EHAB · CIK 0001803737
What Enhabit, Inc. told the SEC could break it.
Enhabit's defining exposure is its dependence on Medicare: in 2025 Medicare was 55.9% of Home Health and 98.2% of Hospice net service revenue, so its results hinge on CMS's annual rate-setting (the 2026 Hospice Rule's 2.6% net increase, Home Health PPS rules), the ongoing 2% Medicare sequestration and hospice payment caps. Within that, a continuing shift toward typically lower-paying Medicare Advantage plans — up to about 31% of Home Health revenue — pressures its rate mix and revenue per visit. It is also party to a merger agreement that would result in a change of control, with the usual closing, regulatory and integration uncertainty, and it depends on third-party-hosted IT systems handling protected health information, exposing it to cyber and HIPAA risk.
4 self-disclosed vulnerabilities, pulled from its own filings, each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Customer concentration
- payer concentration — Medicare ~56% (Home Health) / ~98% (Hospice) of revenue; Medicare Advantage growing to ~31% with lower rateshigh
Enhabit's revenue is concentrated among government and government-sponsored payers — Medicare was 55.9% of Home Health and 98.2% of Hospice net service revenue in 2025, with Medicare Advantage rising to 31.1% of Home Health revenue — so the continuing shift toward typically lower-paying Medicare Advantage plans, and dependence on a few payer programs, pressures its rate mix and revenue per visit and concentrates reimbursement risk.
“in the year ended December 31, 2024, Medicare Advantage patients accounted for 23.0% of our revenue as compared to 23.9% for the year ended December 31, 2025.”
SEC filing →As of 2026
Cybersecurity
- dependence on third-party (business-associate/vendor) IT systems for patient care, coding, billing and PHI; HIPAA data-security obligationsmedium
Enhabit depends on the proper function, availability and security of its information systems — including systems provided or hosted by business associates, external contractors and vendors — for patient care, coding, accounting, billing, collections, quality assurance, HR and payroll, which involve sensitive protected health information (PHI); a cyberattack, system failure, or third-party breach could disrupt operations and trigger HIPAA liability, reputational harm and remediation costs.
“We are and will remain dependent on the proper function, availability, and security of our information systems, including systems provided by or hosted by business associates, external contractors, vendors and other businesses with whom we interact.”
SEC filing →As of 2026
Other disclosures
- pending merger / change of control — completion, regulatory-approval and integration uncertaintymedium
Enhabit is party to a Merger Agreement that, if completed, will result in a change of control of the Company; the pendency and completion of the merger create uncertainty (anti-takeover provisions are made inapplicable to the deal), and failure to close, regulatory conditions, or post-closing integration could affect operations, employee retention and stockholder value.
“We are party to the Merger Agreement, which will result in a change of control of the Company, if completed.”
SEC filing →As of 2026
Regulatory & policy
- heavy dependence on Medicare reimbursement subject to annual CMS rulemaking, sequestration, HH-PPS/Hospice-PS rules and hospice payment capsmedium
Enhabit derives a substantial portion of revenue from Medicare (≈56% of Home Health and ≈98% of Hospice revenue), so its results are heavily affected by Medicare reimbursement-rate changes — annual CMS rulemaking (e.g. the 2026 Hospice Rule's 2.6% net increase, HH-PPS rules), the ongoing 2% sequestration of Medicare payments, hospice aggregate/inpatient payment caps, and Conditions of Participation; adverse reimbursement cuts or new healthcare regulation could materially reduce net service revenue.
“We derive a substantial portion of our Net service revenue from the Medicare program. In addition to reimbursement rate changes resulting from CMS's annual rulemaking processes, Congress and certain state legislatures periodically propose significant changes in laws and regulations governing the healthcare system”
SEC filing →As of 2026
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch