MEMORANDUM
PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
TO: Beatrice Holloway; James Prentice; Derek Okonkwo; Leonard Cross; Priya Ranganathan; Thomas Kearney; Audrey Sato
FROM: Megan Chu, Calderwood & Harkness LLP
DATE: January 12, 2025
RE: intellectual Property and Data Privacy Diligence Summary — MedVance Health Systems, Inc.
Matter No.: 0478231.0001
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to summarize the findings of our intellectual property ("IP") and data privacy due diligence review of MedVance Health Systems, Inc. ("MedVance" or the "Company"), conducted in connection with the proposed acquisition of the Company (the "Transaction") by Ardent Healthcare Holdings Inc. (the "Purchaser"), a newly formed acquisition vehicle of Ardent Capital Partners III LP ("Ardent Capital"). This memorandum is intended to provide the deal team with a consolidated summary of material findings, identified risk items, and recommended actions for pre-closing resolution and post-closing remediation.
Our review encompassed a comprehensive examination of data room materials, management interviews conducted with senior officers of the Company, third-party vendor agreements, Health Insurance Portability and Accountability Act of 1996 ("HIPAA") compliance documentation, and public registry searches. The scope and methodology of our review are described in further detail in Section II below.
Top-Line Conclusions. Based on our review, we have reached the following principal conclusions:
• MedVance's IP portfolio is modest and primarily brand-oriented. The Company owns three active U.S. trademark registrations, all in good standing. The Company owns no issued U.S. or foreign patents and has no pending patent applications. This posture is consistent with the Company's business as a healthcare services provider rather than a health technology company.
• The Company's IT infrastructure is substantially dependent on a third-party platform license from Vertex Health Technologies Inc. ("Vertex Health Tech"), which provides MedVance's core electronic health records ("EHR") platform, practice management software, patient scheduling system, and revenue cycle management tools. The Master Services Agreement governing this relationship contains a change-of-control provision that will require Vertex Health Tech's consent or waiver in connection with the Transaction, which we flag as a pre-closing action item.
• MedVance's HIPAA compliance posture is current, and the Company has experienced no material data breaches in the past three years (January 2022 through January 2025) that required notification to the U.S. Department of Health and Human Services ("HHS") under applicable breach notification rules. The Company maintains a formal compliance program, an up-to-date Security Risk Assessment, and Business Associate Agreements ("BAAs") with all material vendors handling protected health information ("PHI").
• We have identified certain items warranting further attention or post-closing remediation, as described in detail in Section X of this memorandum. However, none of these items rises to the level of a recommended deal impediment, and we do not believe any item identified herein would reasonably be expected to constitute a Material Adverse Effect (as defined in the Stock Purchase Agreement).
This memorandum should be read in conjunction with the general corporate, regulatory, and litigation diligence memoranda circulated separately by the deal team.
II. Scope and Methodology
Documents and Materials Reviewed
Our diligence review encompassed materials made available in the Company's virtual data room (hosted on Thackeray Solutions, Project "Pinnacle Investors"), organized under the following data room categories:
• IP Registrations and Prosecution Files: Trademark registration certificates, renewal filings, prosecution history, and trademark search reports.
• Licensing Agreements: All inbound and outbound IP license agreements, software-as-a-service ("SaaS") agreements, and technology vendor contracts.
• IT Vendor Contracts: Master services agreements, service level agreements, statements of work, and amendments related to the Company's technology infrastructure.
• Employment and Contractor Agreements: Standard form employment agreements, offer letters, independent contractor agreements, and consulting agreements, with a focus on IP assignment, confidentiality, non-competition, and non-solicitation provisions.
• HIPAA Compliance Documentation: Privacy and security policies and procedures manual, HIPAA training records, Security Risk Assessment reports, breach notification logs, and incident response documentation.
• Business Associate Agreements: BAA inventory and copies of executed BAAs with material vendors and business partners.
• Insurance Policies: Cyber liability insurance policies and related documentation.
• Miscellaneous: Corporate formation and organizational documents (for IP ownership verification), payor contracts containing data handling provisions, and internal memoranda relating to IT and data security matters.
In total, we reviewed approximately 342 documents across these categories. All documents reviewed were indexed against our standard IP and data privacy diligence checklist, and any gaps or missing items were flagged through supplemental diligence requests submitted to Company counsel.
Management Interviews. In addition to our document review, we conducted management interviews with the following Company personnel:
• Angela Moretti, Chief Financial Officer — regarding the financial materiality of technology licensing costs, cyber insurance coverage, and any known or threatened IP or privacy claims.
• Karen Tolliver, Chief Operating Officer — regarding the Company's operational reliance on the Vertex Health Tech platform, IT integration and transition planning considerations, and the Company's data governance framework.
• David Nguyen, Director of Information Technology — regarding the Company's IT infrastructure, systems architecture, disaster recovery planning, and cybersecurity posture.
• Rachel Simmons, HIPAA Privacy Officer and Director of Compliance — regarding the Company's HIPAA compliance program, Security Risk Assessment findings, breach history, and BAA management.
These interviews were conducted via videoconference between December 9 and December 18, 2024. Follow-up questions were submitted in writing and responses were received through the data room.
Public Searches. We conducted the following public searches to confirm and supplement the data room materials:
• U.S. Patent and Trademark Office ("USPTO"): Searches of the Trademark Electronic Search System ("TESS") and the Patent Full-Text and Image Database ("PatFT") for registrations and applications in the name of MedVance Health Systems, Inc. and related entity names.
• Domain Name WHOIS Records: WHOIS lookups for all principal domain names associated with the Company's operations.
• Tennessee Secretary of State: Trade name and assumed name filings for MedVance Health Systems, Inc. and related d/b/a names.
• State Registries — Alabama, Georgia, and Kentucky: Trade name and foreign qualification filings in each state where the Company maintains clinic operations.
• HHS Breach Portal: Search of the HHS Office for Civil Rights Breach Portal (the public database of breaches affecting 500 or more individuals) for any entries associated with MedVance Health Systems, Inc.
Data Room Cut-Off Date
The data room materials reviewed for purposes of this memorandum reflect documents posted through January 8, 2025. Any documents posted after that date have not been reviewed and are not reflected in the findings set forth herein.
III. Intellectual Property — Registered Rights
A. Patents. MedVance owns no issued U.S. patents. Our search of the USPTO PatFT database returned no results for MedVance Health Systems, Inc. as an assignee or applicant. The Company has no pending patent applications with the USPTO or with any foreign patent office.
We also reviewed the data room for any patent assignment agreements from founders, executives, or employees that might reflect past invention activity requiring formal transfer or assignment to the Company. No such agreements were identified, and management confirmed during our interviews that the Company has not historically engaged in patentable invention activity.
Assessment: The absence of a patent portfolio is consistent with MedVance's business as a multi-site healthcare services provider, which relies on third-party technology platforms rather than proprietary technology developed in-house. We do not view the absence of patents as a material gap for purposes of this Transaction.
B. Trademarks. MedVance holds three active U.S. trademark registrations with the USPTO, each registered on the Principal Register. The details of these registrations are summarized below and set forth more fully in Attachment A to this memorandum.
1. MedVance®
• Registration No.: 4,892,317
• International Class: Class 44 (Medical services; healthcare services; medical clinic services)
• Filing Date: March 14, 2014
• Registration Date: November 3, 2015
• Status: Active; Section 8 Declaration of Continued Use and Section 9 Application for Renewal filed and accepted (renewal effective November 3, 2025)
• Next Renewal Deadline: November 3, 2035
2. MedVance Wellness®
• Registration No.: 5,214,608
• International Class: Class 44 (Preventive healthcare services; wellness programs; health screening services)
• Filing Date: June 22, 2016
• Registration Date: May 16, 2017
• Status: Active; Section 8 Declaration of Continued Use filed and accepted
• Next Renewal Deadline: May 16, 2027
3. QuickCare by MedVance®
• Registration No.: 5,987,412
• International Classes: Class 44 (Urgent care medical services; walk-in clinic services) and Class 35 (Online scheduling of medical appointments)
• Filing Date: September 8, 2019
• Registration Date: August 25, 2020
• Status: Active; Section 8 Declaration of Continued Use due between August 25, 2025, and August 25, 2026 (with six-month grace period)
• Next Renewal Deadline: August 25, 2030
All three marks are registered on the Principal Register of the USPTO, which affords the Company nationwide constructive notice of ownership and a presumption of validity. Our review of the USPTO Trademark Trial and Appeal Board ("TTAB") records revealed no pending opposition proceedings, cancellation proceedings, or unresolved office actions with respect to any of the Company's registrations. We also identified no instances of third-party registrations or applications that would appear to present a material likelihood of confusion with the Company's marks.
The Company does not hold any foreign trademark registrations or applications. Management confirmed that the Company's operations are exclusively domestic, with clinic locations limited to Tennessee, Alabama, Georgia, and Kentucky. Accordingly, the absence of foreign trademark protection is consistent with the Company's current operational footprint.
In addition to its federal registrations, MedVance has filed state-level trade name registrations in each state in which it operates. Specifically, trade name filings for "MedVance Health Systems" and related d/b/a names (including "MedVance Wellness" and "QuickCare by MedVance") are on file and in good standing with the Secretaries of State in Tennessee, Alabama, Georgia, and Kentucky. These state filings are consistent with the Company's federal trademark registrations.
Post-Closing Action Item: Depending on the ultimate structure of the Transaction (stock purchase versus asset purchase), the three USPTO trademark registrations will need to be either (i) formally assigned to the Purchaser and recorded with the USPTO Assignment Recordation Branch (in the case of an asset purchase), or (ii) maintained in the name of MedVance Health Systems, Inc. with ownership continuity confirmed through the surviving entity structure (in the case of a stock purchase). We recommend confirming that the Stock Purchase Agreement (the "SPA") contains provisions adequately addressing trademark ownership continuity, assignment recordation, and cooperation obligations of the Seller in connection therewith. As currently drafted, Section 6.14 of the SPA addresses post-closing IP transfer cooperation, which appears adequate for this purpose.
C. Copyrights. MedVance has not registered any copyrights with the U.S. Copyright Office. Our search of the Copyright Office's public records returned no results for MedVance Health Systems, Inc. as a claimant or registrant.
Notwithstanding the absence of formal registrations, the Company claims common-law copyright protection in the following categories of original works of authorship:
• Patient education materials, including printed brochures, digital content, and instructional videos distributed through clinic locations and the Company's website.
• Marketing collateral, including advertising copy, logo designs, and promotional materials.
• Website content, including text, graphic elements, and original photography appearing on the Company's principal websites.
• Internal training manuals and operational procedure guides used by clinical and administrative staff.
We reviewed the Company's standard employee handbook, which includes a work-for-hire provision stating that all works created by employees within the scope of their employment are the property of MedVance Health Systems, Inc. We also reviewed the Company's standard form employment agreement, which contains a present-assignment clause transferring to the Company all right, title, and interest in works and inventions created during the term of employment. The adequacy of these provisions and the coverage rate among employees are discussed further in Section VIII below.
Assessment: While the absence of registered copyrights means the Company cannot pursue statutory damages or attorneys' fees in a copyright infringement action without first registering the relevant works, this is common for healthcare services companies and does not present a material risk. If the Purchaser identifies specific works of particular commercial value post-closing (e.g., proprietary training curricula or patient engagement content), registration with the Copyright Office could be pursued at that time at modest cost.
D. Domain Names
MedVance owns and maintains the following principal domain names, all registered through Marlowe Software as the registrar of record:
We confirmed through WHOIS lookups that all principal domain names are registered in the name of MedVance Health Systems, Inc. (not in the name of any individual officer, employee, or founder). All domains are set to auto-renew, and the registrar account credentials are maintained by the Company's IT department. The domain registrations do not present change-of-control issues, as the domains will remain registered to MedVance Health Systems, Inc. following the Transaction (assuming a stock purchase structure).
Assessment: The Company's domain name portfolio is well-organized and appropriately aligned with its trademark registrations. No issues were identified requiring pre-closing resolution.
E. Trade Secrets and Proprietary Know-How
MedVance does not maintain a formal trade secret registry or catalog identifying specific items of information that the Company considers to be trade secrets under the Tennessee Uniform Trade Secrets Act (Tenn. Code Ann. § 47-25-1701 et seq.) or the federal Defend Trade Secrets Act (18 U.S.C. § 1836 et seq.).
The Company does, however, treat certain categories of proprietary information as confidential business information, including:
• Proprietary clinical operational protocols and workflow documentation developed internally to standardize care delivery across the Company's clinic locations.
• Patient engagement and retention strategies and related analytics.
• Financial and operational performance data at the individual clinic level.
• Vendor pricing and contractual terms.
• Strategic planning documents, including expansion and acquisition target analyses.
Protection of this information relies primarily on (i) confidentiality provisions contained in employee and independent contractor agreements, (ii) confidentiality and non-disclosure obligations in vendor contracts, and (iii) general access controls within the Company's IT environment (role-based access, password policies, etc.). The adequacy of these contractual protections is discussed further in Section VIII below.
Assessment: While the Company's current approach to trade secret protection is not unusual for a business of its size and nature, we recommend as a post-closing remediation item that the Purchaser implement a more formalized trade secret identification and protection program. This would include cataloging key items of proprietary information, implementing appropriate access restrictions and marking protocols, and conducting periodic audits to ensure that reasonable measures to maintain secrecy are in place. Such measures would strengthen the Company's position in the event that enforcement of trade secret rights becomes necessary.
IV. Intellectual Property — Licenses and Third-Party Agreements
A. Vertex Health Technologies Inc. — Master Services Agreement
Key Agreement. The single most significant IP-related contract in the Company's portfolio is the Master Services Agreement ("MSA") between MedVance Health Systems, Inc. and Vertex Health Technologies Inc. ("Vertex Health Tech"), originally dated March 1, 2018, as amended by the First Amendment dated September 15, 2020, and the Second Amendment dated February 1, 2023 (collectively, the "Vertex MSA").
Term. The Vertex MSA has a current term running through March 31, 2028, following the extension effected by the Second Amendment. The agreement includes an auto-renewal provision under which the term will automatically renew for successive two-year periods unless either party provides written notice of non-renewal at least 180 days prior to the end of the then-current term. Early termination is permitted by either party for material breach upon 60 days' written notice and failure to cure within such period, and by MedVance for convenience upon 12 months' prior written notice (subject to payment of an early termination fee equal to 50% of the remaining subscription fees through the end of the then-current term).
Scope. Under the Vertex MSA, Vertex Health Tech provides MedVance with the following core technology services on a SaaS/license basis:
• Electronic Health Records ("EHR") platform (VertexCare EHR, Version 7.x), including clinical documentation, order entry, e-prescribing, and clinical decision support modules.
• Practice management software, including patient demographic management, appointment scheduling, and front-desk workflow tools.
• Patient scheduling system, including the patient-facing online scheduling portal integrated with MedVance's QuickCare by MedVance websites.
• Revenue cycle management tools, including charge capture, claims submission, remittance processing, denial management, and financial reporting modules.
Vertex Health Tech also provides hosting, maintenance, and technical support services under the MSA, as well as periodic software updates and upgrades included in the subscription fee.
Financial Terms. MedVance's current annual subscription fee under the Vertex MSA is approximately $2.85 million, payable in equal monthly installments of $237,500. This figure reflects the volume-based pricing tier applicable to MedVance's current clinic count (22 active clinic locations). The Second Amendment introduced a tiered pricing structure under which the per-clinic monthly fee decreases from $10,795 to $9,900 if MedVance operates 25 or more clinic locations, and further decreases to $9,200 if MedVance operates 30 or more clinic locations. These pricing tiers may be relevant to the Purchaser's post-closing expansion strategy. The annual subscription fee represents approximately 4.7% of the Company's 2024 projected operating expenses, which management characterized as consistent with industry benchmarks for EHR and practice management technology costs.
Change-of-Control Provision. Section 12.3 of the Vertex MSA contains an anti-assignment clause providing that neither party may assign its rights or obligations under the agreement without the prior written consent of the other party, which consent shall not be unreasonably withheld, conditioned, or delayed. Critically, Section 12.3(b) further provides that a "Change of Control" of MedVance (defined to include any transaction or series of related transactions resulting in a change of more than 50% of the voting securities or equity interests of MedVance, or any merger, consolidation, or sale of all or substantially all assets) shall be deemed an assignment requiring Vertex Health Tech's prior written consent.
This provision is directly applicable to the proposed Transaction. We have flagged this item with the deal team and recommend that the Purchaser obtain written consent or waiver from Vertex Health Tech prior to closing. We understand that preliminary discussions with Vertex Health Tech have been initiated by Company management, and that Vertex Health Tech has informally indicated a willingness to consent, subject to confirmation that the existing agreement terms will be honored post-closing. We recommend that a formal consent letter be executed and delivered as a closing condition or deliverable. We note that Section 7.2(g) of the current draft SPA includes Vertex Health Tech's consent as a condition to the Purchaser's obligation to close.
IP Ownership. Section 8.1 of the Vertex MSA confirms that all intellectual property rights in and to the Vertex Health Tech platform, including all software, source code, object code, documentation, and related materials, are and shall remain the sole and exclusive property of Vertex Health Tech. MedVance holds a non-exclusive, non-transferable license to use the platform during the term of the MSA solely for MedVance's internal business purposes. Pursuant to Section 8.2, MedVance retains full ownership of all data inputted into or generated through the platform by MedVance users, including all patient data, financial data, and operational data (collectively, "Customer Data").
Data Portability and Transition. Section 14.2 of the Vertex MSA provides that, upon expiration or termination of the agreement, Vertex Health Tech will (i) provide MedVance with a complete export of all Customer Data in a standard, industry-recognized format (HL7 FHIR or CSV, at MedVance's election), (ii) provide reasonable transition assistance for a period of up to 120 days following the effective date of termination (at Vertex Health Tech's then-current hourly professional services rates), and (iii) delete all Customer Data from Vertex Health Tech's systems within 60 days following completion of the data export, subject to any retention obligations required by applicable law. We note that the 120-day transition assistance period and the professional services rate structure should be evaluated by the Purchaser in the context of any post-closing platform migration planning, as migration to an alternative EHR platform would likely require a substantially longer transition timeline and significant professional services expenditure.
Service Level Agreements. Schedule B to the Vertex MSA sets forth service level commitments, including a platform availability target of 99.7% uptime (measured monthly, excluding scheduled maintenance windows). If Vertex Health Tech fails to meet the uptime target in any given month, MedVance is entitled to service credits equal to 5% of the applicable monthly subscription fee for each 0.1% below the 99.7% target, capped at 25% of the monthly subscription fee. Management reported that Vertex Health Tech has consistently met the uptime target and that MedVance has not claimed service credits in the past 24 months.
Limitation of Liability and Indemnification. Section 10.1 of the Vertex MSA caps Vertex Health Tech's aggregate liability under the agreement at the total fees paid by MedVance in the 12-month period immediately preceding the event giving rise to the claim. This cap does not apply to (i) Vertex Health Tech's indemnification obligations for third-party intellectual property infringement claims, or (ii) Vertex Health Tech's obligations arising from its willful misconduct or gross negligence. Vertex Health Tech's IP indemnification obligation (Section 11.1) provides that Vertex Health Tech will defend, indemnify, and hold harmless MedVance against any third-party claim that the platform, as provided by Vertex Health Tech and used in accordance with the MSA, infringes any U.S. patent, copyright, or trademark. Vertex Health Tech's indemnification obligations in respect of data breaches are limited to breaches caused by Vertex Health Tech's failure to comply with its security obligations under the MSA and the associated BAA.
Assessment. The Vertex MSA is a critical contract for MedVance's ongoing operations. The Company's clinical and administrative workflows are deeply integrated with the Vertex Health Tech platform, and any disruption to this relationship would have a material adverse effect on the Company's business. We recommend that the Purchaser (i) confirm its post-closing relationship strategy with Vertex Health Tech, (ii) ensure that written consent to the change of control is obtained prior to closing, and (iii) evaluate whether any amendments to the Vertex MSA would be desirable in connection with the Transaction (e.g., extended term, enhanced transition assistance provisions, or revised pricing to reflect anticipated growth).
B. Other Software and Technology Licenses
In addition to the Vertex MSA, the Company maintains the following material technology license and subscription agreements:
• Ashbury Holdings Enterprise Agreement: MedVance maintains a Ashbury Holdings Enterprise Agreement (EA No. 74821093) for Ashgrove Software enterprise licenses (E3 tier), Windows operating system licenses, and Azure cloud services. The agreement is on standard commercial terms and does not contain a change-of-control provision that would require Ashbury Holdings's consent to the Transaction. Annual spend is approximately $186,000.
• Ridgeway Coding and Compliance Suite: The Company licenses coding and compliance reference tools from Ridgeway Enterprises (a division of Ridgeline Partners LLC) under a standard subscription agreement. Annual subscription cost is approximately $34,000. No change-of-control restrictions identified.
• Amwell Telehealth Platform: MedVance utilizes Amwell's telehealth platform for virtual visit capabilities offered to patients at select clinic locations. The Amwell services agreement runs through December 31, 2026, and contains standard assignment restrictions (consent required, not to be unreasonably withheld). Annual cost is approximately $72,000. We recommend confirming whether this consent requirement is triggered by the Transaction structure.
• RingCentral Communications: The Company uses RingCentral for unified communications (VoIP telephony and video conferencing) across clinic locations. Standard commercial terms; no change-of-control issues. Annual cost is approximately $58,000.
• Ashgrove Technologies/Drayton Technologies Backup Solutions: Cloud-based data backup services for on-premises network infrastructure. Standard terms; annual cost approximately $24,000.
We did not identify any unusual or non-standard change-of-control provisions in the foregoing agreements (other than the Amwell agreement noted above). We also inquired about the Company's use of open-source software. The Company does not maintain a formal open-source software policy or inventory. Management represented that the Company's use of open-source software is limited to standard, widely used components (e.g., Apache HTTP Server, OpenSSL) employed in the Company's internal web infrastructure and IT tools, and that the Company does not distribute or commercialize any software incorporating open-source components. We do not view the absence of a formal open-source policy as a material risk given the Company's business model, but note it as a potential post-closing housekeeping item for the Purchaser's IT governance framework.
C. Inbound IP Licenses — Summary Table
The following table summarizes all material inbound IP and technology licenses. A complete inventory is provided in Attachment B.
D. Outbound IP Licenses
We confirmed through our document review and management interviews that MedVance does not license its intellectual property to any third parties. The Company has not entered into any IP license agreements, technology transfer agreements, or similar arrangements under which a third party has been granted rights to use the Company's trademarks, copyrights, trade secrets, or other proprietary information.
V. IT Infrastructure and Systems
MedVance operates a primarily cloud-based IT environment, with the Vertex Health Tech platform serving as the backbone of both clinical and administrative operations. All EHR, practice management, patient scheduling, and revenue cycle management functions are hosted by Vertex Health Tech in its SOC 2 Type II-certified data centers. This cloud-centric architecture reduces the Company's on-premises IT footprint and associated infrastructure risk.
The Company does, however, maintain on-premises network infrastructure at its Nashville, Tennessee headquarters and at each of its 22 clinic locations across Tennessee (14 locations), Alabama (3 locations), Georgia (3 locations), and Kentucky (2 locations). On-premises infrastructure at each location typically consists of managed network switches, wireless access points, workstations, printers, medical device interfaces, and local network-attached storage devices used primarily for temporary caching and document scanning workflows. The Nashville headquarters also houses the Company's primary domain controller, Active Directory environment, and file server for administrative documents and financial records.
We note the Company's reliance on the Vertex Health Tech platform as the central element of its IT environment and cross-reference the analysis set forth in Section IV.A above. Any disruption to the Vertex Health Tech relationship, or any failure to obtain Vertex Health Tech's consent to the Transaction, would materially affect the Company's ability to operate.
Legacy Systems. During our management interviews, IT Director David Nguyen identified one legacy application — a standalone appointment reminder system (CallPoint Reminders, version 3.2) that is no longer supported by its developer — that remains in use at three of the Company's older clinic locations in Nashville. Mr. Nguyen indicated that the functionality of this system has been largely superseded by the patient communication module within the Vertex Health Tech platform, and that the Company plans to decommission CallPoint Reminders by mid-2025. We flag this item for the Purchaser's post-closing IT integration planning, as the continued use of unsupported software may present a minor security vulnerability.
Disaster Recovery and Business Continuity. The Company maintains a written Disaster Recovery and Business Continuity Plan ("DR/BCP"), last updated in August 2024. The plan addresses scenarios including natural disasters, cyberattacks, prolonged power outages, and vendor service disruptions. Key elements of the plan include:
• Reliance on Vertex Health Tech's disaster recovery capabilities for the EHR and practice management platform (Vertex Health Tech maintains geographically redundant data centers with failover capability, per the terms of the MSA).
• Daily automated backups of on-premises systems via Ashgrove Technologies/Drayton Technologies cloud backup.
• Documented recovery time objectives ("RTOs") and recovery point objectives ("RPOs") for critical systems.
• Designated crisis management team and escalation protocols.
The Company conducted its most recent disaster recovery test on October 12, 2024, which management reported as successful, with all critical systems restored within the documented RTO targets. We reviewed the summary report from this test and noted no material deficiencies.
Cyber Insurance. MedVance maintains a cyber liability insurance policy with Northbridge Specialty Insurance Company (Policy No. NSI-CYBER-2024-07732), with the following key terms:
• Policy Period: July 1, 2024 — June 30, 2025
• Aggregate Limit: $5,000,000
• Per-Incident Limit: $5,000,000
• Retention (Deductible): $50,000
• Coverage: First-party and third-party cyber liability, including network security liability, privacy liability, regulatory defense and penalty coverage (including HIPAA), breach notification and credit monitoring costs, business interruption, data recovery, and cyber extortion.
We note that the Northbridge cyber policy contains a change-of-control provision (Section IV.G of the policy) providing that the policy will terminate upon a "Change of Control" of the named insured unless the insured provides prior written notice to the carrier and the carrier consents to the continuation of coverage. We recommend that the Purchaser either (i) provide notice to Northbridge and obtain written confirmation that coverage will continue post-closing, or (ii) bind replacement cyber liability coverage effective as of the closing date. This item is referenced in Section X below as a pre-closing action item. We also note the interplay between this cyber policy and the representations and warranties insurance policy (Northbridge, Policy No. NSI-POLI-2025-04418), which is addressed in Section X.C.
VI. Data Privacy and Security — HIPAA Compliance
A. HIPAA Compliance Program Overview
MedVance maintains a formal HIPAA compliance program that addresses the requirements of the HIPAA Privacy Rule (45 C.F.R. Part 160 and Subparts A and E of Part 164), the HIPAA Security Rule (45 C.F.R. Part 160 and Subparts A and C of Part 164), and the HIPAA Breach Notification Rule (45 C.F.R. Part 160 and Subpart D of Part 164), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH Act").
The Company's compliance program is administered under the direction of two designated officers:
• Rachel Simmons, HIPAA Privacy Officer and Director of Compliance — responsible for oversight of Privacy Rule compliance, patient rights requests, breach notification processes, and workforce training.
• David Nguyen, HIPAA Security Officer and Director of Information Technology — responsible for oversight of Security Rule compliance, technical safeguards, risk assessments, and incident response.
The Company maintains a comprehensive HIPAA Policies and Procedures Manual, which was last updated on September 15, 2024. We reviewed this manual and confirmed that it addresses the following key areas:
• Uses and disclosures of PHI, including the minimum necessary standard.
• Individual rights, including the right of access, amendment, accounting of disclosures, and restriction requests.
• Notice of Privacy Practices (current version dated March 1, 2024, posted on the Company's website and provided to patients at initial visits).
• Administrative, physical, and technical safeguards under the Security Rule.
• Policies and procedures for breach identification, risk assessment, notification, and documentation.
• Sanctions policy for workforce member violations.
• Documentation retention requirements.
Workforce HIPAA training is conducted annually, with new-hire training required within 30 days of the employee's start date. We reviewed training completion records for the 2023 and 2024 training cycles and confirmed a completion rate of approximately 97% for the 2024 cycle (with the remaining 3% representing employees on leave of absence who completed training upon return). Training is delivered through an online learning management system and includes knowledge assessment quizzes with a minimum passing score requirement.
B. HIPAA Risk Assessment
The Company completed its most recent Security Risk Assessment ("SRA") on August 22, 2024, which is within the recommended 12-month cycle. The SRA was conducted by the Company's internal IT and compliance teams with the assistance of CyberShield Consulting Group, an independent cybersecurity consulting firm specializing in healthcare IT.
The SRA followed the methodology outlined in the HHS Office for Civil Rights' Security Risk Assessment Tool and NIST Special Publication 800-30 (Guide for Conducting Risk Assessments). The assessment encompassed:
• Identification of all systems and locations where electronic PHI ("ePHI") is created, received, maintained, or transmitted.
• Evaluation of current administrative, physical, and technical safeguards.
• Identification and assessment of reasonably anticipated threats and vulnerabilities.
• Determination of risk levels (low, moderate, or high) for identified risk scenarios.
• Development of a remediation plan with assigned owners and target completion dates.
The SRA identified a total of 14 risk items, categorized as follows:
• Low Risk: 9 items (primarily documentation and policy update items)
• Moderate Risk: 4 items (including need for enhanced endpoint detection capabilities at clinic workstations, update of mobile device management policies, implementation of more granular audit logging for ePHI access, and formalization of the vendor risk management process)
• High Risk: 1 item (related to the absence of multi-factor authentication ("MFA") for remote access to certain on-premises administrative systems at the Nashville headquarters)
With respect to the single high-risk item, management reported that the Company implemented MFA for all remote access to on-premises systems in November 2024, and that this remediation has been completed and documented. The four moderate-risk items have documented remediation plans with target completion dates ranging from January 2025 to April 2025. We recommend that the Purchaser confirm the status of these open remediation items as part of any post-closing compliance integration.
C. Business Associate Agreements
MedVance maintains BAAs with all material vendors and business partners that access, create, receive, maintain, or transmit PHI on behalf of the Company. The Company maintains an internal BAA inventory, which we reviewed and cross-referenced against the vendor lists and contracts in the data room.
The Company's BAA inventory includes a total of 37 executed BAAs covering the following categories of business associates:
• EHR and Technology Platform Provider: Vertex Health Technologies Inc. (BAA executed as an exhibit to the Vertex MSA, updated February 1, 2023, in connection with the Second Amendment).
• Auditors and Consultants with Billing Data Access: Prumvane & Reese LLP (external auditor; BAA dated April 15, 2021).
• Claims Clearinghouse Vendors: Sterling Reach Services Inc. (BAA dated January 10, 2022) and Harborline Technologies (now part of Penrose Holdings; BAA dated March 1, 2020).
• Cloud Hosting and IT Services Providers: Brightmoor Partners LLC (online services data protection addendum incorporating BAA terms), Ashgrove Technologies/Drayton Technologies (BAA dated August 1, 2023).
• Medical Transcription Services: TranscribeMD, Inc. (BAA dated May 12, 2022).
• Document Shredding and Destruction Vendors: Ashford Enterprises (BAA dated November 3, 2021).
• Laboratory and Diagnostic Services Partners: Crestline Holdings (BAA dated June 20, 2020), Kestrel & Co. (BAA dated September 8, 2019).
• Telehealth Platform Provider: Severin Data Systems (BAA dated as part of the services agreement, July 1, 2023).
• Other Service Providers: Including answering services, medical courier services, collection agencies, and health information exchange participants.
We identified the following items requiring attention:
• The BAA with Harborline Technologies (now part of Penrose Holdings) has not been updated since March 2020. Given the Harborline Technologies data breach incident in February 2024 and the subsequent corporate restructuring, we recommend that the Company re-execute or update this BAA to reflect the current entity name, contact information, and any revised security commitments. We note that the Company was not directly affected by the Harborline Technologies data breach, as its claims data was routed through Westmark Systems during the affected period.
• Two BAAs with minor vendors (a medical courier service and a part-time answering service) were identified as having expired terms that had not been formally renewed, although the services continued under the existing terms. We recommend that these BAAs be re-executed to ensure continued compliance.
We have flagged these items in the recommendations section below for post-closing remediation.
D. Breach History
Key Finding: MedVance has experienced no material breaches of unsecured PHI in the past three years (January 2022 through January 2025) that required notification to the Secretary of HHS under 45 C.F.R. § 164.408 (i.e., no breaches affecting 500 or more individuals).
We confirmed this finding through the following steps:
• Review of the Company's internal breach notification log maintained by the Privacy Officer.
• Search of the HHS Breach Portal (the public database maintained by the Office for Civil Rights listing breaches affecting 500 or more individuals). Our search returned no entries for MedVance Health Systems, Inc. or any related entity name.
• Management representations provided during diligence interviews.
The Company's internal breach notification log reflects four (4) minor security incidents during the three-year review period, each involving fewer than 500 individuals. These incidents are summarized as follows:
1. March 2022: A misdirected fax containing PHI for 3 patients was sent to an incorrect recipient. The recipient confirmed destruction of the fax. Risk assessment determined low probability of compromise; individual notification provided as a precautionary measure.
2. August 2022: A laptop belonging to a traveling nurse practitioner was stolen from a vehicle. The laptop was encrypted (full-disk encryption via BitLocker), and the risk assessment determined that the encryption rendered the PHI unsecured, meaning no breach notification was required under the safe harbor provision of 45 C.F.R. § 164.402(2). The incident was documented internally.
3. May 2023: A mailing vendor error resulted in 12 patients receiving explanation of benefits summaries intended for other patients. Individual notification was provided to all 12 affected patients. The incident was documented, and the mailing vendor's processes were reviewed and corrective actions implemented.
4. November 2024: A phishing email was received by an employee who briefly clicked the link before recognizing it as suspicious and reporting it to IT. The Company's endpoint protection system blocked the malicious payload. Investigation determined that no ePHI was accessed or exfiltrated. The incident was documented as a near-miss and additional phishing awareness training was conducted.
All four incidents were managed in accordance with the Company's internal incident response protocols, and none required notification to media outlets (as that obligation applies only to breaches affecting 500 or more individuals in a single state or jurisdiction) or resulted in an investigation by the HHS Office for Civil Rights.
We confirmed that there are no open investigations or enforcement actions by the HHS Office for Civil Rights pertaining to MedVance. Additionally, there are no pending state attorney general data breach investigations or inquiries relating to the Company.