GRDN · CIK 0001802255
What Guardian Pharmacy Services, Inc. told the SEC could break it.
Guardian Pharmacy's defining exposure is its reliance on a single government program: about 71% of its 2025 revenue came from Medicare Part D, so even though no individual customer tops 10%, its results hinge on that one reimbursement source. That makes regulation central — as a Part D long-term-care (NLTCP) provider it must meet CMS-mandated rules and service capabilities, and changes to CMS reimbursement or requirements could raise its costs or impair its eligibility. Handling protected health information also subjects it to HIPAA and increasingly strict state privacy laws, where a breach could bring fines and lost customers, and its Founders retain control through Class B stock, letting them determine substantially all stockholder matters under NYSE controlled-company exemptions.
4 self-disclosed vulnerabilities, pulled from its own filings, each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Customer concentration
- ~71% of revenue from Medicare Part Dhigh
Although no single customer exceeds 10% of revenue, ~71% of 2025 revenue came from Medicare Part D, concentrating exposure to one government reimbursement program.
“for the year ended December 31, 2025, approximately 71% of our revenue was derived from Medicare Part D.”
SEC filing →As of 2026
Cybersecurity
- PHI handling under HIPAA and state privacy lawsmedium
Guardian's operations involve protected health information; failure to comply with HIPAA and increasingly strict state privacy laws could trigger breach notifications, fines, criminal penalties and loss of customers.
“equivalent laws could subject us to loss of customers, breach notification requirements, denial of the right to conduct business, civil damages, fines, criminal penalties and other enforcement actions.”
SEC filing →As of 2026
Key person
- Guardian Founders control via Class B; controlled-company exemptionsmedium
The Guardian Founders can determine the outcome of substantially all stockholder matters (charter, mergers, asset sales) and the company relies on NYSE controlled-company governance exemptions.
“Guardian Founders are able to determine the outcome of substantially all matters requiring action by our stockholders, including amendments to our certificate of incorporation and bylaws, any proposed merger, consolidation or sale of all or substantially all of our assets and other corporate transactions, even if such actions are not favored by our other stockholders.”
SEC filing →As of 2026
Regulatory & policy
- CMS Part D NLTCP provider rules & reimbursementmedium
Participation as a Part D long-term-care pharmacy (NLTCP) requires meeting CMS's mandated rules and service capabilities; changes to CMS reimbursement or requirements could raise costs or impair eligibility.
“CMS mandates 10 rules and service capabilities to qualify for 15 Table of Contents participation as a Part D NLTCP provider, as differentiated from traditional Part D and commercial reimbursement.”
SEC filing →As of 2026
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch