, the completeness of the submission, and the complexity of the ownership structure. Given the August 15, 2025 estimated closing date, there is a meaningful risk that CMS will not have completed processing of all eleven CHOW applications prior to closing. This risk is heightened by the complexity of Crestline's ownership structure (discussed in Section V.C below in the context of NY DOH passive parent entity disclosure) and the number of facilities involved.
To mitigate this risk, we recommend that the APA include one or more of the following provisions:
(i) A condition precedent to closing requiring that CMS have acknowledged receipt and initiated processing of all eleven CMS-855 CHOW applications, with no indication from CMS or Keystone MAC that any application will be denied or that additional information is required that cannot reasonably be provided prior to closing;
(ii) An interim billing arrangement, pursuant to which Sellers agree that, in the event CMS has not completed processing of all CHOW applications by the closing date, Sellers will continue to bill Medicare and Medicaid on behalf of the acquired facilities for a transitional period (not to exceed 90 days following closing) under existing provider numbers, with all collections remitted to Crestline, subject to appropriate accounting and reconciliation procedures; and
(iii) A covenant requiring Sellers to cooperate fully with Crestline and Keystone MAC in the CHOW enrollment process, including responding promptly to any requests for additional information from CMS.
National Provider Identifiers. In addition to the CMS-855 CHOW filings, the transaction will require attention to National Provider Identifier ("NPI") assignments. Lakewood currently holds a Type 2 (organizational) NPI for each clinic facility. Upon closing, Crestline will need to either obtain new Type 2 NPIs for the acquired facilities or arrange for the reassignment of Lakewood's existing organizational NPIs. CMS guidance permits the reassignment of organizational NPIs in connection with a CHOW, and we recommend this approach to maintain continuity with payors.
With respect to individual providers, each of the 38 physicians and 24 NPs/PAs holds a Type 1 (individual) NPI that is not affected by the change of ownership. However, these individual NPIs will need to be reassigned to Crestline as the billing entity in the CMS enrollment system, and corresponding updates will need to be made with each commercial payor.
D. Medicaid Enrollment — New York and Pennsylvania
New York. In addition to the CMS CHOW filings, the eight New York facilities will require updated Medicaid provider enrollment with the New York State Department of Health ("NY DOH") Medicaid program. Lakewood's current Medicaid enrollment is maintained through the eMedNY electronic claims processing system. Upon closing, Crestline will need to submit updated Medicaid provider enrollment forms reflecting the change in ownership for each of the eight New York facilities. The eMedNY system requires submission of provider enrollment change forms, updated organizational information, and verification of the new operating entity's authority to participate in the New York Medicaid program. We note that NY DOH Medicaid enrollment is closely linked to the Article 28 operating certificate status discussed in Section V below, and the Medicaid enrollment changes cannot be finalized until the Article 28 change-of-ownership approval has been obtained.
Pennsylvania. The three Pennsylvania facilities (Scranton, Wilkes-Barre, and Towanda) will require analogous re-enrollment with the Pennsylvania Department of Human Services ("PA DHS") Medicaid program, which is administered through the PROMISe™ system. Upon closing, Crestline will need to submit new or updated provider enrollment applications for each Pennsylvania facility, reflecting Crestline as the new operating entity. Pennsylvania's Medicaid enrollment process is generally less complex than New York's and does not require a separate certificate of need or establishment action prior to enrollment; however, enrollment changes cannot take effect retroactively and must be coordinated with the facility license transfer discussed in Section VI below.
We recommend that Medicaid re-enrollment applications for both New York and Pennsylvania be prepared and submitted concurrently with the CMS-855 CHOW applications and the state licensure applications, to the extent practicable, in order to minimize any gaps in Medicaid billing authority.
III. STARK LAW AND ANTI-KICKBACK STATUTE COMPLIANCE
A. Overview of Applicable Law
The Stark Law, codified at 42 U.S.C. § 1395nn, generally prohibits a physician from making referrals for certain "designated health services" ("DHS") payable by Medicare to an entity with which the physician (or an immediate family member) has a financial relationship, unless the arrangement satisfies one of the statute's enumerated exceptions. DHS includes, among other categories, clinical laboratory services, physical therapy services, radiology and certain other imaging services, and outpatient prescription drugs — categories that are relevant to Lakewood's operations. The Stark Law is a strict liability statute, meaning that a violation does not require proof of intent to violate the law. Violations of the Stark Law can result in denial or refund of claims, civil monetary penalties of up to $15,000 per service, and exclusion from federal healthcare programs. Claims submitted in violation of the Stark Law may also give rise to liability under the federal False Claims Act, 31 U.S.C. § 3729 et seq.
The federal Anti-Kickback Statute, codified at 42 U.S.C. § 1320a-7b(b), makes it a criminal offense to knowingly and willfully offer, pay, solicit, or receive any remuneration to induce or reward the referral of items or services payable by a federal healthcare program, or the purchasing, leasing, or ordering of any item or service payable by a federal healthcare program. Unlike the Stark Law, the AKS requires proof of intent (i.e., that the remuneration was offered, paid, solicited, or received "knowingly and willfully"). The OIG has established a series of regulatory "safe harbors" (42 C.F.R. § 1001.952) that, if fully satisfied, provide protection from prosecution under the AKS. Failure to satisfy a safe harbor does not necessarily mean that an arrangement violates the AKS, but it does mean that the arrangement must be evaluated on its facts and circumstances. Violations of the AKS can result in criminal penalties (fines and imprisonment), civil monetary penalties, treble damages under the False Claims Act, and exclusion from federal healthcare programs. Notably, under the 2010 Affordable Care Act amendments, a claim submitted in connection with an AKS violation is deemed a false claim for purposes of the False Claims Act.
Both the Stark Law and the AKS are particularly relevant to Lakewood's operations given that Lakewood is a multi-site outpatient provider organization that bills Medicare and Medicaid for DHS and that maintains numerous financial relationships with referring physicians.
B. Existing Physician Compensation Arrangements
Ownership Compensation — Dr. Alcott and Dr. Petrosian. Lakewood's two co-managing members, Dr. Raymond Alcott and Dr. Nadia Petrosian, hold direct equity interests in Lakewood — 60% and 40%, respectively. Both physicians are actively practicing at Lakewood facilities and make referrals for DHS that are billed by Lakewood to Medicare and Medicaid. Both physicians receive compensation through distributions based on Lakewood's net income, which constitutes a financial relationship with the entity to which they refer for DHS.
This ownership-based compensation structure requires careful analysis under the Stark Law. The most commonly applicable exception for physician-owned outpatient practices is the "in-office ancillary services" exception (42 C.F.R. § 411.355(b)), which permits referrals for DHS furnished in the same building as the referring physician's office, or in another building used by the physician's group practice, provided certain conditions are met, including that the services are billed by the group practice. Additionally, the "physician services" exception (42 C.F.R. § 411.355(a)) may apply to certain services personally performed by the referring physician. These exceptions are subject to detailed requirements, including the "group practice" definition set forth in 42 C.F.R. § 411.352, which imposes specific requirements regarding the distribution of income and compensation to group physicians.
Under the AKS, the ownership interests held by Dr. Alcott and Dr. Petrosian must be analyzed under the investment interest safe harbor for small entity investments (42 C.F.R. § 1001.952(a)(2)), if applicable, or under the personal services and management contracts safe harbor (42 C.F.R. § 1001.952(d)). We note that Lakewood does not appear to qualify for the small entity investment safe harbor because the entity has more than $2,000,000 in undivided ownership interests.
Our review of the data room documentation indicates that, while Lakewood has generally operated in a manner consistent with the in-office ancillary services exception and the physician services exception, there are documentation deficiencies that create compliance risk. Specifically, we have not been able to confirm from the available documentation that Lakewood satisfies all elements of the "group practice" definition under 42 C.F.R. § 411.352, including the requirement that substantially all of the services of each physician member be furnished through the group practice. We recommend that the deal team obtain additional documentation from Sellers to confirm compliance with the group practice definition.
Other Physician and Mid-Level Provider Arrangements. In addition to the ownership interests of Dr. Alcott and Dr. Petrosian, Lakewood maintains compensation arrangements with 38 physicians and 24 nurse practitioners and physician assistants. Based on our review of the data room documentation, these arrangements fall into the following categories:
(i) Employment Agreements: Approximately 28 of the 38 physicians and all 24 NPs/PAs are compensated under written employment agreements. Our review of a sample of these agreements (approximately 15 physician employment agreements and 10 NP/PA employment agreements) indicates that the agreements generally contain the terms necessary to satisfy the Stark Law employment exception (42 C.F.R. § 411.357(c)) and the AKS employment safe harbor (42 C.F.R. § 1001.952(i)). However, we identified several employment agreements in which the compensation formula includes a productivity bonus component that is calculated, in whole or in part, based on the volume of referrals generated by the physician, rather than solely on personally performed services. Such arrangements require further analysis to confirm that the productivity bonus does not take into account the volume or value of referrals in a manner that would fail to satisfy the Stark employment exception or the AKS employment safe harbor.
(ii) Independent Contractor Agreements: Approximately seven of the 38 physicians are engaged under independent contractor agreements. Our review indicates that at least three of these agreements have expired by their terms and are operating on a month-to-month or holdover basis without current written agreements. The absence of a current written agreement is a compliance concern under both the Stark Law personal services exception (42 C.F.R. § 411.357(d)), which requires a written agreement signed by the parties, and the AKS personal services and management contracts safe harbor (42 C.F.R. § 1001.952(d)), which has a similar writing requirement.
(iii) Medical Directorships and Administrative Services Agreements: Three physicians hold medical directorship or administrative services arrangements in addition to their clinical compensation. Our review of these arrangements has identified concerns regarding whether the compensation paid under these arrangements reflects fair market value for the actual administrative services rendered, or whether the compensation may be viewed as a premium above fair market value that could be characterized as remuneration for referrals in violation of the AKS.
We have requested complete copies of all physician and mid-level provider compensation arrangements from Sellers' counsel, Whitfield, Ames & Greer LLP (Tomás Delgado, Lead Associate), but have not yet received the complete universe of documents. Our preliminary findings set forth in this section are therefore subject to supplementation upon receipt of the outstanding documents.
C. Arrangements Requiring Restructuring Under Crestline Employment Model
Following closing, Crestline intends to convert all existing Lakewood physician and mid-level provider compensation arrangements to the Crestline employment model. This conversion will require the termination of existing arrangements and the execution of new agreements on Crestline's standard terms. The following specific categories of arrangements require particular attention during the restructuring process:
1. Equity-Based Compensation of Dr. Alcott and Dr. Petrosian. Upon closing of the asset acquisition, the equity interests held by Dr. Alcott and Dr. Petrosian in Lakewood will be extinguished, and both physicians will receive their respective portions of the purchase price consideration. Post-closing, both physicians have agreed to provide consulting and transitional services to Crestline pursuant to individual consulting agreements. The proposed terms are as follows:
• Dr. Raymond Alcott: Consulting agreement for a term of two years (through August 15, 2027) at annual compensation of $450,000, for services including clinical oversight, referral source relationship management, and operational transition assistance.
• Dr. Nadia Petrosian: Consulting agreement for a term of two years (through August 15, 2027) at annual compensation of $375,000, for services including medical directorship, clinical quality assurance, and provider credentialing transition support.
These post-closing consulting agreements must be carefully structured to satisfy both the Stark Law personal services exception (42 C.F.R. § 411.357(d)) and the AKS personal services and management contracts safe harbor (42 C.F.R. § 1001.952(d)). To satisfy these requirements, each agreement must: (a) be set forth in a written agreement signed by both parties; (b) specify the services to be provided with sufficient detail; (c) set forth the aggregate compensation to be paid over the term, with such compensation set in advance, consistent with fair market value, and not determined in a manner that takes into account the volume or value of any referrals or business otherwise generated between the parties; and (d) have a term of at least one year.
We recommend that Crestline obtain independent fair market value opinions for the compensation proposed under both consulting agreements prior to execution. We further recommend that the consulting agreements include detailed schedules of duties, time commitments, and deliverables, and that Crestline maintain contemporaneous records of the services actually performed by each physician.
2. Independent Contractor Physician Agreements. As noted above, approximately seven physicians are currently engaged under independent contractor agreements, at least three of which have expired and are operating without current written agreements. All of these arrangements must be either converted to Crestline employment agreements or restructured under new independent contractor agreements that fully comply with the applicable Stark Law exceptions and AKS safe harbors. Given Crestline's preference for an employment model, we anticipate that most or all of these physicians will be offered employment agreements on Crestline's standard terms.
For all post-closing physician compensation arrangements — whether employment or independent contractor — we recommend that Crestline engage an independent valuation firm to provide fair market value opinions. Marchand has recommended Stonebridge Actuarial & Benefits Consulting, Inc., which has significant experience in physician compensation valuation. We concur with this recommendation and suggest that Gregory Faulkner, a senior principal at Stonebridge, be engaged for this purpose. The fair market value opinions should be obtained prior to closing to the extent practicable, or no later than 60 days following closing, to ensure that all post-closing arrangements are defensible from inception.
3. Medical Directorship and Administrative Services Agreements. The three existing medical directorship and administrative services agreements must be reviewed for compliance with the AKS personal services and management contracts safe harbor. As noted above, we have identified potential concerns regarding whether the compensation under these arrangements reflects fair market value for the services actually rendered. These arrangements should be restructured post-closing to ensure that: (a) the compensation is consistent with fair market value; (b) the compensation does not take into account the volume or value of referrals or other business generated; (c) the services to be performed are clearly specified; and (d) the agreements are reduced to writing and signed by both parties. If any of the physicians serving in medical directorship or administrative roles also provide clinical services under separate employment or contractor agreements, the aggregate compensation across all arrangements must be analyzed for fair market value and referral-volume independence.
D. Recommendations for APA Protections
Based on the foregoing analysis, we recommend the following APA-level protections related to Stark Law and Anti-Kickback Statute compliance:
(i) Seller Representations and Warranties. The APA should include specific representations and warranties from Sellers regarding compliance with the Stark Law and the Anti-Kickback Statute. These representations should cover: (a) the existence and terms of all financial relationships between Lakewood and referring physicians; (b) the specific Stark Law exceptions and AKS safe harbors upon which Lakewood relies for each such relationship; (c) confirmation that Lakewood has not received any notice of investigation, audit, or inquiry related to Stark Law or AKS compliance (other than the OIG matter disclosed pursuant to Section VII); and (d) confirmation that Lakewood has not made, nor is aware of any obligation to make, any refunds, disclosures, or repayments related to claims submitted in connection with arrangements that potentially violate the Stark Law or the AKS.
(ii) Seller Disclosure Schedule. The APA should require Sellers to deliver, as a condition to execution, a complete schedule of all physician and mid-level provider compensation arrangements, including all employment agreements, independent contractor agreements, medical directorships, administrative services agreements, and any other arrangements pursuant to which compensation or other remuneration is paid to or received from any physician or mid-level provider who refers or generates business for Lakewood. This schedule should identify the specific Stark Law exception and AKS safe harbor upon which Lakewood relies for each arrangement.
(iii) Indemnification. The APA should provide indemnification coverage for any pre-closing Stark Law or AKS violations, with a survival period coterminous with the applicable statute of limitations. Under the False Claims Act, the statute of limitations for civil enforcement actions is six years from the date of the violation, or three years from the date when the material facts are known or reasonably should have been known by the government official charged with responsibility to act, but in no event more than ten years from the date of the violation. 31 U.S.C. § 3731(b). We recommend that the survival period for Stark/AKS-related representations be set at a minimum of 36 months (through August 15, 2028), consistent with the survival period for Fundamental Representations, though the deal team should consider whether a longer survival period is warranted.
(iv) R&W Insurance Coverage. The representations and warranties insurance policy being placed through Northern Crest Insurance Brokers, LLC (Michael Torrance, Account Executive) with Keystone Mutual Assurance Company ($35,000,000 policy limit; $2,100,000 retention) should be reviewed carefully to confirm that Stark Law and AKS representations are not excluded from coverage. Healthcare regulatory representations are frequently subject to specific exclusions or limitations in R&W policies, and the policy form should be negotiated to provide the broadest available coverage for these matters. To the extent the R&W policy excludes or limits coverage for Stark/AKS matters, the specific indemnity from Sellers becomes correspondingly more important.
IV. HIPAA AND HITECH ACT COMPLIANCE
A. Covered Entity Status
Lakewood qualifies as a "covered entity" under HIPAA, specifically as a "health care provider" that conducts certain standard electronic transactions, including the electronic submission of claims for payment to Medicare, Medicaid, and commercial health plans. 45 C.F.R. § 160.103. As a covered entity, Lakewood is subject to the HIPAA Privacy Rule (45 C.F.R. Part 164, Subpart E), the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C), and the HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D), as modified and strengthened by the HITECH Act (Pub. L. No. 111-5, Title XIII).
Upon closing, the acquired operations will need to be integrated into Crestline's HIPAA compliance framework. The specific structure for this integration — whether Crestline will designate the acquired operations as part of an organized health care arrangement ("OHCA") under 45 C.F.R. § 164.501, as an affiliated covered entity under 45 C.F.R. § 164.105(b), or as a component of a hybrid entity — should be determined in consultation with Crestline's Chief Privacy Officer and outside privacy counsel. The choice of structure will have implications for the scope of Crestline's privacy and security obligations, the permissible uses and disclosures of protected health information ("PHI") across organizational units, and the requirements for internal organizational policies and procedures.
We recommend that the determination of the post-closing HIPAA organizational structure be made as early as practicable, and in any event no later than closing, to facilitate the orderly transition of HIPAA compliance obligations and to avoid any gaps in coverage during the transition period.
B. Business Associate Agreements — Reassignment and Novation
Lakewood, as a covered entity, has entered into business associate agreements ("BAAs") with various third-party service providers that create, receive, maintain, or transmit PHI on Lakewood's behalf. Upon closing, these BAAs must be terminated, assigned, novated, or replaced to reflect Crestline as the covered entity. The following are the key BAAs identified in our review, though a comprehensive inventory of all BAAs has not yet been completed (see Section X, Open Items):
Clearpath Health Systems, Inc. — Clearpath is Lakewood's electronic health record ("EHR") platform provider under License Agreement No. CP-ENT-2022-0487. The license carries an annual fee of $840,000 and has a term extending through December 31, 2027. The existing BAA between Lakewood and Clearpath must be novated or replaced to reflect Crestline as the covered entity. This is particularly important because the EHR system contains the most comprehensive repository of patient PHI across all eleven Lakewood facilities. We note that the Clearpath License Agreement contains an assignment clause that requires Clearpath's prior written consent to any assignment, whether by operation of law or otherwise. Accordingly, Crestline must obtain Clearpath's consent to the assignment of the License Agreement (which is addressed in our separate contract diligence memorandum) and must simultaneously execute a new or novated BAA with Clearpath. We flag that Clearpath may seek to impose additional terms or conditions, or to renegotiate pricing, as a condition to its consent.
Redstone Diagnostics, Inc. — Redstone is a reference laboratory that provides clinical laboratory services to Lakewood facilities. Lakewood's annual spend with Redstone is approximately $1,600,000. Redstone receives PHI in the form of test orders and returns results containing PHI. The existing BAA with Redstone must be reassigned to or replaced by a new BAA naming Crestline as the covered entity. Unlike the Clearpath arrangement, we understand that the Redstone services agreement may not contain an anti-assignment clause, though this remains subject to confirmation.
Keystone MAC Services, LLC — As the Medicare Administrative Contractor, Keystone MAC processes Medicare claims on behalf of Lakewood and necessarily has access to significant volumes of patient information. Keystone MAC operates under CMS-mandated data use agreements and is subject to CMS privacy and security requirements that parallel, and in some cases exceed, HIPAA BAA requirements. We recommend confirming whether Lakewood has a separate BAA with Keystone MAC or whether the CMS data use agreement framework is the operative privacy arrangement.
Other Third-Party Service Providers. Based on our review of the data room materials and our interview with Gretchen Unger, we have identified the following additional categories of third-party service providers that have access to PHI and with whom BAAs are likely in place or should be in place:
• Medical billing and coding services (currently provided by an internal department, but with certain outsourced overflow functions);
• IT managed services and network security (provider not yet identified in the data room);
• Cloud hosting and data storage services for backup and disaster recovery;
• Document shredding and destruction services;
• Transcription services;
• Patient communication and appointment reminder platforms; and
• Collection agencies for patient balance recovery.
We recommend that a comprehensive inventory of all BAAs be compiled as part of the closing checklist and that a transition plan be developed for each BAA, identifying whether the agreement will be assigned, novated, replaced, or terminated. This inventory should be completed no later than 30 days prior to the estimated closing date to allow adequate time for counterparty communications and execution of new or revised agreements.
C. HIPAA Security and Privacy Compliance Posture
We have reviewed the following HIPAA compliance documentation produced by Lakewood in the data room:
(i) HIPAA Privacy and Security Policies and Procedures Manual (last updated March 2023); (ii) HIPAA Security Risk Assessment (conducted October 2021); (iii) Workforce HIPAA training records (2022 and 2023; 2024 records not provided); (iv) Breach Notification Log (covering the period from January 2020 through December 2024); and (v) Notice of Privacy Practices (current version dated January 2022).
Based on our review, we note the following deficiencies in Lakewood's HIPAA compliance posture:
Outdated Risk Assessment. The most recent HIPAA Security Risk Assessment in the data room is dated October 2021, which is more than three and a half years old. While HIPAA does not specify a mandatory frequency for security risk assessments, the Office for Civil Rights ("OCR") of HHS has consistently indicated that risk assessments should be conducted on a regular and ongoing basis, and industry best practice is to conduct a comprehensive risk assessment at least annually. The 2021 assessment predates several material changes in Lakewood's operations and technology environment, including the deployment of an updated EHR module in 2023 and the opening of the Towanda, Pennsylvania facility in late 2022. The absence of a current risk assessment is a significant compliance gap and could be a point of vulnerability in the event of an OCR investigation.
Gaps in Workforce Training Documentation. The data room contains workforce HIPAA training records for 2022 and 2023 but does not contain training records for 2024 or 2025. We have requested these records from Sellers and have been informed by Ms. Unger that training was conducted in 2024 but that the documentation has not been compiled for production. HIPAA requires covered entities to provide training to all workforce members regarding the entity's privacy and security policies and procedures, and to maintain documentation of such training. The absence of documented training records for the most recent periods creates compliance risk.
Absence of Documented Incident Response Plan. While the Breach Notification Log appears to be maintained in an organized fashion and reflects a total of three minor breaches over the five-year period reviewed (all of which appear to have been reported to affected individuals within the required timeframes), we did not identify a formal, written incident response plan in the data room. A documented incident response plan is an important component of a HIPAA compliance program and should address the procedures for identifying, investigating, and mitigating security incidents, as well as the process for determining whether a reportable breach has occurred.
Policy Manual Currency. The HIPAA Privacy and Security Policies and Procedures Manual was last updated in March 2023. While not critically outdated, this manual should be reviewed and updated to reflect current regulatory requirements, including any changes resulting from the 2024 HIPAA Security Rule NPRM, and should be aligned with Crestline's corporate HIPAA policies following closing.
We recommend that the APA include a pre-closing covenant requiring Sellers to commission and deliver an updated HIPAA Security Risk Assessment prior to closing. This assessment should be conducted by a qualified independent firm and should cover all eleven Lakewood facilities and all systems that create, receive, maintain, or transmit PHI. The updated risk assessment will serve as a baseline for Crestline's post-closing integration of the Lakewood operations into its corporate HIPAA compliance framework and will help identify any critical vulnerabilities that should be remediated promptly following closing.
D. Data Transition and PHI Handling
The handling of PHI during the transaction process and at closing requires careful attention to HIPAA requirements. We address below the key considerations for each phase of the transaction:
Due Diligence Phase. During the due diligence phase, access to PHI has been limited in accordance with the HIPAA Privacy Rule's minimum necessary standard and the terms of the Confidentiality Agreement executed between the parties. The data room has been configured with access controls that restrict access to patient-level data, and where patient information has been provided (e.g., for purposes of claims analysis and coding review), it has been provided in de-identified or limited dataset format to the extent practicable. Where access to identifiable PHI has been necessary (e.g., in connection with the review of the OIG inquiry at the Syracuse facility), such access has been limited to individuals who have signed the requisite confidentiality agreements and who have a need to review such information in connection with the transaction.
Closing and Post-Closing Data Migration. At closing, Crestline will assume responsibility for the PHI maintained by the Lakewood facilities as part of the acquired assets. The data migration plan should address the following: (i) secure transfer of electronic PHI from Lakewood's systems to Crestline's systems, including data stored in the Clearpath EHR platform and any other systems containing PHI; (ii) transfer or secure disposition of paper-based medical records; (iii) retention obligations for medical records under applicable state law (New York requires retention of adult patient records for at least six years from the date of last treatment; Pennsylvania requires retention for at least seven years for adult patients); and (iv) any patient notification requirements under state law arising from the change in ownership of the provider entity.
With respect to patient notification, we note that neither HIPAA nor New York or Pennsylvania law specifically requires patient notification in connection with a change of ownership of a healthcare provider, provided that the acquiring entity continues to maintain the privacy and security of PHI in accordance with applicable law. However, best practice suggests that Crestline issue a notice to patients of the affected facilities informing them of the change in ownership and providing updated Notice of Privacy Practices reflecting Crestline's policies. We recommend that this notice be distributed within 60 days following closing.
V. NEW YORK STATE LICENSURE — ARTICLE 28 DIAGNOSTIC AND TREATMENT CENTER LICENSES
A. Current License Status
Lakewood operates eight outpatient clinic facilities in the State of New York under Diagnostic and Treatment Center ("D&TC") operating certificates issued by the New York State Department of Health ("NY DOH") pursuant to New York Public Health Law Article 28 and 10 NYCRR Part 600 et seq. The following table sets forth the operating certificate number for each New York facility:
We have confirmed through the NY DOH Health Commerce System that all eight operating certificates are currently in active status. We note the following with respect to expiration, renewal, and enforcement actions:
• The Rochester Main (D&TC-4821), Brighton (D&TC-4822), and Henrietta (D&TC-4823) operating certificates were most recently renewed in 2023 and are current through their respective renewal dates.
• The Syracuse (D&TC-4824) operating certificate is current but is subject to the pending OIG inquiry discussed in Section VII below. While the OIG inquiry is a federal matter, any adverse finding or sanction resulting from the inquiry could have implications for the facility's state licensure, including potential referral to NY DOH for state enforcement action. We are not aware of any current NY DOH enforcement action or condition on the Syracuse operating certificate related to the OIG inquiry, but we recommend monitoring this situation closely.
• The remaining operating certificates (Utica, Binghamtonhamton, Ithaca, and Albany) are current with no pending enforcement actions or conditions on licensure, based on our review of available records and our interview with Ms. Unger.
B. NY DOH Change-of-Ownership Approval
Under New York Public Health Law Article 28 and the implementing regulations at 10 NYCRR Part 600, a change in the "operator" of a Diagnostic and Treatment Center requires prior written approval from the NY DOH through its Public Health and Health Planning Council ("PHHPC"). This requirement applies regardless of whether the transaction is structured as an asset purchase or a change in ownership interests, because the concept of "operator" under Article 28 focuses on the entity that exercises operational control over the licensed facility.
The proposed acquisition by Crestline constitutes a change of operator under Article 28, and Crestline must obtain PHHPC approval prior to assuming operational control of the eight New York facilities. The approval process involves the following steps:
(a) Certificate of Need Application. Crestline must submit a Certificate of Need ("CON") application to the NY DOH for an "establishment action" — specifically, a change in the ownership and operation of the eight D&TC facilities. The CON application will be reviewed by the NY DOH Bureau of Project Management and the PHHPC to determine whether the proposed change is consistent with the public interest and whether the acquiring entity satisfies the applicable requirements for licensure.
(b) Character and Competence Review. The PHHPC will conduct a character and competence review of the acquiring entity and its principals. This review examines the professional qualifications, experience, and regulatory compliance history of the individuals who will exercise control over the licensed facilities. For this purpose, all "controlling persons" — defined to include individuals and entities with a 10% or greater direct or indirect ownership or control interest — must submit detailed character and competence questionnaires, including disclosure of any prior licensure denials, revocations, or disciplinary actions, any criminal convictions, and any pending or prior government investigations.
(c) Financial Feasibility Review. The NY DOH will review the financial feasibility of the proposed acquisition, including the acquiring entity's financial capacity to operate the facilities in compliance with applicable standards. This review will include examination of Crestline's financial statements, the terms of the acquisition financing, and the projected financial performance of the acquired facilities.
Filing Deadline. We recommend that the CON application be filed with the NY DOH no later than June 26, 2025, which is ten business days following the target APA execution date of June 16, 2025. This timeline is necessary to maximize the likelihood of obtaining PHHPC approval (or at minimum, contingent approval) as close to the August 15, 2025 estimated closing date as practicable.
Required Submission Materials. The CON application submission will include the following materials, among others:
• Completed CON application form (Schedule 1: Establishment Actions);
• Disclosure of ownership and control, identifying all persons and entities with a 10% or greater direct or indirect ownership interest in the applicant entity (Crestline) and each entity in the ownership chain up to and including the ultimate parent;
• Organizational documents for Crestline, CPS Holdings, Inc., Pinnacle River Capital Partners, LP, and Pinnacle River GP IV, LLC;
• Audited financial statements for Crestline and its parent entities;
• Character and competence questionnaires for all controlling persons, including officers, directors, and managing members of each entity in the ownership chain;
• Pro forma financial projections for the acquired operations; and
• A narrative description of the proposed transaction, the acquiring entity's operational plans, and the anticipated impact on services and staffing at the affected facilities.
Processing Timeline and Closing Risk. The typical NY DOH processing timeline for Article 28 change-of-ownership applications is three to six months, and in some cases longer, depending on the complexity of the application and the PHHPC meeting schedule. Given the August 15, 2025 estimated closing date, it is unlikely that full PHHPC approval will be obtained prior to closing. However, it may be possible to obtain contingent approval or "approval with conditions" on an expedited basis, depending on the completeness of the application and the responsiveness of NY DOH staff.
We recommend the following approach to address the NY DOH approval timeline:
(i) APA Condition Precedent. The APA should include NY DOH Article 28 change-of-ownership approval as a condition precedent to closing. Alternatively, if the parties determine that a hard condition precedent is impracticable given the timeline, the APA should provide for a mechanism to operate under an interim management agreement pending final PHHPC approval.
(ii) Interim Management Agreement. If PHHPC approval has not been obtained by the estimated closing date, the parties may consider entering into an interim management agreement pursuant to which Crestline would manage the day-to-day operations of the eight New York facilities on behalf of Lakewood, pending receipt of final approval. This structure would allow Crestline to begin integrating the operations while preserving Lakewood's status as the licensed operator during the interim period. Any interim management agreement must be carefully structured to comply with Article 28 requirements and should be reviewed by the NY DOH prior to implementation.
(iii) Extension Right. The APA should include a provision permitting either party to extend the outside closing date by a specified period (e.g., 90 days) if NY DOH approval has not been obtained by the initial estimated closing date, provided that the application is pending and no indication of denial has been received.
C. Passive Parent Entity Disclosure
The NY DOH CON application will require full disclosure of the acquiring entity's ownership chain, from Crestline up through the ultimate parent. Based on organizational documents reviewed in the data room, the ownership chain is as follows:
Lakewood Regional Health Partners, LLC (Target) → acquired by Crestline Packaging Solutions LLC ("CPS") (Acquiring Entity) → wholly owned by CPS Holdings, Inc. (Intermediate Parent) → controlled by Pinnacle River Capital Partners, LP ("Pinnacle River Fund IV") (Ultimate Parent) → managed by Pinnacle River GP IV, LLC (General Partner of Pinnacle River Fund IV).
Pinnacle River Capital Partners, LP is a private equity fund with total committed capital of approximately $2,600,000,000. The involvement of a private equity sponsor as the ultimate parent of the acquiring entity will subject the application to heightened scrutiny under recently tightened NY DOH review standards for private equity-backed healthcare transactions.
In recent years, the NY DOH and PHHPC have adopted an increasingly rigorous posture toward healthcare acquisitions by private equity-backed entities, driven by concerns about the impact of PE ownership on healthcare quality, access, and cost. The PHHPC has, in several recent proceedings, imposed specific conditions on approvals of PE-backed healthcare transactions, including requirements related to staffing levels, service continuity, capital expenditure commitments, and restrictions on management fees, dividends, and related-party transactions.
Marchand Healthcare Regulatory Advisors has provided guidance on the current PHHPC posture and has recommended that the CON application proactively address the PHHPC's likely areas of concern, including:
• A detailed description of Pinnacle River's investment thesis, investment horizon, and track record in healthcare investments;
• A commitment to maintain current staffing levels and service offerings for a specified period following closing;
• Disclosure of the acquisition financing structure, including the proportion of debt financing and any security interests in the assets of the licensed facilities;
• Disclosure of any proposed management fees, advisory fees, or monitoring fees payable to Pinnacle River or its affiliates; and
• A commitment to provide annual financial reports to the NY DOH for a specified period following closing.
We recommend that the CON application narrative be prepared in close coordination with Marchand and that a draft be circulated for review by Crestline's management team and Pinnacle River's compliance function prior to submission.
VI. PENNSYLVANIA STATE LICENSURE — OUTPATIENT CLINIC LICENSES
A. Current License Status
Lakewood operates three outpatient clinic facilities in the Commonwealth of Pennsylvania under facility licenses issued by the Pennsylvania Department of Health ("PA DOH"). The following table sets forth the license number for each Pennsylvania facility:
We have confirmed the current active status of each of these licenses through the PA DOH facility license verification database. None of the three Pennsylvania facilities is subject to any pending enforcement action, condition on licensure, or outstanding deficiency citation, based on our review of available records and our interview with Ms. Unger. The Towanda facility was licensed in 2022, making it the most recently opened of Lakewood's eleven facilities.
B. PA DOH Change-of-Ownership Requirements
Pennsylvania's regulatory framework for outpatient clinic facility licensure is governed by 28 Pa. Code Chapter 51 and applicable facility-specific regulations. Unlike New York, Pennsylvania does not require pre-approval of a change of ownership of a licensed outpatient clinic facility. Rather, Pennsylvania requires prompt notification of the change of ownership and submission of new license applications by the acquiring entity.
Specifically, upon a change of ownership of a licensed health care facility in Pennsylvania, the new owner must submit new facility license applications to the PA DOH, together with updated ownership disclosure forms and proof of professional liability insurance coverage. The PA DOH will review the applications and, upon satisfaction of all applicable requirements, issue new facility licenses to the acquiring entity.
Filing Deadline. Consistent with our recommendation for the NY DOH filing, we recommend that the PA DOH license applications be prepared and filed no later than June 26, 2025 — ten business days following the target APA execution date of June 16, 2025. While Pennsylvania does not impose a strict pre-closing approval requirement, early filing is advisable to ensure that the PA DOH has adequate time to process the applications and issue new licenses on or before the August 15, 2025 estimated closing date.
Required Submission Materials. The PA DOH license application submission will include:
• Completed facility license application forms for each of the three Pennsylvania facilities;
• Updated ownership disclosure forms, identifying Crestline as the new owner and disclosing the full ownership chain;
• Proof of professional liability insurance coverage for the acquired facilities (to be obtained from Ridgeline Specialty Insurance Company or Crestline's existing insurer);
• Evidence of compliance with applicable physical plant and operational requirements; and
• Any additional documentation required by the PA DOH for new license issuance.
The PA DOH processing timeline for outpatient clinic license applications is generally less complex and less time-consuming than the NY DOH Article 28 process. Based on our experience, PA DOH license applications for change-of-ownership transactions can typically be processed within 30 to 60 days, which is well within the timeline to the August 15, 2025 estimated closing date.
We recommend that the APA include, as a closing condition or covenant, receipt of the PA DOH facility licenses for all three Pennsylvania facilities, or, at minimum, evidence that the applications have been filed and accepted by the PA DOH with no indication of denial or material deficiency.
VII. PENDING OIG INQUIRY — SYRACUSE FACILITY (CMS CERTIFICATION NO. 33-7024)
A. Background and Current Status
The Syracuse facility (NY Article 28 Operating Certificate No. D&TC-4824; CMS Certification No. 33-7024) is the subject of a pending inquiry by the Office of Inspector General ("OIG") of the U.S. Department of Health and Human Services. The inquiry relates to allegations of systematic upcoding of evaluation and management ("E/M") services at the Syracuse facility, specifically the allegation that services rendered at the facility were routinely billed under CPT code 99214 (office or other outpatient visit, established patient, moderate complexity) when the documentation supported coding at CPT code 99213 (office or other outpatient visit, established patient, low complexity) or lower.
Based on our review of the data room documentation and our consultation with Marchand, the following is a summary of the timeline and current procedural posture of the inquiry:
• September 12, 2024: Lakewood received a civil investigative demand ("CID") from the OIG's Office of Investigations, requesting production of medical records, billing records, coding worksheets, and related documentation for all E/M services billed under CPT code 99214 at the Syracuse facility during the period from January 1, 202

CALDERWOOD & HARKNESS LLP 425 Lexington Avenue, 31st Floor New York, NY 10017

MEMORANDUM

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

I. EXECUTIVE SUMMARY

II. MEDICARE AND MEDICAID ENROLLMENT

III. STARK LAW AND ANTI-KICKBACK STATUTE COMPLIANCE

IV. HIPAA AND HITECH ACT COMPLIANCE

Record

Parties

Dates

Amounts