HSTM · CIK 0001095565
What HealthStream, Inc. told the SEC could break it.
HealthStream's disclosures revolve around being a SaaS provider tied to a single industry and the sensitive data it holds. It sells almost entirely to U.S. healthcare organizations, so its demand rides on that one sector's spending, reimbursement, and budgets. Because it hosts sensitive healthcare-workforce data, it faces cyberattack and business-interruption risk — and warns its cyber-liability and business-interruption insurance may exclude claims or fall short of losses — alongside evolving internet and healthcare privacy and data-security regulation that could raise costs or create liability. Its platform also depends on third-party data centers and cloud infrastructure to store data and connect it to the internet, so a provider failure could disrupt service.
4 self-disclosed vulnerabilities, pulled from its own filings, each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Cybersecurity
- data-breach/business-interruption risk with possibly insufficient insurancemedium
As a SaaS provider hosting sensitive healthcare-workforce data, HealthStream faces cyberattack and business-interruption risk, and its cyber-liability/business-interruption insurance may exclude certain claims or be insufficient to cover losses.
“Our cyber liability and business interruption insurance may not adequately compensate us for losses that may occur and may exclude certain types of claims or otherwise be insufficient to cover all losses.”
SEC filing →As of 2026
Other disclosures
- customer base concentrated in the U.S. healthcare industrymedium
HealthStream sells its products and services almost entirely to U.S. healthcare-industry organizations, tying demand to healthcare-sector spending, reimbursement and budget conditions in a single industry and geography.
“The Company sells its products and services to various companies in the healthcare industry that are primarily located in the United States.”
SEC filing →As of 2026
Regulatory & policy
- internet and healthcare privacy/data-security regulationmedium
HealthStream is subject to evolving legal requirements governing the internet and the privacy/security of personal (including healthcare) information; changes or non-compliance could raise costs and create liability for its SaaS handling of sensitive data.
“We are subject to various legal requirements related to the Internet and the privacy and security of personal information, which legal requirements may ch”
SEC filing →As of 2026
Supplier concentration
- reliance on third-party data centers and cloud infrastructure to host SaaSmedium
HealthStream's SaaS applications run on third-party data-center providers and cloud infrastructure that store its data, house its network systems and connect it to the internet; failure by these providers to deliver services satisfactorily could disrupt its platform.
“we rely on third parties to securely store our archived data, house our infrastructure and network systems, and connect us to the Internet.”
SEC filing →As of 2026
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch