1001-00003 · Client 1001 · Diligence

litigation-regulatory-review-memo.docx DOCUMENT M&A / Corporate

19 / 38 ← → ✕

MEMORANDUM

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

TO: Beatrice Holloway, Responsible Partner, Mergers & Acquisitions, Calderwood & Harkness LLP Priya Mehta-Sullivan, Partner, Head of Healthcare Investments, Ardent Capital Management LLC Connor Briggs, Vice President, Healthcare Deal Team, Ardent Capital Management LLC

FROM: Derek Okonkwo, Lead Associate, Mergers & Acquisitions, Calderwood & Harkness LLP (with assistance from Tiffany Rosenthal, Working Associate)

DATE: March 12, 2024

RE: Litigation and Regulatory Review — Cardinal Peak Industries, Inc. ("Project Cardinal")

MATTER NO.: 2024-M&A-0142

CLIENT: Ardent Capital Partners III LP

This memorandum has been prepared by Calderwood & Harkness LLP at the request of and for the exclusive benefit of Ardent Capital Partners III LP and its affiliates (collectively, "Ardent Capital") in connection with the proposed acquisition of substantially all assets of Cardinal Peak Industries, Inc. This memorandum is protected by the attorney-client privilege and constitutes attorney work product. It should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and Ardent Capital. Nothing in this memorandum constitutes legal advice to any person or entity other than Ardent Capital.

Right-click to update Table of Contents

I. Executive Summary

This memorandum summarizes the findings of our litigation and regulatory compliance review conducted in connection with the proposed $620,000,000 asset purchase of substantially all assets of Cardinal Peak Industries, Inc. ("CPI" or the "Seller") by Ardent Healthcare Acquisition Corp. (the "Acquisition Sub"), a wholly-owned subsidiary of Ardent Capital Partners III LP ("Ardent Capital" or the "Buyer"). The transaction is structured as an asset purchase pursuant to an Asset Purchase Agreement (the "APA") currently under negotiation between the parties. The purpose of this memorandum is to identify, analyze, and assess all material litigation risks and regulatory compliance matters that bear upon the valuation, structuring, and documentation of the proposed acquisition.

Our due diligence review commenced on February 5, 2024, and this memorandum synthesizes our findings through the date of this memorandum, March 12, 2024. The review is ongoing, and supplemental findings will be addressed in subsequent memoranda or updates as warranted.

Scope of Review. The scope of our review encompasses the following categories: (a) all pending and threatened litigation involving CPI; (b) CPI's regulatory compliance history with respect to state healthcare facility licensing, Medicare and Medicaid certifications and enrollment, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and related data privacy requirements, and federal healthcare fraud and abuse statutes; and (c) any enforcement actions, investigations, or sanctions involving CPI or its personnel. This review covers all 37 of CPI's outpatient rehabilitation and behavioral health facilities located across seven states: Tennessee, Georgia, North Carolina, South Carolina, Alabama, Virginia, and Kentucky.

Materials Reviewed. In conducting this review, we examined the following materials, among others:

• CPI's complete litigation docket, as provided by the Seller's outside counsel, Barrow, Kensington & Pratt LLP (contact partners: Catherine "Kit" Barrow and Samuel Otieno);

• CPI management representations and responses to our due diligence request lists, including management's litigation questionnaire responses;

• Documents made available in the electronic data room maintained by Seller's counsel, including corporate records, regulatory filings, compliance program documentation, employment policies and procedures, insurance coverage summaries, patient privacy policies, and related materials;

• State licensing and certification files for all 37 CPI clinic locations;

• State survey and inspection reports for CPI facilities covering the five-year period from 2019 through the present;

• CPI's Medicare provider enrollment records and Medicaid provider agreements across all applicable states;

• CPI's HIPAA compliance program documentation, including breach notification logs and incident reports;

• CPI's insurance program summaries, including general liability, professional liability, employment practices liability, directors and officers, and cyber liability policies; and

• Public records searches, including searches of the HHS Office of Inspector General ("OIG") List of Excluded Individuals/Entities ("LEIE"), the System for Award Management ("SAM") exclusion database, and publicly available court docket records.

Coordination with Healthcare Regulatory Counsel. We have coordinated closely with Hargrove, Sinclair & Demarest LLP (Angela Demarest, Partner, Healthcare Regulatory) on all healthcare regulatory matters, including state licensing, Medicare and Medicaid certifications, federal healthcare fraud and abuse law compliance, and change-of-ownership filing requirements. A separate joint Healthcare Regulatory Compliance Memorandum addressing these matters in greater depth is forthcoming and is currently expected to be delivered on or about March 20, 2024.

Key Findings. Our principal findings are as follows:

1. Material Pending Litigation — Dawson v. Cardinal Peak Industries, Inc. We have identified one material pending litigation matter: Dawson v. Cardinal Peak Industries, Inc., Case No. 3:23-cv-01847 (M.D. Tenn.), a putative class action alleging wage-and-hour violations under the Fair Labor Standards Act ("FLSA"). The Seller's litigation counsel estimates that CPI's potential exposure in this matter ranges from approximately $2.8 million to $5.1 million, inclusive of potential back pay, liquidated damages, and plaintiffs' attorneys' fees. We recommend that this matter be treated as an excluded liability under the APA, with the Seller retaining full responsibility and providing specific indemnification to the Buyer.

2. Other Litigation Matters. Beyond the Dawson matter, we identified only routine, immaterial pending litigation (two minor premises liability claims and one workers' compensation claim) and one threatened wrongful termination claim that CPI management expects to resolve prior to closing. No other material pending or threatened litigation has been identified.

3. Regulatory Compliance Profile. CPI's regulatory compliance profile is generally satisfactory. All 37 clinic locations hold current, active state licenses. CPI maintains active Medicare provider enrollment and Medicaid provider agreements in all applicable states. No material regulatory enforcement actions are currently pending against CPI. Historical survey deficiencies have been minor and were corrected without the imposition of penalties or sanctions. Two minor HIPAA breach incidents were identified and reported to HHS in accordance with applicable regulations; neither incident resulted in any enforcement action or penalty.

4. Overall Assessment. With the implementation of the APA protections recommended in this memorandum — including excluded liability treatment for the Dawson litigation, robust healthcare compliance representations and warranties, the proposed escrow holdback, and the representations and warranties insurance policy — we believe Buyer's litigation and regulatory risk exposure from this acquisition is appropriately mitigated and manageable.

II. Pending Litigation

A. Dawson v. Cardinal Peak Industries, Inc. — Overview

The most significant litigation matter identified in our review is Dawson v. Cardinal Peak Industries, Inc., Case No. 3:23-cv-01847, pending in the United States District Court for the Middle District of Tennessee. The key details of this matter are as follows:

Case Caption: Dawson v. Cardinal Peak Industries, Inc., Case No. 3:23-cv-01847 (M.D. Tenn.)

Court: United States District Court for the Middle District of Tennessee, Nashville Division

Date Filed: The complaint was filed on or about July 18, 2023.

Plaintiff(s): The named plaintiff is Brenda Dawson, a former CPI employee who was employed as a non-exempt, hourly administrative support specialist at CPI's Murfreesboro, Tennessee clinic location. The complaint is brought on behalf of Ms. Dawson and all similarly situated current and former non-exempt hourly employees of CPI.

Defendant: Cardinal Peak Industries, Inc.

Nature of Claims: This is a putative class action alleging wage-and-hour violations under the Fair Labor Standards Act, 29 U.S.C. §§ 201 et seq. The complaint does not assert claims under any state wage-and-hour statutes at this time, although it is possible that such claims could be added by amendment.

Allegations. The complaint alleges, in substance, that CPI engaged in a pattern and practice of failing to properly compensate its non-exempt, hourly employees for all hours worked, in violation of the FLSA's overtime and minimum wage provisions. Specifically, the complaint alleges the following categories of violations:

(a) Off-the-Clock Work. Plaintiffs allege that CPI required non-exempt employees to perform pre-shift and post-shift work — including logging into electronic systems, reviewing patient documentation, and completing administrative tasks — without compensation. The complaint alleges that this uncompensated work regularly amounted to 15 to 30 minutes per shift.

(b) Improper Timekeeping Rounding. Plaintiffs allege that CPI's electronic timekeeping system employed a rounding policy that systematically operated to the disadvantage of employees by rounding clock-in times forward and clock-out times backward, thereby undercounting compensable time.

(c) Misclassification of Administrative Support Positions. Plaintiffs allege that CPI misclassified certain administrative support positions — specifically, senior intake coordinators and billing specialists — as exempt from the FLSA's overtime requirements under the administrative exemption, when in fact these positions did not satisfy the duties test for the administrative exemption.

Class Status. The action is styled as a putative collective action under Section 216(b) of the FLSA. As of the date of this memorandum, no motion for conditional certification has been filed, although plaintiffs' counsel has indicated in discovery-related correspondence that such a motion is anticipated to be filed in the second quarter of 2024. The conditional certification motion, if filed and granted, would permit the plaintiffs to issue notice to all similarly situated current and former CPI employees, inviting them to opt in to the collective action.

Seller's Counsel's Assessment. Based on our discussions with the Seller's outside counsel at Barrow, Kensington & Pratt LLP (Kit Barrow and Samuel Otieno), and our review of the privilege-redacted litigation summary prepared by CPI's separate litigation counsel retained for the Dawson matter, the estimated potential exposure in this litigation ranges from $2.8 million to $5.1 million. This range is inclusive of potential back pay for overtime violations, liquidated damages (which are mandatory under the FLSA unless the employer can demonstrate good faith), and an award of plaintiffs' attorneys' fees and costs. The litigation is currently in the early stages of fact discovery, and no depositions have yet been taken.

CPI's Litigation Counsel. CPI is represented in the Dawson matter by separate litigation counsel. Based on the data room materials, it appears that CPI has retained a Nashville-based employment litigation firm to handle the defense of this matter, with Barrow, Kensington & Pratt LLP providing oversight and coordination in connection with the proposed transaction.

B. Dawson — Analysis and Risk Assessment

We have conducted an independent analysis of the risk profile of the Dawson litigation based on the materials available to us. Our assessment is set forth below.

Review of CPI's Timekeeping and Payroll Practices. We reviewed CPI's employee handbook, timekeeping policies, and payroll records summaries provided in the data room. CPI utilizes an electronic timekeeping system (Penrose Systems) across all 37 clinic locations. The timekeeping system does employ a rounding function, which rounds employee clock-in and clock-out times to the nearest quarter-hour. While rounding policies are generally permissible under the FLSA and applicable Department of Labor regulations when they are facially neutral and do not consistently favor the employer over time, the plaintiffs' complaint alleges that CPI's implementation of the rounding policy was, in practice, systematically biased against employees. We have not been provided with sufficient raw timekeeping data to independently verify or refute this allegation, although we note that the allegation is a common feature of FLSA collective actions and presents a factual question that would likely be addressed through expert analysis during discovery.

We also note that the off-the-clock work allegations are inherently difficult for employers to defend when the employer's timekeeping system does not capture pre-shift and post-shift activities. CPI's timekeeping system records clock-in and clock-out times at designated terminals, but does not appear to capture time spent on electronic documentation systems before or after shift start and end times. This gap in the timekeeping records could present vulnerability for CPI in the discovery process.

With respect to the misclassification claims, we reviewed the job descriptions and compensation structures for the senior intake coordinator and billing specialist positions. Based on our preliminary review, these positions involve a significant degree of routine clerical and data-entry work, and it is not clear that the positions consistently satisfy the "primary duty" test for the FLSA administrative exemption under 29 C.F.R. § 541.200. However, a definitive assessment of the misclassification claims would require a detailed factual analysis of the actual day-to-day duties performed by incumbents in these positions, which is beyond the scope of this transactional due diligence review.

Scope of Putative Class. CPI employs approximately 2,100 employees across its 37 clinic locations. Of this total, approximately 1,450 are licensed clinicians (physical therapists, occupational therapists, speech-language pathologists, licensed clinical social workers, licensed professional counselors, and related clinical professionals), and approximately 650 are administrative and support staff. The putative class in the Dawson action appears to target the non-exempt administrative and support staff cohort. However, to the extent that the misclassification claims encompass senior intake coordinators and billing specialists, the class could also implicate a subset of positions that CPI has treated as exempt. Based on the data room materials, we estimate that the number of potentially affected positions could range from approximately 400 to 650 current and former employees, depending on the scope of the class ultimately certified (or conditionally certified under the FLSA's opt-in mechanism).

Conditional Certification Likelihood. Under Section 216(b) of the FLSA, conditional certification of a collective action requires only a modest showing that the named plaintiff and potential opt-in members are "similarly situated." Courts in the Sixth Circuit (which encompasses Tennessee) apply a relatively lenient standard at the conditional certification stage, typically requiring only that the plaintiffs demonstrate a "colorable basis" for their claim that a class of similarly situated persons exists. See, e.g., Comer v. Wal-Mart Stores, Inc., 454 F.3d 544, 546-47 (6th Cir. 2006). Given the allegations of company-wide timekeeping and compensation policies, we assess the likelihood of conditional certification as moderate to high. However, even if conditional certification is granted, the defendant may move for decertification after the completion of opt-in discovery, and the ultimate size of the collective is highly dependent on opt-in rates, which vary significantly across cases.

Litigation Trajectory. Assuming the Dawson matter proceeds on its current trajectory, we anticipate the following milestones:

• Q2 2024: Motion for conditional certification filed by plaintiffs.

• Q3-Q4 2024: If conditional certification is granted, issuance of notice to potential opt-in plaintiffs; opt-in period (typically 60-90 days).

• Q4 2024 – Q2 2025: Completion of fact and expert discovery.

• Q2-Q3 2025: Potential motion for decertification by defendant; dispositive motions.

• Q3-Q4 2025 or later: Trial, if the case is not resolved through settlement.

It is noteworthy that the majority of FLSA collective actions settle prior to trial. Based on our experience with similar matters, we believe there is a reasonable probability that the Dawson matter will be resolved through settlement, potentially in the range of $1.5 million to $3.5 million, depending on the size of the opt-in class and the strength of the evidence developed in discovery. However, for purposes of this memorandum and the structuring of APA protections, we use the Seller's counsel's broader exposure range of $2.8 million to $5.1 million, which represents a more conservative (i.e., higher) estimate.

Exposure Range Analysis. The exposure range provided by Seller's counsel is based on the following assumptions:

• Low End ($2.8 million): Assumes limited class participation (approximately 30-40% opt-in rate among eligible employees), partial liability (i.e., liability on some but not all of the alleged violations), reduced damages for certain claim categories, and a modest award of plaintiffs' attorneys' fees.

• High End ($5.1 million): Assumes broad class participation (60-70% opt-in rate), full liability on all alleged violations, liquidated damages equal to the amount of unpaid wages (as mandated by 29 U.S.C. § 216(b) absent a showing of good faith by the employer), and a substantial award of plaintiffs' attorneys' fees and litigation costs.

Insurance Recovery. We do not anticipate meaningful insurance recovery for the Dawson matter. CPI maintains an employment practices liability insurance ("EPLI") policy; however, typical EPLI policies contain exclusions for FLSA wage-and-hour claims and related statutory wage violations. We have reviewed a summary of CPI's EPLI coverage in the data room, and the policy appears to contain a standard wage-and-hour exclusion, although we have requested a copy of the full policy form from Seller's counsel to confirm this assessment. If the EPLI policy does contain a wage-and-hour exclusion, as we expect, there would be no insurance recovery available for the Dawson matter, and the full amount of any liability or settlement would fall on the responsible party (i.e., the Seller, under our recommended excluded liability treatment).

Impact on Transaction Value. At a base purchase price of $620,000,000, the maximum estimated exposure in the Dawson matter of $5.1 million represents approximately 0.82% of the purchase price. While this is not an insignificant dollar amount in absolute terms, it is a manageable and quantifiable liability in the context of the overall transaction. The Dawson matter does not, in our assessment, rise to the level of a Material Adverse Effect that would warrant revisiting the fundamental terms of the acquisition, but it is a concrete liability that should be addressed through appropriate contractual protections in the APA.

C. Dawson — Recommended APA Treatment

Based on our analysis of the Dawson litigation, we recommend the following treatment in the APA and ancillary transaction documents:

Primary Recommendation: Excluded Liability. The Dawson litigation should be treated as an excluded liability under the APA. Under the proposed asset purchase structure, the Buyer (through the Acquisition Sub) will assume certain specified liabilities of the Seller. The Dawson matter, and all liabilities arising from or related thereto, should be expressly excluded from the definition of "Assumed Liabilities" and included in the definition of "Excluded Liabilities" in the APA.

The Dawson litigation should be specifically identified by case caption, case number, and court on the applicable Disclosure Schedule (anticipated to be Schedule 3.14 — Litigation, or the equivalent schedule addressing pending and threatened claims). The explicit listing of the Dawson matter on the Disclosure Schedules will serve the dual purpose of (a) ensuring that the Buyer has full knowledge of the matter for purposes of the representations and warranties, and (b) memorializing the parties' agreement that this liability is retained by the Seller.

Specific Indemnification. In addition to the excluded liability treatment, the Seller should provide a specific indemnification obligation for the Dawson matter. This specific indemnification should operate as follows:

(a) The Seller shall indemnify, defend, and hold harmless the Buyer, the Acquisition Sub, and their respective affiliates, directors, officers, employees, and agents from and against any and all losses, liabilities, damages, costs, and expenses (including reasonable attorneys' fees and costs of defense) arising from or related to the Dawson litigation, including any settlement, judgment, award, or other resolution thereof.

(b) The specific indemnification for the Dawson matter should not be subject to the general indemnification basket of $3,100,000 (representing 0.5% of the purchase price). Losses arising from the Dawson matter should be recoverable from the first dollar, without regard to the basket or any de minimis threshold (the proposed de minimis threshold is $100,000 per individual claim under the general indemnification framework).

(c) The specific indemnification for the Dawson matter should be subject to the general 20% indemnification cap of $124,000,000. Given that the estimated maximum exposure in the Dawson matter is $5.1 million, which is well below the general cap, we do not believe it is necessary to negotiate an uncapped indemnification obligation for this matter. The general cap provides more than adequate coverage.

(d) The specific indemnification for the Dawson matter should survive for the full general indemnification survival period of 18 months post-closing (i.e., through December 30, 2025, assuming a June 30, 2024 closing date). In the event the Dawson matter remains pending at the expiration of the 18-month survival period, the indemnification obligation should survive with respect to any claims made or reasonably anticipated in connection with the Dawson matter until such time as the matter is fully and finally resolved.

Closing Certificate. We recommend that the Seller's closing certificate include a specific bring-down representation confirming the status of the Dawson matter as of the closing date, including any material developments since the date of the APA (such as the filing of a conditional certification motion, any settlement discussions, or any changes to the estimated exposure range).

Assignment and Assumption Agreement. The Assignment and Assumption Agreement to be executed at closing should expressly exclude the Dawson matter from the assumed liabilities. The excluded liabilities section of the Assignment and Assumption Agreement should cross-reference the APA's definition of Excluded Liabilities and specifically identify the Dawson matter by case caption and case number.

R&W Insurance Coordination. The representations and warranties insurance policy to be placed with Sentinel Specialty Insurance Company (Policy No. SSI-RWI-2024-05178) is expected to exclude the Dawson litigation as a "known matter" or "disclosed matter" under the policy exclusions. This is standard practice for R&W insurance underwriting: matters specifically identified in the Disclosure Schedules are excluded from coverage because they are known risks that should be addressed through direct contractual protections between the parties. Accordingly, the Buyer should not rely on the R&W insurance policy for any losses arising from the Dawson litigation and should instead rely on the Seller's direct indemnification obligation and the escrow holdback as the primary sources of recovery.

Pre-Closing Covenant. We further recommend that the APA include a covenant requiring the Seller not to settle, compromise, or consent to any judgment in the Dawson matter without the Buyer's prior written consent (not to be unreasonably withheld, conditioned, or delayed) during the interim period between signing and closing. Assuming a target signing date of April 2, 2024 and a target closing date of June 30, 2024, this covenant would remain in effect for approximately three months. This provision will ensure that the Buyer has visibility into and control over any proposed resolution of the Dawson matter that could affect the Buyer's post-closing operations or employee relations.

D. Other Pending Litigation

Beyond the Dawson matter, our review of CPI's litigation docket and the data room materials identified only the following minor pending litigation matters:

Premises Liability Claims. Two routine slip-and-fall claims are pending against CPI at clinic locations:

(a) Johnson v. Cardinal Peak Industries, Inc., filed in the State Court of Fulton County, Georgia, involving an alleged slip-and-fall incident at CPI's Buckhead, Georgia clinic location. The claim seeks approximately $75,000 in damages. CPI's general liability insurer has accepted the defense of this claim, and CPI's counsel views the claim as defensible. The amount in controversy is below the proposed de minimis threshold of $100,000 per individual claim.

(b) Martinez v. Cardinal Peak Industries, Inc., filed in the General Sessions Court for Davidson County, Tennessee, involving an alleged trip-and-fall incident at CPI's Nashville, Tennessee clinic location. The claim seeks approximately $50,000 in damages. This claim is similarly covered by CPI's general liability insurance and is considered immaterial.

Both premises liability claims are routine in nature, are covered by CPI's existing general liability insurance program, and are individually below the proposed de minimis threshold. These claims do not present material risk to the transaction and, assuming the proposed asset purchase is structured as we recommend, should be treated as excluded liabilities retained by the Seller (as pre-closing claims).

Workers' Compensation Claim. One pending workers' compensation claim has been identified in Georgia, involving a former CPI clinician who alleges a work-related musculoskeletal injury. The claim is being handled through CPI's workers' compensation insurance carrier and represents de minimis exposure to CPI. Workers' compensation claims are typically employer-specific obligations that do not transfer in an asset purchase, and this claim should be excluded from the assumed liabilities.

Confirmation. No other material pending lawsuits involving CPI have been identified in our review. We recommend that the APA include a comprehensive representation and warranty from the Seller confirming the absence of any pending litigation not disclosed on the applicable Disclosure Schedule, and requiring the Seller to update the Disclosure Schedules prior to closing to reflect any new matters that may arise during the interim period.

E. Threatened Litigation

Our review of the data room materials included an examination of demand letters, pre-litigation correspondence, and other communications that might indicate threatened but not-yet-filed litigation.

Wrongful Termination Demand. We identified one demand letter from a former CPI regional director (name redacted in data room materials) alleging wrongful termination in connection with the individual's separation from CPI in November 2023. The demand letter, dated January 8, 2024 and submitted by the individual's personal attorney, seeks approximately $175,000 in severance payments and damages, asserting that the termination was retaliatory and in breach of an alleged oral commitment regarding continued employment. Based on our discussions with CPI management and Seller's counsel at Barrow, Kensington & Pratt LLP, CPI considers this demand to be without substantial merit. CPI management has represented that the individual was terminated for documented performance deficiencies and that no oral commitment regarding employment tenure was made. CPI's counsel has indicated that this matter is unlikely to result in the filing of a lawsuit and that CPI is exploring a modest pre-closing resolution to eliminate any residual risk.

We recommend that this threatened matter be disclosed on the applicable Disclosure Schedule (Schedule 3.14 — Litigation, or equivalent) to ensure full transparency and to protect the Buyer against any claim that the matter was not adequately disclosed. If the matter is resolved prior to closing, the Seller should provide evidence of the resolution to the Buyer, including any release or settlement agreement executed in connection therewith.

Other Threatened Matters. No other demand letters, cease-and-desist communications, or pre-litigation threats of significance were identified in the data room materials. We recommend that the APA include a standard representation and warranty regarding the absence of any additional pending or threatened litigation not disclosed on the applicable Disclosure Schedules.

III. Regulatory Compliance Review — Healthcare Licensing and Certifications

A. State Licensing — Overview

CPI operates a network of 37 outpatient rehabilitation and behavioral health clinics across seven states. The geographic distribution of these facilities is as follows:

Each state in which CPI operates requires facility-specific licenses for the provision of outpatient rehabilitation services and/or behavioral health services. Depending on the state, these licenses may be issued separately for rehabilitation and behavioral health services or may be combined under a single license category. In all cases, the licenses are facility-specific (i.e., issued to a particular location) and are held in the name of the operating entity, Cardinal Peak Industries, Inc.

We reviewed CPI's licensing files in the data room, including copies of current licenses, renewal correspondence, and any historical enforcement or disciplinary records. Our review confirms that all 37 CPI clinic locations hold current, active state licenses. We did not identify any lapsed, suspended, revoked, or conditional licenses at any CPI facility. All licenses have been renewed on a timely basis within the applicable renewal cycles prescribed by each state's licensing authority. A schedule of license numbers, effective dates, and next renewal dates for each of the 37 facilities has been compiled and is maintained in our working files.

B. State Licensing — State-by-State Summary

Set forth below is a state-by-state summary of CPI's licensing status and any notable findings:

Tennessee (14 clinics). CPI's Tennessee facilities are licensed by the Tennessee Department of Health, Division of Health Care Facilities. All 14 Tennessee licenses are current and in good standing. We identified no pending enforcement actions, administrative proceedings, or conditions placed on any Tennessee license. Tennessee licenses are renewed annually, and all renewal filings have been timely submitted. Tennessee is CPI's largest market, accounting for approximately 38% of its clinic locations and a corresponding proportion of its revenues.

Georgia (8 clinics). CPI's Georgia facilities are licensed by the Georgia Department of Community Health. All eight Georgia licenses are current and in good standing. We identified one historical administrative deficiency at CPI's Marietta, Georgia location in 2021, involving a documentation issue related to patient intake records. Specifically, a routine survey by the Georgia Department of Community Health identified instances in which patient intake assessments were not completed within the timeframe prescribed by Georgia administrative regulations. CPI submitted a corrective action plan, which was accepted by the Department, and the matter was closed without the imposition of any fine, penalty, or condition on the facility's license. No other issues have been identified with respect to CPI's Georgia licenses.

North Carolina (5 clinics). CPI's North Carolina facilities are licensed by the North Carolina Department of Health and Human Services, Division of Health Service Regulation. All five North Carolina licenses are current and in good standing. We identified no pending or historical enforcement actions, deficiencies, or conditions on any North Carolina license. North Carolina has a biennial license renewal cycle, and all renewals have been timely submitted.

South Carolina (4 clinics). CPI's South Carolina facilities are licensed by the South Carolina Department of Health and Environmental Control ("DHEC"). All four South Carolina licenses are current and in good standing. No pending or historical enforcement actions, deficiencies, or conditions have been identified.

Alabama (3 clinics). CPI's Alabama facilities are licensed by the Alabama Department of Public Health. All three Alabama licenses are current and in good standing. No pending or historical enforcement actions, deficiencies, or conditions have been identified.

Virginia (2 clinics). CPI's Virginia facilities are licensed by the Virginia Department of Health. Both Virginia licenses are current and in good standing. No pending or historical enforcement actions, deficiencies, or conditions have been identified.

Kentucky (1 clinic). CPI's sole Kentucky facility is licensed by the Kentucky Cabinet for Health and Family Services. The Kentucky license is current and in good standing. No pending or historical enforcement actions, deficiencies, or conditions have been identified.

C. Change-of-Ownership Filing Requirements

The proposed acquisition is structured as an asset purchase, which constitutes a change of ownership ("CHOW") for purposes of state healthcare facility licensing in most, if not all, of the seven states in which CPI operates. State CHOW requirements vary considerably and may include pre-closing notification requirements, post-closing filing obligations, application for new licenses in the name of the Acquisition Sub, or some combination thereof.

The following CHOW filings have been initiated or are being tracked:

(a) Tennessee, Georgia, and North Carolina. State healthcare change-of-ownership notices were filed on March 4, 2024 for Tennessee (14 locations), Georgia (8 locations), and North Carolina (5 locations). These three states account for 27 of CPI's 37 clinic locations and were prioritized due to the volume of facilities and the relative complexity of their respective CHOW processes. The Tennessee Department of Health, the Georgia Department of Community Health, and the North Carolina Division of Health Service Regulation have each acknowledged receipt of the initial filings. Follow-up submissions, including new license applications in the name of the Acquisition Sub, will be filed in coordination with the closing timeline.

(b) South Carolina, Alabama, Virginia, and Kentucky. Additional CHOW filings are required or expected for the remaining four states. Hargrove, Sinclair & Demarest LLP (Angela Demarest) is coordinating the preparation and submission of these filings. The timing and specific requirements for each state are being tracked and will be addressed in detail in the joint Healthcare Regulatory Compliance Memorandum, which is expected to be delivered on or about March 20, 2024.

For purposes of the APA, we recommend that the receipt of all required state change-of-ownership approvals (or, where applicable, satisfactory evidence that post-closing filing is permissible under applicable state law) be included as a closing condition. This is discussed further in Section VII.B below.

D. Medicare and Medicaid Certifications

CPI participates in the Medicare program (administered by the Centers for Medicare & Medicaid Services, or "CMS") and in the Medicaid programs of the seven states in which it operates. Government payors — Medicare and Medicaid combined — represent approximately 31% of CPI's net revenue. Given the significance of government payor revenue to CPI's business, the maintenance of Medicare and Medicaid provider enrollment and certifications is critical to the value of the acquired assets.

Current Enrollment Status. Our review of CPI's Medicare provider enrollment records and Medicaid provider agreements confirms that all 37 clinic locations hold active Medicare provider enrollment under the CMS Provider Enrollment, Chain, and Ownership System ("PECOS"). Additionally, CPI maintains active Medicaid provider agreements in each of the seven states in which it operates, to the extent that the specific services offered at each location are covered under the applicable state Medicaid program. We identified no current Medicare or Medicaid exclusions, suspensions, or pending revocable sanctions against CPI or against any individual clinician employed by CPI based on our searches of the OIG exclusion database (LEIE), the SAM exclusion database, and CPI's own compliance records.

Revalidation History. CPI's most recent Medicare revalidation cycle was completed in 2022. Under current CMS revalidation requirements, Medicare-enrolled providers are subject to revalidation every five years. Accordingly, CPI's next revalidation is expected in approximately 2027. CPI's Medicare enrollment appears to be in good standing, and no issues or deficiencies were identified in connection with the 2022 revalidation.

Post-Closing Provider Enrollment. Following the closing of the asset purchase, the Acquisition Sub (Ardent Healthcare Acquisition Corp.) will need to enroll as the new Medicare and Medicaid provider for all 37 clinic locations, or effectuate a change of information filing reflecting the new ownership. This process requires the submission of CMS-855 series enrollment forms (CMS-855B for clinics/group practices) and corresponding state Medicaid enrollment applications. The provider enrollment process can take several weeks to several months, depending on the efficiency of the applicable CMS Medicare Administrative Contractor ("MAC") and state Medicaid agencies.

Billing Gap Risk. A significant operational risk associated with the change of provider enrollment is the potential for a gap in Medicare and Medicaid billing authority during the transition period. If the Acquisition Sub's Medicare and Medicaid enrollment is not effective as of the closing date, the Acquisition Sub may not be able to bill Medicare or Medicaid for services rendered until the enrollment is approved. To mitigate this risk, we recommend that the Transition Services Agreement ("TSA") include provisions under which CPI continues to bill Medicare and Medicaid under its existing provider numbers during the transition period, with appropriate arrangements for the remittance of collected receivables to the Acquisition Sub. The TSA billing arrangement should be carefully structured to comply with applicable Medicare and Medicaid anti-assignment rules and CMS guidance regarding change-of-ownership billing. Angela Demarest at Hargrove, Sinclair & Demarest LLP is advising on the specific structuring of these TSA provisions.

E. Prior Survey and Inspection Results

We reviewed state survey and inspection reports for CPI's 37 facilities covering the five-year period from 2019 through the present. State survey and inspection processes vary by state but generally involve periodic on-site inspections by state licensing authorities to assess compliance with applicable regulations governing facility operations, patient care, staffing, documentation, safety, and related requirements.

Overall Assessment. CPI's survey and inspection history is clean and consistent with well-managed multi-site healthcare operations. No facility closures, license revocations, or conditions placed on any CPI license were identified during the review period. CPI's facilities have generally received satisfactory survey results, with only two minor deficiencies noted across the entire 37-facility portfolio over the past five years.

Identified Deficiencies. The two minor survey deficiencies identified are as follows:

(a) Georgia — Marietta Location (2021). As discussed in Section III.B above, a routine survey by the Georgia Department of Community Health identified a documentation deficiency at CPI's Marietta, Georgia clinic. The deficiency involved instances in which patient intake assessments were not completed within the timeframe prescribed by applicable Georgia administrative regulations. CPI submitted a corrective action plan, which was reviewed and accepted by the Department. The matter was closed without the imposition of any fine, penalty, or condition on the facility's license.

(b) Tennessee — Murfreesboro Location (2022). A routine state inspection of CPI's Murfreesboro, Tennessee clinic identified a minor fire safety code citation. The citation related to the placement of certain storage materials in a manner that partially obstructed a designated egress pathway. CPI corrected the deficiency within 30 days of the citation, and the Tennessee Department of Health confirmed that the corrective action was satisfactory. No fine was imposed, and no follow-up inspection was required.

Neither of these deficiencies is material to the transaction, and both were resolved in the ordinary course of CPI's operations. The overall survey and inspection record supports the conclusion that CPI maintains its facilities in compliance with applicable state regulations and industry standards.

IV. Regulatory Compliance Review — Federal Healthcare Laws

A. Anti-Kickback Statute and Stark Law

CPI's operations involve referral relationships with physicians, hospitals, and other healthcare providers who refer patients to CPI's outpatient rehabilitation and behavioral health clinics. These referral relationships implicate two principal federal healthcare fraud and abuse statutes:

(a) The Federal Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)) prohibits the knowing and willful offer, payment, solicitation, or receipt of any remuneration to induce or reward referrals of items or services payable by a federal healthcare program.

(b) The Physician Self-Referral Law (the "Stark Law," 42 U.S.C. § 1395nn) prohibits a physician from making referrals for certain designated health services payable by Medicare to an entity with which the physician (or an immediate family member) has a financial relationship, unless an exception applies.

Violations of the Anti-Kickback Statute may result in criminal penalties (fines and imprisonment), civil monetary penalties, and exclusion from federal healthcare programs. Violations of the Stark Law may result in denial of payment, refund obligations, civil monetary penalties, and exclusion from federal healthcare programs. Both statutes have been the subject of vigorous enforcement by the Department of Justice ("DOJ") and the HHS Office of Inspector General ("OIG") in recent years.

Review Findings. We reviewed the following materials in the data room relating to CPI's referral arrangements and compliance with these statutes:

• CPI's standard physician referral agreements and marketing agreements;

• CPI's arrangements with hospitals and health systems for patient referrals;

• CPI's physician compensation arrangements (to the extent CPI employs or contracts with referring physicians);

• CPI's corporate compliance program, including compliance policies and procedures, the compliance officer's annual reports, and compliance training records; and

• CPI's marketing and promotional materials and practices.

CPI maintains a corporate compliance program overseen by a designated Chief Compliance Officer. The compliance program includes written policies and procedures addressing referral relationships, physician compensation arrangements, and anti-kickback and Stark Law compliance. The compliance program appears to be reasonably designed and consistent with industry practice for a multi-site outpatient healthcare provider of CPI's size and scope.

Based on our review of the materials available in the data room, we have not identified any specific violations of the Anti-Kickback Statute or the Stark Law. However, we wish to note the following caveats:

(i) Our review of CPI's referral arrangements and physician compensation structures is ongoing and is being conducted in close coordination with Angela Demarest at Hargrove, Sinclair & Demarest LLP, who brings specialized expertise in healthcare regulatory compliance. A more detailed analysis of CPI's compliance with the Anti-Kickback Statute and the Stark Law will be provided in the joint Healthcare Regulatory Compliance Memorandum, expected on or about March 20, 2024.

(ii) Anti-Kickback Statute and Stark Law compliance is inherently fact-intensive and cannot be definitively confirmed through a document review alone. The absence of identified violations in the data room does not constitute a guarantee that no violations exist. Accordingly, we recommend robust representations and warranties in the APA regarding compliance with federal healthcare fraud and abuse laws, supported by appropriate disclosure schedule exceptions for any arrangements that may present compliance risk.

B. False Claims Act

The federal False Claims Act (31 U.S.C. §§ 3729-3733) imposes civil liability on any person who knowingly submits false or fraudulent claims for payment to the federal government, or who causes such claims to be submitted. In the healthcare context, False Claims Act liability can arise from range conduct, including billing for services not rendered, upcoding, unbundling, billing for medically unnecessary services, and billing tainted by violations of the Anti-Kickback Statute or the Stark Law. The False Claims Act authorizes treble damages and per-claim penalties, and is frequently enforced through qui tam actions brought by private whistleblowers (known as "relators") on behalf of the government.

Review Findings. Our review of the data room materials and our discussions with CPI management and Seller's counsel have yielded the following findings:

• No pending or historical *qui tam* / False Claims Act actions. We have not identified any pending or historical qui tam lawsuits or other False Claims Act actions against CPI. CPI management has represented that CPI has not been a defendant in any such action.

• No Civil Investigative Demands or government subpoenas. We have not identified any Civil Investigative Demands ("CIDs") or subpoenas from the DOJ, HHS-OIG, or any state Medicaid Fraud Control Unit directed at CPI. CPI management has represented that CPI has not received any such demands or subpoenas.

• No whistleblower complaints. CPI management has represented that CPI has not received any internal or external whistleblower complaints under the False Claims Act or any state false claims act equivalent. CPI's corporate compliance program includes a mechanism for employees to report potential compliance concerns (including an anonymous compliance hotline), and the compliance officer's annual reports, which we reviewed in the data room, do not reflect any reports of suspected false claims or billing fraud.

We note that qui tam actions may be filed under seal and remain unknown to the defendant for extended periods (sometimes years) while the government investigates and decides whether to intervene. Accordingly, the absence of known qui tam actions does not eliminate the possibility that a sealed qui tam action exists. This inherent limitation underscores the importance of robust False Claims Act representations and warranties in the APA, as discussed in Section VII below.

We recommend that the APA include a standard representation and warranty confirming the absence of any pending or threatened False Claims Act actions, government investigations, CIDs, and related matters, with appropriate qualification for the Seller's knowledge.

C. HIPAA Compliance

CPI handles protected health information ("PHI") of patients across its 37 clinic locations in the ordinary course of providing outpatient rehabilitation and behavioral health services. As a "covered entity" under HIPAA, CPI is subject to the requirements of the HIPAA Privacy Rule (45 C.F.R. Part 160 and Subparts A and E of Part 164), the HIPAA Security Rule (45 C.F.R. Part 160 and Subparts A and C of Part 164), and the HIPAA Breach Notification Rule (45 C.F.R. Part 160 and Subpart D of Part 164), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH Act").

HIPAA Compliance Program. CPI maintains a HIPAA compliance program that includes the following elements:

• A designated Privacy Officer responsible for overseeing compliance with the HIPAA Privacy Rule and the HIPAA Breach Notification Rule;

• A designated Security Officer responsible for overseeing compliance with the HIPAA Security Rule;

• Written privacy and security policies and procedures that address the use and disclosure of PHI, patient rights regarding PHI, administrative safeguards, physical safeguards, technical safeguards, and breach notification procedures;

• Employee training on HIPAA privacy and security requirements, conducted at onboarding and on an annual basis;

• Business Associate Agreements with vendors and service providers that create, receive, maintain, or transmit PHI on CPI's behalf; and

• A breach notification log and incident response procedures for identifying, investigating, and reporting potential breaches of unsecured PHI.

Based on our review of the data room materials, CPI's HIPAA compliance program appears to be reasonably designed and maintained. The policies and procedures we reviewed are consistent with industry standards for outpatient healthcare providers.

HIPAA Breach History. We reviewed CPI's breach notification log and identified two HIPAA breach incidents reported to the U.S. Department of Health and Human Services ("HHS") within the past three years:

(a) 2021 — Misdirected Fax Incident. In 2021, an employee at a single CPI clinic location inadvertently transmitted a fax containing PHI of approximately 12 individuals to an incorrect fax number. The misdirected fax was sent to a number belonging to an unrelated business, which promptly notified CPI and confirmed destruction of the received documents. CPI investigated the incident, determined that it constituted a breach of unsecured PHI under the HIPAA Breach Notification Rule, and reported the breach to HHS and to the affected individuals in accordance with the applicable notification requirements. The HHS Office for Civil Rights ("OCR") did not initiate an investigation or enforcement action in connection with this incident. CPI implemented additional safeguards, including enhanced fax verification procedures, to prevent recurrence.

(b) 2023 — Lost Unencrypted Laptop Incident. In 2023, a CPI employee's laptop computer containing PHI of approximately 87 individuals was lost. The laptop was not encrypted at the time of the loss. CPI investigated the incident and determined that it constituted a breach of unsecured PHI. Because the breach affected fewer than 500 individuals, CPI reported the breach to HHS on an annual basis in accordance with the Breach Notification Rule's reporting requirements for smaller breaches (45 C.F.R. § 164.408). CPI also provided individual notification to the 87 affected individuals in accordance with 45 C.F.R. § 164.404. Following the incident, CPI implemented additional encryption protocols for all employee laptops and mobile devices and conducted supplemental security awareness training for employees. HHS OCR did not initiate an investigation or enforcement action in connection with this incident.

Neither of the above incidents resulted in the imposition of any penalty, resolution agreement, corrective action plan, or other enforcement action by HHS OCR. Both incidents were minor in scope and were handled in accordance with CPI's established breach response procedures and applicable HIPAA requirements.

PeakConnect Patient-Engagement Platform. CPI operates a proprietary patient-engagement software platform known as PeakConnect (U.S. Trademark Registration No. 5,412,887). PeakConnect is used across CPI's 37 clinic locations to facilitate patient scheduling, communications, intake processing, and certain clinical documentation functions. The platform handles PHI and is therefore subject to the requirements of the HIPAA Security Rule. CPI management has represented that PeakConnect is compliant with applicable HIPAA Security Rule standards, including the implementation of appropriate administrative, physical, and technical safeguards. We have not conducted an independent technical assessment of PeakConnect's security architecture; such an assessment, if desired by the Buyer, would typically be performed by the Buyer's information technology or cybersecurity team, potentially with the assistance of a third-party security assessor.

Post-Closing HIPAA Considerations. The post-closing transition period will involve CPI's continued access to and handling of PHI in connection with the Transition Services Agreement. During the TSA period, CPI will be functioning in a capacity analogous to a "business associate" of the Acquisition Sub with respect to any PHI it accesses or handles on the Acquisition Sub's behalf. Accordingly, a Business Associate Agreement ("BAA") between the Acquisition Sub and CPI will be required to govern CPI's use and disclosure of PHI during the TSA period. The BAA should be appended to or incorporated by reference in the Transition Services Agreement and should satisfy the requirements of 45 C.F.R. § 164.504(e).

APA Recommendations. We recommend that the APA include comprehensive representations and warranties from the Seller regarding HIPAA compliance, including representations regarding the maintenance of a HIPAA compliance program, the absence of material HIPAA violations, the absence of pending OCR investigations or enforcement actions, and compliance with breach notification requirements. The two reported breach incidents described above should be disclosed on the applicable Disclosure Schedule as exceptions to the HIPAA compliance representation.

V. Other Regulatory Matters

A. Employment and Labor Compliance (Beyond Dawson)

As noted in Section II above, CPI employs approximately 2,100 employees across seven states, comprising approximately 1,450 licensed clinicians and approximately 650 administrative and support staff. CPI's multi-state operations implicate a broad range of federal and state employment and labor law requirements, including wage-and-hour laws, anti-discrimination statutes, workplace safety regulations, and employee benefits laws.

Employee Handbook and Policies. We reviewed CPI's employee handbook and related employment policies in the data room. The handbook addresses, among other topics, equal employment opportunity, anti-harassment and anti-discrimination, leave policies, compensation and pay practices, timekeeping procedures, and employee classification. The handbook appears to be professionally drafted and generally consistent with industry standards, although we note that its treatment of employee classification (exempt vs. non-exempt) and overtime policies should be reviewed in light of the issues raised by the Dawson litigation.

Wage-and-Hour Compliance. The Dawson litigation, discussed in detail in Section II, highlights potential systemic issues with CPI's wage-and-hour compliance practices, including timekeeping, overtime compensation, and employee classification. While the Dawson litigation is the only formal proceeding currently pending on these issues, the allegations in that case — if proven — would suggest that the underlying compliance deficiencies may be company-wide rather than limited to any single location or employee. We therefore recommend that the Buyer plan to conduct an enhanced post-closing review of CPI's timekeeping and payroll practices across all 37 clinic locations, potentially including a retention of an independent payroll and classification consultant to audit CPI's practices and recommend corrective measures as needed.

EEOC and State Agency Charges. Our review did not identify any pending charges with the U.S. Equal Employment Opportunity Commission ("EEOC") or any state human rights commission or civil rights enforcement agency. The only employment-related threatened claim is the wrongful termination demand letter discussed in Section II.E above.

ERISA and Employee Benefits. CPI sponsors a 401(k) retirement savings plan for eligible employees. Under the proposed asset purchase structure, CPI's 401(k) plan and all related liabilities will constitute excluded liabilities retained by the Seller. Our review did not identify any Employee Retirement Income Security Act of 1974 ("ERISA") compliance issues that would adversely affect the asset purchase or give rise to successor liability for the Buyer. Post-closing, the Acquisition Sub will establish its own employee benefit programs for employees who transition to the Acquisition Sub's employment.

B. Environmental Compliance

Whitmore Environmental Sciences Inc., an independent environmental consulting firm based in Atlanta, Georgia, has been engaged to review environmental compliance matters in connection with the proposed transaction. Their review is ongoing, and we summarize below the preliminary findings relevant to the litigation and regulatory risk assessment.

Environmental Risk Profile. CPI operates outpatient rehabilitation and behavioral health clinics. Unlike hospitals, surgical centers, or manufacturing facilities, outpatient clinics generally present a low environmental risk profile. CPI's facilities do not involve significant hazardous materials usage, industrial processes, or underground storage tanks. The primary environmental considerations for CPI's operations are limited to medical waste management (including sharps disposal and limited pharmaceutical waste) and general compliance with workplace safety and environmental regulations applicable to commercial office and clinic settings.

Real Property. CPI does not own any real property. All 37 clinic locations are operated under triple-net lease arrangements. Because CPI is a tenant rather than an owner, the environmental liabilities associated with the underlying real property (e.g., soil contamination, groundwater contamination, environmental remediation obligations) are generally the responsibility of the respective landlords under the lease agreements. Phase I environmental site assessments were not conducted for the leased properties, as this was deemed unnecessary given CPI's tenant status and the low environmental risk profile of outpatient clinic operations.

Environmental Compliance Findings. No known environmental contamination, remediation obligations, or pending environmental enforcement actions have been identified in connection with any CPI facility. CPI's behavioral health clinics may involve limited pharmaceutical waste from the administration or dispensing of medications, and CPI represents that it complies with applicable pharmaceutical waste disposal regulations, including those promulgated by the U.S. Environmental Protection Agency ("EPA") under the Resource Conservation and Recovery Act ("RCRA"). We do not view environmental compliance as a material risk factor for this transaction.

C. Data Privacy and State Consumer P

MEMORANDUM
PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
TO: Beatrice Holloway, Responsible Partner, Mergers & Acquisitions, Calderwood & Harkness LLP Priya Mehta-Sullivan, Partner, Head of Healthcare Investments, Ardent Capital Management LLC Connor Briggs, Vice President, Healthcare Deal Team, Ardent Capital Management LLC
FROM: Derek Okonkwo, Lead Associate, Mergers & Acquisitions, Calderwood & Harkness LLP (with assistance from Tiffany Rosenthal, Working Associate)
DATE: March 12, 2024
RE: Litigation and Regulatory Review — Cardinal Peak Industries, Inc. ("Project Cardinal")
MATTER NO.: 2024-M&A-0142
CLIENT: Ardent Capital Partners III LP
This memorandum has been prepared by Calderwood & Harkness LLP at the request of and for the exclusive benefit of Ardent Capital Partners III LP and its affiliates (collectively, "Ardent Capital") in connection with the proposed acquisition of substantially all assets of Cardinal Peak Industries, Inc. This memorandum is protected by the attorney-client privilege and constitutes attorney work product. It should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and Ardent Capital. Nothing in this memorandum constitutes legal advice to any person or entity other than Ardent Capital.
Right-click to update Table of Contents
I. Executive Summary
This memorandum summarizes the findings of our litigation and regulatory compliance review conducted in connection with the proposed $620,000,000 asset purchase of substantially all assets of Cardinal Peak Industries, Inc. ("CPI" or the "Seller") by Ardent Healthcare Acquisition Corp. (the "Acquisition Sub"), a wholly-owned subsidiary of Ardent Capital Partners III LP ("Ardent Capital" or the "Buyer"). The transaction is structured as an asset purchase pursuant to an Asset Purchase Agreement (the "APA") currently under negotiation between the parties. The purpose of this memorandum is to identify, analyze, and assess all material litigation risks and regulatory compliance matters that bear upon the valuation, structuring, and documentation of the proposed acquisition.
Our due diligence review commenced on February 5, 2024, and this memorandum synthesizes our findings through the date of this memorandum, March 12, 2024. The review is ongoing, and supplemental findings will be addressed in subsequent memoranda or updates as warranted.
Scope of Review. The scope of our review encompasses the following categories: (a) all pending and threatened litigation involving CPI; (b) CPI's regulatory compliance history with respect to state healthcare facility licensing, Medicare and Medicaid certifications and enrollment, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and related data privacy requirements, and federal healthcare fraud and abuse statutes; and (c) any enforcement actions, investigations, or sanctions involving CPI or its personnel. This review covers all 37 of CPI's outpatient rehabilitation and behavioral health facilities located across seven states: Tennessee, Georgia, North Carolina, South Carolina, Alabama, Virginia, and Kentucky.
Materials Reviewed. In conducting this review, we examined the following materials, among others:
• CPI's complete litigation docket, as provided by the Seller's outside counsel, Barrow, Kensington & Pratt LLP (contact partners: Catherine "Kit" Barrow and Samuel Otieno);
• CPI management representations and responses to our due diligence request lists, including management's litigation questionnaire responses;
• Documents made available in the electronic data room maintained by Seller's counsel, including corporate records, regulatory filings, compliance program documentation, employment policies and procedures, insurance coverage summaries, patient privacy policies, and related materials;
• State licensing and certification files for all 37 CPI clinic locations;
• State survey and inspection reports for CPI facilities covering the five-year period from 2019 through the present;
• CPI's Medicare provider enrollment records and Medicaid provider agreements across all applicable states;
• CPI's HIPAA compliance program documentation, including breach notification logs and incident reports;
• CPI's insurance program summaries, including general liability, professional liability, employment practices liability, directors and officers, and cyber liability policies; and
• Public records searches, including searches of the HHS Office of Inspector General ("OIG") List of Excluded Individuals/Entities ("LEIE"), the System for Award Management ("SAM") exclusion database, and publicly available court docket records.
Coordination with Healthcare Regulatory Counsel. We have coordinated closely with Hargrove, Sinclair & Demarest LLP (Angela Demarest, Partner, Healthcare Regulatory) on all healthcare regulatory matters, including state licensing, Medicare and Medicaid certifications, federal healthcare fraud and abuse law compliance, and change-of-ownership filing requirements. A separate joint Healthcare Regulatory Compliance Memorandum addressing these matters in greater depth is forthcoming and is currently expected to be delivered on or about March 20, 2024.
Key Findings. Our principal findings are as follows:
1. Material Pending Litigation — Dawson v. Cardinal Peak Industries, Inc. We have identified one material pending litigation matter: Dawson v. Cardinal Peak Industries, Inc., Case No. 3:23-cv-01847 (M.D. Tenn.), a putative class action alleging wage-and-hour violations under the Fair Labor Standards Act ("FLSA"). The Seller's litigation counsel estimates that CPI's potential exposure in this matter ranges from approximately $2.8 million to $5.1 million, inclusive of potential back pay, liquidated damages, and plaintiffs' attorneys' fees. We recommend that this matter be treated as an excluded liability under the APA, with the Seller retaining full responsibility and providing specific indemnification to the Buyer.
2. Other Litigation Matters. Beyond the Dawson matter, we identified only routine, immaterial pending litigation (two minor premises liability claims and one workers' compensation claim) and one threatened wrongful termination claim that CPI management expects to resolve prior to closing. No other material pending or threatened litigation has been identified.
3. Regulatory Compliance Profile. CPI's regulatory compliance profile is generally satisfactory. All 37 clinic locations hold current, active state licenses. CPI maintains active Medicare provider enrollment and Medicaid provider agreements in all applicable states. No material regulatory enforcement actions are currently pending against CPI. Historical survey deficiencies have been minor and were corrected without the imposition of penalties or sanctions. Two minor HIPAA breach incidents were identified and reported to HHS in accordance with applicable regulations; neither incident resulted in any enforcement action or penalty.
4. Overall Assessment. With the implementation of the APA protections recommended in this memorandum — including excluded liability treatment for the Dawson litigation, robust healthcare compliance representations and warranties, the proposed escrow holdback, and the representations and warranties insurance policy — we believe Buyer's litigation and regulatory risk exposure from this acquisition is appropriately mitigated and manageable.
II. Pending Litigation
A. Dawson v. Cardinal Peak Industries, Inc. — Overview
The most significant litigation matter identified in our review is Dawson v. Cardinal Peak Industries, Inc., Case No. 3:23-cv-01847, pending in the United States District Court for the Middle District of Tennessee. The key details of this matter are as follows:
Case Caption: Dawson v. Cardinal Peak Industries, Inc., Case No. 3:23-cv-01847 (M.D. Tenn.)
Court: United States District Court for the Middle District of Tennessee, Nashville Division
Date Filed: The complaint was filed on or about July 18, 2023.
Plaintiff(s): The named plaintiff is Brenda Dawson, a former CPI employee who was employed as a non-exempt, hourly administrative support specialist at CPI's Murfreesboro, Tennessee clinic location. The complaint is brought on behalf of Ms. Dawson and all similarly situated current and former non-exempt hourly employees of CPI.
Defendant: Cardinal Peak Industries, Inc.
Nature of Claims: This is a putative class action alleging wage-and-hour violations under the Fair Labor Standards Act, 29 U.S.C. §§ 201 et seq. The complaint does not assert claims under any state wage-and-hour statutes at this time, although it is possible that such claims could be added by amendment.
Allegations. The complaint alleges, in substance, that CPI engaged in a pattern and practice of failing to properly compensate its non-exempt, hourly employees for all hours worked, in violation of the FLSA's overtime and minimum wage provisions. Specifically, the complaint alleges the following categories of violations:
(a) Off-the-Clock Work. Plaintiffs allege that CPI required non-exempt employees to perform pre-shift and post-shift work — including logging into electronic systems, reviewing patient documentation, and completing administrative tasks — without compensation. The complaint alleges that this uncompensated work regularly amounted to 15 to 30 minutes per shift.
(b) Improper Timekeeping Rounding. Plaintiffs allege that CPI's electronic timekeeping system employed a rounding policy that systematically operated to the disadvantage of employees by rounding clock-in times forward and clock-out times backward, thereby undercounting compensable time.
(c) Misclassification of Administrative Support Positions. Plaintiffs allege that CPI misclassified certain administrative support positions — specifically, senior intake coordinators and billing specialists — as exempt from the FLSA's overtime requirements under the administrative exemption, when in fact these positions did not satisfy the duties test for the administrative exemption.
Class Status. The action is styled as a putative collective action under Section 216(b) of the FLSA. As of the date of this memorandum, no motion for conditional certification has been filed, although plaintiffs' counsel has indicated in discovery-related correspondence that such a motion is anticipated to be filed in the second quarter of 2024. The conditional certification motion, if filed and granted, would permit the plaintiffs to issue notice to all similarly situated current and former CPI employees, inviting them to opt in to the collective action.
Seller's Counsel's Assessment. Based on our discussions with the Seller's outside counsel at Barrow, Kensington & Pratt LLP (Kit Barrow and Samuel Otieno), and our review of the privilege-redacted litigation summary prepared by CPI's separate litigation counsel retained for the Dawson matter, the estimated potential exposure in this litigation ranges from $2.8 million to $5.1 million. This range is inclusive of potential back pay for overtime violations, liquidated damages (which are mandatory under the FLSA unless the employer can demonstrate good faith), and an award of plaintiffs' attorneys' fees and costs. The litigation is currently in the early stages of fact discovery, and no depositions have yet been taken.
CPI's Litigation Counsel. CPI is represented in the Dawson matter by separate litigation counsel. Based on the data room materials, it appears that CPI has retained a Nashville-based employment litigation firm to handle the defense of this matter, with Barrow, Kensington & Pratt LLP providing oversight and coordination in connection with the proposed transaction.
B. Dawson — Analysis and Risk Assessment
We have conducted an independent analysis of the risk profile of the Dawson litigation based on the materials available to us. Our assessment is set forth below.
Review of CPI's Timekeeping and Payroll Practices. We reviewed CPI's employee handbook, timekeeping policies, and payroll records summaries provided in the data room. CPI utilizes an electronic timekeeping system (Penrose Systems) across all 37 clinic locations. The timekeeping system does employ a rounding function, which rounds employee clock-in and clock-out times to the nearest quarter-hour. While rounding policies are generally permissible under the FLSA and applicable Department of Labor regulations when they are facially neutral and do not consistently favor the employer over time, the plaintiffs' complaint alleges that CPI's implementation of the rounding policy was, in practice, systematically biased against employees. We have not been provided with sufficient raw timekeeping data to independently verify or refute this allegation, although we note that the allegation is a common feature of FLSA collective actions and presents a factual question that would likely be addressed through expert analysis during discovery.
We also note that the off-the-clock work allegations are inherently difficult for employers to defend when the employer's timekeeping system does not capture pre-shift and post-shift activities. CPI's timekeeping system records clock-in and clock-out times at designated terminals, but does not appear to capture time spent on electronic documentation systems before or after shift start and end times. This gap in the timekeeping records could present vulnerability for CPI in the discovery process.
With respect to the misclassification claims, we reviewed the job descriptions and compensation structures for the senior intake coordinator and billing specialist positions. Based on our preliminary review, these positions involve a significant degree of routine clerical and data-entry work, and it is not clear that the positions consistently satisfy the "primary duty" test for the FLSA administrative exemption under 29 C.F.R. § 541.200. However, a definitive assessment of the misclassification claims would require a detailed factual analysis of the actual day-to-day duties performed by incumbents in these positions, which is beyond the scope of this transactional due diligence review.
Scope of Putative Class. CPI employs approximately 2,100 employees across its 37 clinic locations. Of this total, approximately 1,450 are licensed clinicians (physical therapists, occupational therapists, speech-language pathologists, licensed clinical social workers, licensed professional counselors, and related clinical professionals), and approximately 650 are administrative and support staff. The putative class in the Dawson action appears to target the non-exempt administrative and support staff cohort. However, to the extent that the misclassification claims encompass senior intake coordinators and billing specialists, the class could also implicate a subset of positions that CPI has treated as exempt. Based on the data room materials, we estimate that the number of potentially affected positions could range from approximately 400 to 650 current and former employees, depending on the scope of the class ultimately certified (or conditionally certified under the FLSA's opt-in mechanism).
Conditional Certification Likelihood. Under Section 216(b) of the FLSA, conditional certification of a collective action requires only a modest showing that the named plaintiff and potential opt-in members are "similarly situated." Courts in the Sixth Circuit (which encompasses Tennessee) apply a relatively lenient standard at the conditional certification stage, typically requiring only that the plaintiffs demonstrate a "colorable basis" for their claim that a class of similarly situated persons exists. See, e.g., Comer v. Wal-Mart Stores, Inc., 454 F.3d 544, 546-47 (6th Cir. 2006). Given the allegations of company-wide timekeeping and compensation policies, we assess the likelihood of conditional certification as moderate to high. However, even if conditional certification is granted, the defendant may move for decertification after the completion of opt-in discovery, and the ultimate size of the collective is highly dependent on opt-in rates, which vary significantly across cases.
Litigation Trajectory. Assuming the Dawson matter proceeds on its current trajectory, we anticipate the following milestones:
• Q2 2024: Motion for conditional certification filed by plaintiffs.
• Q3-Q4 2024: If conditional certification is granted, issuance of notice to potential opt-in plaintiffs; opt-in period (typically 60-90 days).
• Q4 2024 – Q2 2025: Completion of fact and expert discovery.
• Q2-Q3 2025: Potential motion for decertification by defendant; dispositive motions.
• Q3-Q4 2025 or later: Trial, if the case is not resolved through settlement.
It is noteworthy that the majority of FLSA collective actions settle prior to trial. Based on our experience with similar matters, we believe there is a reasonable probability that the Dawson matter will be resolved through settlement, potentially in the range of $1.5 million to $3.5 million, depending on the size of the opt-in class and the strength of the evidence developed in discovery. However, for purposes of this memorandum and the structuring of APA protections, we use the Seller's counsel's broader exposure range of $2.8 million to $5.1 million, which represents a more conservative (i.e., higher) estimate.
Exposure Range Analysis. The exposure range provided by Seller's counsel is based on the following assumptions:
• Low End ($2.8 million): Assumes limited class participation (approximately 30-40% opt-in rate among eligible employees), partial liability (i.e., liability on some but not all of the alleged violations), reduced damages for certain claim categories, and a modest award of plaintiffs' attorneys' fees.
• High End ($5.1 million): Assumes broad class participation (60-70% opt-in rate), full liability on all alleged violations, liquidated damages equal to the amount of unpaid wages (as mandated by 29 U.S.C. § 216(b) absent a showing of good faith by the employer), and a substantial award of plaintiffs' attorneys' fees and litigation costs.
Insurance Recovery. We do not anticipate meaningful insurance recovery for the Dawson matter. CPI maintains an employment practices liability insurance ("EPLI") policy; however, typical EPLI policies contain exclusions for FLSA wage-and-hour claims and related statutory wage violations. We have reviewed a summary of CPI's EPLI coverage in the data room, and the policy appears to contain a standard wage-and-hour exclusion, although we have requested a copy of the full policy form from Seller's counsel to confirm this assessment. If the EPLI policy does contain a wage-and-hour exclusion, as we expect, there would be no insurance recovery available for the Dawson matter, and the full amount of any liability or settlement would fall on the responsible party (i.e., the Seller, under our recommended excluded liability treatment).
Impact on Transaction Value. At a base purchase price of $620,000,000, the maximum estimated exposure in the Dawson matter of $5.1 million represents approximately 0.82% of the purchase price. While this is not an insignificant dollar amount in absolute terms, it is a manageable and quantifiable liability in the context of the overall transaction. The Dawson matter does not, in our assessment, rise to the level of a Material Adverse Effect that would warrant revisiting the fundamental terms of the acquisition, but it is a concrete liability that should be addressed through appropriate contractual protections in the APA.
C. Dawson — Recommended APA Treatment
Based on our analysis of the Dawson litigation, we recommend the following treatment in the APA and ancillary transaction documents:
Primary Recommendation: Excluded Liability. The Dawson litigation should be treated as an excluded liability under the APA. Under the proposed asset purchase structure, the Buyer (through the Acquisition Sub) will assume certain specified liabilities of the Seller. The Dawson matter, and all liabilities arising from or related thereto, should be expressly excluded from the definition of "Assumed Liabilities" and included in the definition of "Excluded Liabilities" in the APA.
The Dawson litigation should be specifically identified by case caption, case number, and court on the applicable Disclosure Schedule (anticipated to be Schedule 3.14 — Litigation, or the equivalent schedule addressing pending and threatened claims). The explicit listing of the Dawson matter on the Disclosure Schedules will serve the dual purpose of (a) ensuring that the Buyer has full knowledge of the matter for purposes of the representations and warranties, and (b) memorializing the parties' agreement that this liability is retained by the Seller.
Specific Indemnification. In addition to the excluded liability treatment, the Seller should provide a specific indemnification obligation for the Dawson matter. This specific indemnification should operate as follows:
(a) The Seller shall indemnify, defend, and hold harmless the Buyer, the Acquisition Sub, and their respective affiliates, directors, officers, employees, and agents from and against any and all losses, liabilities, damages, costs, and expenses (including reasonable attorneys' fees and costs of defense) arising from or related to the Dawson litigation, including any settlement, judgment, award, or other resolution thereof.
(b) The specific indemnification for the Dawson matter should not be subject to the general indemnification basket of $3,100,000 (representing 0.5% of the purchase price). Losses arising from the Dawson matter should be recoverable from the first dollar, without regard to the basket or any de minimis threshold (the proposed de minimis threshold is $100,000 per individual claim under the general indemnification framework).
(c) The specific indemnification for the Dawson matter should be subject to the general 20% indemnification cap of $124,000,000. Given that the estimated maximum exposure in the Dawson matter is $5.1 million, which is well below the general cap, we do not believe it is necessary to negotiate an uncapped indemnification obligation for this matter. The general cap provides more than adequate coverage.
(d) The specific indemnification for the Dawson matter should survive for the full general indemnification survival period of 18 months post-closing (i.e., through December 30, 2025, assuming a June 30, 2024 closing date). In the event the Dawson matter remains pending at the expiration of the 18-month survival period, the indemnification obligation should survive with respect to any claims made or reasonably anticipated in connection with the Dawson matter until such time as the matter is fully and finally resolved.
Closing Certificate. We recommend that the Seller's closing certificate include a specific bring-down representation confirming the status of the Dawson matter as of the closing date, including any material developments since the date of the APA (such as the filing of a conditional certification motion, any settlement discussions, or any changes to the estimated exposure range).
Assignment and Assumption Agreement. The Assignment and Assumption Agreement to be executed at closing should expressly exclude the Dawson matter from the assumed liabilities. The excluded liabilities section of the Assignment and Assumption Agreement should cross-reference the APA's definition of Excluded Liabilities and specifically identify the Dawson matter by case caption and case number.
R&W Insurance Coordination. The representations and warranties insurance policy to be placed with Sentinel Specialty Insurance Company (Policy No. SSI-RWI-2024-05178) is expected to exclude the Dawson litigation as a "known matter" or "disclosed matter" under the policy exclusions. This is standard practice for R&W insurance underwriting: matters specifically identified in the Disclosure Schedules are excluded from coverage because they are known risks that should be addressed through direct contractual protections between the parties. Accordingly, the Buyer should not rely on the R&W insurance policy for any losses arising from the Dawson litigation and should instead rely on the Seller's direct indemnification obligation and the escrow holdback as the primary sources of recovery.
Pre-Closing Covenant. We further recommend that the APA include a covenant requiring the Seller not to settle, compromise, or consent to any judgment in the Dawson matter without the Buyer's prior written consent (not to be unreasonably withheld, conditioned, or delayed) during the interim period between signing and closing. Assuming a target signing date of April 2, 2024 and a target closing date of June 30, 2024, this covenant would remain in effect for approximately three months. This provision will ensure that the Buyer has visibility into and control over any proposed resolution of the Dawson matter that could affect the Buyer's post-closing operations or employee relations.
D. Other Pending Litigation
Beyond the Dawson matter, our review of CPI's litigation docket and the data room materials identified only the following minor pending litigation matters:
Premises Liability Claims. Two routine slip-and-fall claims are pending against CPI at clinic locations:
(a) Johnson v. Cardinal Peak Industries, Inc., filed in the State Court of Fulton County, Georgia, involving an alleged slip-and-fall incident at CPI's Buckhead, Georgia clinic location. The claim seeks approximately $75,000 in damages. CPI's general liability insurer has accepted the defense of this claim, and CPI's counsel views the claim as defensible. The amount in controversy is below the proposed de minimis threshold of $100,000 per individual claim.
(b) Martinez v. Cardinal Peak Industries, Inc., filed in the General Sessions Court for Davidson County, Tennessee, involving an alleged trip-and-fall incident at CPI's Nashville, Tennessee clinic location. The claim seeks approximately $50,000 in damages. This claim is similarly covered by CPI's general liability insurance and is considered immaterial.
Both premises liability claims are routine in nature, are covered by CPI's existing general liability insurance program, and are individually below the proposed de minimis threshold. These claims do not present material risk to the transaction and, assuming the proposed asset purchase is structured as we recommend, should be treated as excluded liabilities retained by the Seller (as pre-closing claims).
Workers' Compensation Claim. One pending workers' compensation claim has been identified in Georgia, involving a former CPI clinician who alleges a work-related musculoskeletal injury. The claim is being handled through CPI's workers' compensation insurance carrier and represents de minimis exposure to CPI. Workers' compensation claims are typically employer-specific obligations that do not transfer in an asset purchase, and this claim should be excluded from the assumed liabilities.
Confirmation. No other material pending lawsuits involving CPI have been identified in our review. We recommend that the APA include a comprehensive representation and warranty from the Seller confirming the absence of any pending litigation not disclosed on the applicable Disclosure Schedule, and requiring the Seller to update the Disclosure Schedules prior to closing to reflect any new matters that may arise during the interim period.
E. Threatened Litigation
Our review of the data room materials included an examination of demand letters, pre-litigation correspondence, and other communications that might indicate threatened but not-yet-filed litigation.
Wrongful Termination Demand. We identified one demand letter from a former CPI regional director (name redacted in data room materials) alleging wrongful termination in connection with the individual's separation from CPI in November 2023. The demand letter, dated January 8, 2024 and submitted by the individual's personal attorney, seeks approximately $175,000 in severance payments and damages, asserting that the termination was retaliatory and in breach of an alleged oral commitment regarding continued employment. Based on our discussions with CPI management and Seller's counsel at Barrow, Kensington & Pratt LLP, CPI considers this demand to be without substantial merit. CPI management has represented that the individual was terminated for documented performance deficiencies and that no oral commitment regarding employment tenure was made. CPI's counsel has indicated that this matter is unlikely to result in the filing of a lawsuit and that CPI is exploring a modest pre-closing resolution to eliminate any residual risk.
We recommend that this threatened matter be disclosed on the applicable Disclosure Schedule (Schedule 3.14 — Litigation, or equivalent) to ensure full transparency and to protect the Buyer against any claim that the matter was not adequately disclosed. If the matter is resolved prior to closing, the Seller should provide evidence of the resolution to the Buyer, including any release or settlement agreement executed in connection therewith.
Other Threatened Matters. No other demand letters, cease-and-desist communications, or pre-litigation threats of significance were identified in the data room materials. We recommend that the APA include a standard representation and warranty regarding the absence of any additional pending or threatened litigation not disclosed on the applicable Disclosure Schedules.
III. Regulatory Compliance Review — Healthcare Licensing and Certifications
A. State Licensing — Overview
CPI operates a network of 37 outpatient rehabilitation and behavioral health clinics across seven states. The geographic distribution of these facilities is as follows:
Each state in which CPI operates requires facility-specific licenses for the provision of outpatient rehabilitation services and/or behavioral health services. Depending on the state, these licenses may be issued separately for rehabilitation and behavioral health services or may be combined under a single license category. In all cases, the licenses are facility-specific (i.e., issued to a particular location) and are held in the name of the operating entity, Cardinal Peak Industries, Inc.
We reviewed CPI's licensing files in the data room, including copies of current licenses, renewal correspondence, and any historical enforcement or disciplinary records. Our review confirms that all 37 CPI clinic locations hold current, active state licenses. We did not identify any lapsed, suspended, revoked, or conditional licenses at any CPI facility. All licenses have been renewed on a timely basis within the applicable renewal cycles prescribed by each state's licensing authority. A schedule of license numbers, effective dates, and next renewal dates for each of the 37 facilities has been compiled and is maintained in our working files.
B. State Licensing — State-by-State Summary
Set forth below is a state-by-state summary of CPI's licensing status and any notable findings:
Tennessee (14 clinics). CPI's Tennessee facilities are licensed by the Tennessee Department of Health, Division of Health Care Facilities. All 14 Tennessee licenses are current and in good standing. We identified no pending enforcement actions, administrative proceedings, or conditions placed on any Tennessee license. Tennessee licenses are renewed annually, and all renewal filings have been timely submitted. Tennessee is CPI's largest market, accounting for approximately 38% of its clinic locations and a corresponding proportion of its revenues.
Georgia (8 clinics). CPI's Georgia facilities are licensed by the Georgia Department of Community Health. All eight Georgia licenses are current and in good standing. We identified one historical administrative deficiency at CPI's Marietta, Georgia location in 2021, involving a documentation issue related to patient intake records. Specifically, a routine survey by the Georgia Department of Community Health identified instances in which patient intake assessments were not completed within the timeframe prescribed by Georgia administrative regulations. CPI submitted a corrective action plan, which was accepted by the Department, and the matter was closed without the imposition of any fine, penalty, or condition on the facility's license. No other issues have been identified with respect to CPI's Georgia licenses.
North Carolina (5 clinics). CPI's North Carolina facilities are licensed by the North Carolina Department of Health and Human Services, Division of Health Service Regulation. All five North Carolina licenses are current and in good standing. We identified no pending or historical enforcement actions, deficiencies, or conditions on any North Carolina license. North Carolina has a biennial license renewal cycle, and all renewals have been timely submitted.
South Carolina (4 clinics). CPI's South Carolina facilities are licensed by the South Carolina Department of Health and Environmental Control ("DHEC"). All four South Carolina licenses are current and in good standing. No pending or historical enforcement actions, deficiencies, or conditions have been identified.
Alabama (3 clinics). CPI's Alabama facilities are licensed by the Alabama Department of Public Health. All three Alabama licenses are current and in good standing. No pending or historical enforcement actions, deficiencies, or conditions have been identified.
Virginia (2 clinics). CPI's Virginia facilities are licensed by the Virginia Department of Health. Both Virginia licenses are current and in good standing. No pending or historical enforcement actions, deficiencies, or conditions have been identified.
Kentucky (1 clinic). CPI's sole Kentucky facility is licensed by the Kentucky Cabinet for Health and Family Services. The Kentucky license is current and in good standing. No pending or historical enforcement actions, deficiencies, or conditions have been identified.
C. Change-of-Ownership Filing Requirements
The proposed acquisition is structured as an asset purchase, which constitutes a change of ownership ("CHOW") for purposes of state healthcare facility licensing in most, if not all, of the seven states in which CPI operates. State CHOW requirements vary considerably and may include pre-closing notification requirements, post-closing filing obligations, application for new licenses in the name of the Acquisition Sub, or some combination thereof.
The following CHOW filings have been initiated or are being tracked:
(a) Tennessee, Georgia, and North Carolina. State healthcare change-of-ownership notices were filed on March 4, 2024 for Tennessee (14 locations), Georgia (8 locations), and North Carolina (5 locations). These three states account for 27 of CPI's 37 clinic locations and were prioritized due to the volume of facilities and the relative complexity of their respective CHOW processes. The Tennessee Department of Health, the Georgia Department of Community Health, and the North Carolina Division of Health Service Regulation have each acknowledged receipt of the initial filings. Follow-up submissions, including new license applications in the name of the Acquisition Sub, will be filed in coordination with the closing timeline.
(b) South Carolina, Alabama, Virginia, and Kentucky. Additional CHOW filings are required or expected for the remaining four states. Hargrove, Sinclair & Demarest LLP (Angela Demarest) is coordinating the preparation and submission of these filings. The timing and specific requirements for each state are being tracked and will be addressed in detail in the joint Healthcare Regulatory Compliance Memorandum, which is expected to be delivered on or about March 20, 2024.
For purposes of the APA, we recommend that the receipt of all required state change-of-ownership approvals (or, where applicable, satisfactory evidence that post-closing filing is permissible under applicable state law) be included as a closing condition. This is discussed further in Section VII.B below.
D. Medicare and Medicaid Certifications
CPI participates in the Medicare program (administered by the Centers for Medicare & Medicaid Services, or "CMS") and in the Medicaid programs of the seven states in which it operates. Government payors — Medicare and Medicaid combined — represent approximately 31% of CPI's net revenue. Given the significance of government payor revenue to CPI's business, the maintenance of Medicare and Medicaid provider enrollment and certifications is critical to the value of the acquired assets.
Current Enrollment Status. Our review of CPI's Medicare provider enrollment records and Medicaid provider agreements confirms that all 37 clinic locations hold active Medicare provider enrollment under the CMS Provider Enrollment, Chain, and Ownership System ("PECOS"). Additionally, CPI maintains active Medicaid provider agreements in each of the seven states in which it operates, to the extent that the specific services offered at each location are covered under the applicable state Medicaid program. We identified no current Medicare or Medicaid exclusions, suspensions, or pending revocable sanctions against CPI or against any individual clinician employed by CPI based on our searches of the OIG exclusion database (LEIE), the SAM exclusion database, and CPI's own compliance records.
Revalidation History. CPI's most recent Medicare revalidation cycle was completed in 2022. Under current CMS revalidation requirements, Medicare-enrolled providers are subject to revalidation every five years. Accordingly, CPI's next revalidation is expected in approximately 2027. CPI's Medicare enrollment appears to be in good standing, and no issues or deficiencies were identified in connection with the 2022 revalidation.
Post-Closing Provider Enrollment. Following the closing of the asset purchase, the Acquisition Sub (Ardent Healthcare Acquisition Corp.) will need to enroll as the new Medicare and Medicaid provider for all 37 clinic locations, or effectuate a change of information filing reflecting the new ownership. This process requires the submission of CMS-855 series enrollment forms (CMS-855B for clinics/group practices) and corresponding state Medicaid enrollment applications. The provider enrollment process can take several weeks to several months, depending on the efficiency of the applicable CMS Medicare Administrative Contractor ("MAC") and state Medicaid agencies.
Billing Gap Risk. A significant operational risk associated with the change of provider enrollment is the potential for a gap in Medicare and Medicaid billing authority during the transition period. If the Acquisition Sub's Medicare and Medicaid enrollment is not effective as of the closing date, the Acquisition Sub may not be able to bill Medicare or Medicaid for services rendered until the enrollment is approved. To mitigate this risk, we recommend that the Transition Services Agreement ("TSA") include provisions under which CPI continues to bill Medicare and Medicaid under its existing provider numbers during the transition period, with appropriate arrangements for the remittance of collected receivables to the Acquisition Sub. The TSA billing arrangement should be carefully structured to comply with applicable Medicare and Medicaid anti-assignment rules and CMS guidance regarding change-of-ownership billing. Angela Demarest at Hargrove, Sinclair & Demarest LLP is advising on the specific structuring of these TSA provisions.
E. Prior Survey and Inspection Results
We reviewed state survey and inspection reports for CPI's 37 facilities covering the five-year period from 2019 through the present. State survey and inspection processes vary by state but generally involve periodic on-site inspections by state licensing authorities to assess compliance with applicable regulations governing facility operations, patient care, staffing, documentation, safety, and related requirements.
Overall Assessment. CPI's survey and inspection history is clean and consistent with well-managed multi-site healthcare operations. No facility closures, license revocations, or conditions placed on any CPI license were identified during the review period. CPI's facilities have generally received satisfactory survey results, with only two minor deficiencies noted across the entire 37-facility portfolio over the past five years.
Identified Deficiencies. The two minor survey deficiencies identified are as follows:
(a) Georgia — Marietta Location (2021). As discussed in Section III.B above, a routine survey by the Georgia Department of Community Health identified a documentation deficiency at CPI's Marietta, Georgia clinic. The deficiency involved instances in which patient intake assessments were not completed within the timeframe prescribed by applicable Georgia administrative regulations. CPI submitted a corrective action plan, which was reviewed and accepted by the Department. The matter was closed without the imposition of any fine, penalty, or condition on the facility's license.
(b) Tennessee — Murfreesboro Location (2022). A routine state inspection of CPI's Murfreesboro, Tennessee clinic identified a minor fire safety code citation. The citation related to the placement of certain storage materials in a manner that partially obstructed a designated egress pathway. CPI corrected the deficiency within 30 days of the citation, and the Tennessee Department of Health confirmed that the corrective action was satisfactory. No fine was imposed, and no follow-up inspection was required.
Neither of these deficiencies is material to the transaction, and both were resolved in the ordinary course of CPI's operations. The overall survey and inspection record supports the conclusion that CPI maintains its facilities in compliance with applicable state regulations and industry standards.
IV. Regulatory Compliance Review — Federal Healthcare Laws
A. Anti-Kickback Statute and Stark Law
CPI's operations involve referral relationships with physicians, hospitals, and other healthcare providers who refer patients to CPI's outpatient rehabilitation and behavioral health clinics. These referral relationships implicate two principal federal healthcare fraud and abuse statutes:
(a) The Federal Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)) prohibits the knowing and willful offer, payment, solicitation, or receipt of any remuneration to induce or reward referrals of items or services payable by a federal healthcare program.
(b) The Physician Self-Referral Law (the "Stark Law," 42 U.S.C. § 1395nn) prohibits a physician from making referrals for certain designated health services payable by Medicare to an entity with which the physician (or an immediate family member) has a financial relationship, unless an exception applies.
Violations of the Anti-Kickback Statute may result in criminal penalties (fines and imprisonment), civil monetary penalties, and exclusion from federal healthcare programs. Violations of the Stark Law may result in denial of payment, refund obligations, civil monetary penalties, and exclusion from federal healthcare programs. Both statutes have been the subject of vigorous enforcement by the Department of Justice ("DOJ") and the HHS Office of Inspector General ("OIG") in recent years.
Review Findings. We reviewed the following materials in the data room relating to CPI's referral arrangements and compliance with these statutes:
• CPI's standard physician referral agreements and marketing agreements;
• CPI's arrangements with hospitals and health systems for patient referrals;
• CPI's physician compensation arrangements (to the extent CPI employs or contracts with referring physicians);
• CPI's corporate compliance program, including compliance policies and procedures, the compliance officer's annual reports, and compliance training records; and
• CPI's marketing and promotional materials and practices.
CPI maintains a corporate compliance program overseen by a designated Chief Compliance Officer. The compliance program includes written policies and procedures addressing referral relationships, physician compensation arrangements, and anti-kickback and Stark Law compliance. The compliance program appears to be reasonably designed and consistent with industry practice for a multi-site outpatient healthcare provider of CPI's size and scope.
Based on our review of the materials available in the data room, we have not identified any specific violations of the Anti-Kickback Statute or the Stark Law. However, we wish to note the following caveats:
(i) Our review of CPI's referral arrangements and physician compensation structures is ongoing and is being conducted in close coordination with Angela Demarest at Hargrove, Sinclair & Demarest LLP, who brings specialized expertise in healthcare regulatory compliance. A more detailed analysis of CPI's compliance with the Anti-Kickback Statute and the Stark Law will be provided in the joint Healthcare Regulatory Compliance Memorandum, expected on or about March 20, 2024.
(ii) Anti-Kickback Statute and Stark Law compliance is inherently fact-intensive and cannot be definitively confirmed through a document review alone. The absence of identified violations in the data room does not constitute a guarantee that no violations exist. Accordingly, we recommend robust representations and warranties in the APA regarding compliance with federal healthcare fraud and abuse laws, supported by appropriate disclosure schedule exceptions for any arrangements that may present compliance risk.
B. False Claims Act
The federal False Claims Act (31 U.S.C. §§ 3729-3733) imposes civil liability on any person who knowingly submits false or fraudulent claims for payment to the federal government, or who causes such claims to be submitted. In the healthcare context, False Claims Act liability can arise from range conduct, including billing for services not rendered, upcoding, unbundling, billing for medically unnecessary services, and billing tainted by violations of the Anti-Kickback Statute or the Stark Law. The False Claims Act authorizes treble damages and per-claim penalties, and is frequently enforced through qui tam actions brought by private whistleblowers (known as "relators") on behalf of the government.
Review Findings. Our review of the data room materials and our discussions with CPI management and Seller's counsel have yielded the following findings:
• No pending or historical *qui tam* / False Claims Act actions. We have not identified any pending or historical qui tam lawsuits or other False Claims Act actions against CPI. CPI management has represented that CPI has not been a defendant in any such action.
• No Civil Investigative Demands or government subpoenas. We have not identified any Civil Investigative Demands ("CIDs") or subpoenas from the DOJ, HHS-OIG, or any state Medicaid Fraud Control Unit directed at CPI. CPI management has represented that CPI has not received any such demands or subpoenas.
• No whistleblower complaints. CPI management has represented that CPI has not received any internal or external whistleblower complaints under the False Claims Act or any state false claims act equivalent. CPI's corporate compliance program includes a mechanism for employees to report potential compliance concerns (including an anonymous compliance hotline), and the compliance officer's annual reports, which we reviewed in the data room, do not reflect any reports of suspected false claims or billing fraud.
We note that qui tam actions may be filed under seal and remain unknown to the defendant for extended periods (sometimes years) while the government investigates and decides whether to intervene. Accordingly, the absence of known qui tam actions does not eliminate the possibility that a sealed qui tam action exists. This inherent limitation underscores the importance of robust False Claims Act representations and warranties in the APA, as discussed in Section VII below.
We recommend that the APA include a standard representation and warranty confirming the absence of any pending or threatened False Claims Act actions, government investigations, CIDs, and related matters, with appropriate qualification for the Seller's knowledge.
C. HIPAA Compliance
CPI handles protected health information ("PHI") of patients across its 37 clinic locations in the ordinary course of providing outpatient rehabilitation and behavioral health services. As a "covered entity" under HIPAA, CPI is subject to the requirements of the HIPAA Privacy Rule (45 C.F.R. Part 160 and Subparts A and E of Part 164), the HIPAA Security Rule (45 C.F.R. Part 160 and Subparts A and C of Part 164), and the HIPAA Breach Notification Rule (45 C.F.R. Part 160 and Subpart D of Part 164), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH Act").
HIPAA Compliance Program. CPI maintains a HIPAA compliance program that includes the following elements:
• A designated Privacy Officer responsible for overseeing compliance with the HIPAA Privacy Rule and the HIPAA Breach Notification Rule;
• A designated Security Officer responsible for overseeing compliance with the HIPAA Security Rule;
• Written privacy and security policies and procedures that address the use and disclosure of PHI, patient rights regarding PHI, administrative safeguards, physical safeguards, technical safeguards, and breach notification procedures;
• Employee training on HIPAA privacy and security requirements, conducted at onboarding and on an annual basis;
• Business Associate Agreements with vendors and service providers that create, receive, maintain, or transmit PHI on CPI's behalf; and
• A breach notification log and incident response procedures for identifying, investigating, and reporting potential breaches of unsecured PHI.
Based on our review of the data room materials, CPI's HIPAA compliance program appears to be reasonably designed and maintained. The policies and procedures we reviewed are consistent with industry standards for outpatient healthcare providers.
HIPAA Breach History. We reviewed CPI's breach notification log and identified two HIPAA breach incidents reported to the U.S. Department of Health and Human Services ("HHS") within the past three years:
(a) 2021 — Misdirected Fax Incident. In 2021, an employee at a single CPI clinic location inadvertently transmitted a fax containing PHI of approximately 12 individuals to an incorrect fax number. The misdirected fax was sent to a number belonging to an unrelated business, which promptly notified CPI and confirmed destruction of the received documents. CPI investigated the incident, determined that it constituted a breach of unsecured PHI under the HIPAA Breach Notification Rule, and reported the breach to HHS and to the affected individuals in accordance with the applicable notification requirements. The HHS Office for Civil Rights ("OCR") did not initiate an investigation or enforcement action in connection with this incident. CPI implemented additional safeguards, including enhanced fax verification procedures, to prevent recurrence.
(b) 2023 — Lost Unencrypted Laptop Incident. In 2023, a CPI employee's laptop computer containing PHI of approximately 87 individuals was lost. The laptop was not encrypted at the time of the loss. CPI investigated the incident and determined that it constituted a breach of unsecured PHI. Because the breach affected fewer than 500 individuals, CPI reported the breach to HHS on an annual basis in accordance with the Breach Notification Rule's reporting requirements for smaller breaches (45 C.F.R. § 164.408). CPI also provided individual notification to the 87 affected individuals in accordance with 45 C.F.R. § 164.404. Following the incident, CPI implemented additional encryption protocols for all employee laptops and mobile devices and conducted supplemental security awareness training for employees. HHS OCR did not initiate an investigation or enforcement action in connection with this incident.
Neither of the above incidents resulted in the imposition of any penalty, resolution agreement, corrective action plan, or other enforcement action by HHS OCR. Both incidents were minor in scope and were handled in accordance with CPI's established breach response procedures and applicable HIPAA requirements.
PeakConnect Patient-Engagement Platform. CPI operates a proprietary patient-engagement software platform known as PeakConnect (U.S. Trademark Registration No. 5,412,887). PeakConnect is used across CPI's 37 clinic locations to facilitate patient scheduling, communications, intake processing, and certain clinical documentation functions. The platform handles PHI and is therefore subject to the requirements of the HIPAA Security Rule. CPI management has represented that PeakConnect is compliant with applicable HIPAA Security Rule standards, including the implementation of appropriate administrative, physical, and technical safeguards. We have not conducted an independent technical assessment of PeakConnect's security architecture; such an assessment, if desired by the Buyer, would typically be performed by the Buyer's information technology or cybersecurity team, potentially with the assistance of a third-party security assessor.
Post-Closing HIPAA Considerations. The post-closing transition period will involve CPI's continued access to and handling of PHI in connection with the Transition Services Agreement. During the TSA period, CPI will be functioning in a capacity analogous to a "business associate" of the Acquisition Sub with respect to any PHI it accesses or handles on the Acquisition Sub's behalf. Accordingly, a Business Associate Agreement ("BAA") between the Acquisition Sub and CPI will be required to govern CPI's use and disclosure of PHI during the TSA period. The BAA should be appended to or incorporated by reference in the Transition Services Agreement and should satisfy the requirements of 45 C.F.R. § 164.504(e).
APA Recommendations. We recommend that the APA include comprehensive representations and warranties from the Seller regarding HIPAA compliance, including representations regarding the maintenance of a HIPAA compliance program, the absence of material HIPAA violations, the absence of pending OCR investigations or enforcement actions, and compliance with breach notification requirements. The two reported breach incidents described above should be disclosed on the applicable Disclosure Schedule as exceptions to the HIPAA compliance representation.
V. Other Regulatory Matters
A. Employment and Labor Compliance (Beyond Dawson)
As noted in Section II above, CPI employs approximately 2,100 employees across seven states, comprising approximately 1,450 licensed clinicians and approximately 650 administrative and support staff. CPI's multi-state operations implicate a broad range of federal and state employment and labor law requirements, including wage-and-hour laws, anti-discrimination statutes, workplace safety regulations, and employee benefits laws.
Employee Handbook and Policies. We reviewed CPI's employee handbook and related employment policies in the data room. The handbook addresses, among other topics, equal employment opportunity, anti-harassment and anti-discrimination, leave policies, compensation and pay practices, timekeeping procedures, and employee classification. The handbook appears to be professionally drafted and generally consistent with industry standards, although we note that its treatment of employee classification (exempt vs. non-exempt) and overtime policies should be reviewed in light of the issues raised by the Dawson litigation.
Wage-and-Hour Compliance. The Dawson litigation, discussed in detail in Section II, highlights potential systemic issues with CPI's wage-and-hour compliance practices, including timekeeping, overtime compensation, and employee classification. While the Dawson litigation is the only formal proceeding currently pending on these issues, the allegations in that case — if proven — would suggest that the underlying compliance deficiencies may be company-wide rather than limited to any single location or employee. We therefore recommend that the Buyer plan to conduct an enhanced post-closing review of CPI's timekeeping and payroll practices across all 37 clinic locations, potentially including a retention of an independent payroll and classification consultant to audit CPI's practices and recommend corrective measures as needed.
EEOC and State Agency Charges. Our review did not identify any pending charges with the U.S. Equal Employment Opportunity Commission ("EEOC") or any state human rights commission or civil rights enforcement agency. The only employment-related threatened claim is the wrongful termination demand letter discussed in Section II.E above.
ERISA and Employee Benefits. CPI sponsors a 401(k) retirement savings plan for eligible employees. Under the proposed asset purchase structure, CPI's 401(k) plan and all related liabilities will constitute excluded liabilities retained by the Seller. Our review did not identify any Employee Retirement Income Security Act of 1974 ("ERISA") compliance issues that would adversely affect the asset purchase or give rise to successor liability for the Buyer. Post-closing, the Acquisition Sub will establish its own employee benefit programs for employees who transition to the Acquisition Sub's employment.
B. Environmental Compliance
Whitmore Environmental Sciences Inc., an independent environmental consulting firm based in Atlanta, Georgia, has been engaged to review environmental compliance matters in connection with the proposed transaction. Their review is ongoing, and we summarize below the preliminary findings relevant to the litigation and regulatory risk assessment.
Environmental Risk Profile. CPI operates outpatient rehabilitation and behavioral health clinics. Unlike hospitals, surgical centers, or manufacturing facilities, outpatient clinics generally present a low environmental risk profile. CPI's facilities do not involve significant hazardous materials usage, industrial processes, or underground storage tanks. The primary environmental considerations for CPI's operations are limited to medical waste management (including sharps disposal and limited pharmaceutical waste) and general compliance with workplace safety and environmental regulations applicable to commercial office and clinic settings.
Real Property. CPI does not own any real property. All 37 clinic locations are operated under triple-net lease arrangements. Because CPI is a tenant rather than an owner, the environmental liabilities associated with the underlying real property (e.g., soil contamination, groundwater contamination, environmental remediation obligations) are generally the responsibility of the respective landlords under the lease agreements. Phase I environmental site assessments were not conducted for the leased properties, as this was deemed unnecessary given CPI's tenant status and the low environmental risk profile of outpatient clinic operations.
Environmental Compliance Findings. No known environmental contamination, remediation obligations, or pending environmental enforcement actions have been identified in connection with any CPI facility. CPI's behavioral health clinics may involve limited pharmaceutical waste from the administration or dispensing of medications, and CPI represents that it complies with applicable pharmaceutical waste disposal regulations, including those promulgated by the U.S. Environmental Protection Agency ("EPA") under the Resource Conservation and Recovery Act ("RCRA"). We do not view environmental compliance as a material risk factor for this transaction.
C. Data Privacy and State Consumer P

MEMORANDUM

PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

MATTER NO.: 2024-M&A-0142

Record

Parties

Dates

Amounts