Paragraphs with nothing like them in last year's 10-K
Quoted exactly
14 paragraphs in Risk Factors of the 10-K filed Feb 17, 2026
with nothing like them in the 10-K filed Feb 18, 2025. Quoted exactly.
Paragraphs that were only edited are under 10-K change.
the EHR and PM systems of our clients, which could be costly and time consuming, and could adversely affect our business results.
Any adverse impact to the availability, integrity, or confidentiality of our information technology systems or data, or the information technology systems or data of third parties upon which we rely, could require us to expend significant resources to mitigate the breach of security, pay any applicable fines, and address matters related to any such breach, including notifying impacted individuals, the media, or regulators, making public disclosures, and addressing reputational harm.
We have integrated AI and machine learning technologies into our products and solutions, and our future success will depend, in part, on our ability to leverage these technologies responsibly and effectively. The development and use of
AI subjects us to risks that could adversely affect our business, financial condition and results of operations, and use of such technologies may not enhance our products or solutions, allow us to keep pace with competitors or benefit our business as intended. As these technologies are rapidly developing, it is not possible to predict all of the legal, operational, competitive, security, technological and other risks that may arise relating to the use of such technologies.
Our AI-enabled solutions depend on the quality and completeness of training data, and deficiencies could result in inaccurate, misleading, unreliable, or biased outputs that could harm our clients or expose us to liability. AI technologies are inherently complex, and our AI systems may not perform as intended, or may degrade in performance over time due to changes in underlying data, payer requirements, market conditions or for other reasons. Validating AI outputs requires substantial resources and consistent, reliable performance across diverse client environments and use cases is difficult. Any actual or perceived failures of our AI-enabled solutions could result in client dissatisfaction, claims against us, regulatory scrutiny, or reputational harm.
Our clients may impose contractual restrictions on our use of AI, or seek indemnification for AI-related errors, any of which could limit the value of our AI-enabled solutions or expose us to liability. Client reluctance to adopt AI features due to accuracy, liability, or regulatory concerns could also slow our ability to realize returns on our AI investments.
Moreover, AI is subject to a dynamic and rapidly evolving legal and regulatory environment, and our efforts, including the introduction of new products or changes to existing products, may result in new or enhanced governmental or regulatory scrutiny, litigation, ethical concerns, or other complications and liabilities. We may not be able to successfully respond to these rapidly evolving frameworks, laws, regulations and other requirements, and we may need to expend significant resources to adjust our operations or offerings in response.
The rapid advancement of generative and agentic AI also poses competitive risks. Large technology companies with significantly greater resources are deploying AI tools that could commoditize revenue cycle management functions core to our platform, and competitors may also adopt or deploy AI more quickly or effectively than we do. Agentic AI systems could automate workflows our clients currently rely on us to perform, and EHR and PM vendors may integrate AI capabilities directly into their platforms, reducing demand for our solutions. Generative AI may also lower barriers to entry, enabling new competitors to emerge more quickly. If we fail to keep pace with AI advancements or our AI-enabled solutions do not achieve market acceptance, our competitive position could be materially harmed.
business. Even if we are successful in defending against these claims, litigation could result in substantial cost and be a distraction to our management and employees.
We are a “covered entity” as defined under HIPAA when we provide our clearinghouse services, and we also are a “business associate” as defined under HIPAA for other covered entities when we provide revenue cycle management and other solutions. HHS OCR may impose civil penalties on both covered entities and business associates for their failure to
Show the other 3
expect even greater scrutiny by federal and state regulators, partners, and consumers of our Processing of health information, particularly with our AI-enabled solutions. Additionally, federal and state consumer protection laws are increasingly being applied by the FTC and states’ attorneys general to regulate the Processing of personal information, through websites or otherwise, and to regulate the presentation of website content.
As a public company, we are subject to significant requirements for enhanced financial reporting and internal controls. The process of designing and maintaining effective internal controls is a time consuming, costly, and continuous effort that requires us to anticipate and react to changes in our business and the economic and regulatory environments. If
we are unable maintain appropriate internal financial reporting controls and procedures, it could cause us to fail to meet our reporting obligations on a timely basis, result in material misstatements in our consolidated financial statements, expose us to increased risk of fraud or reputational harm, or harm our results of operations.
the holders of at least 662∕3% of the shares of common stock entitled to vote generally in the election of directors; and
The 10-Q's risk factors against the 10-K
Item 1A of the 10-Q filed Nov 2, 2026 against Item 1A of the 10-K filed Feb 17, 2026.
A 10-Q repeats only the risks that changed, so a 10-K paragraph that is missing from it is not counted as removed.
Added is a paragraph with nothing like it in the 10-K, Reworded a sentence that is in both with several words changed,
Quiet changes a sentence in both where one to four words changed and one is a hedge or a modal
(cut words struck through, new words highlighted).
Text on the page, not a score; each links to the filing at sec.gov.
What the 10-Q itself says about its risk factors:Our business, results of operations, prospects, and financial condition may be materially adversely affected by a number of factors, whether currently known or unknown, including those described in Part I, Item 1A "Risk Factors" of the 2025 Form 10-K, as updated by Part II, Item 1A “Risk Factors” of our Quarterly Report on Form 10-Q for the quarterly period ended June 30, 2026. Except as set forth below, there have been no material changes to the risk factors disclosed in the 2025 Form 10-K, as updated.
Read in the 10-Qopen_in_new
Added10-Q Nov 2, 2026 vs 10-K Feb 17, 2026
We and certain of our third-party providers have experienced cyber-attacks and other incidents, and we expect such attacks and incidents to continue in varying degrees in the future. For example, in early June 2026, we identified the unauthorized acquisition of point-in-time copies of source code, primarily used for testing purposes, from a cloud-based repository hosted by a third-party provider and the unauthorized acquisition of four files of inactive data from a single application, which had been written to cloud-based storage pending its scheduled destruction. The incident was promptly contained and did not involve any access to active production systems or client data being processed by any active Waystar products. The application-related data and, we believe, the subset of source code in the third-party code repository platform used for testing purposes included PHI and personally identifiable information associated with fewer than 1% of Waystar clients. We immediately activated incident response procedures, initiated an investigation, engaged leading external cybersecurity experts, notified law enforcement, and took steps to contain, assess, and remediate the incident. We are also in the process of communicating with the relevant clients and will comply with any applicable legal obligations. The incident did not impact the operation of our software solutions, the ability of clients to access our cloud-based software platform, or any functions of our financial and operating reporting systems. While to date, we have no evidence that the affected information has been misused, the threat actor may use or disclose the information that was subject to unauthorized access and acquisition in a manner that adversely affects our business. We may also discover additional impacts of this or other incidents as part of that investigation. While our response efforts are ongoing, we believe this incident has not had, and is not reasonably likely to have, any material adverse effect on our operations or financial condition, and we expect that a portion of costs incurred relating to containing, investigating and remediating the incident will be reimbursed through insurance recoveries. Despite these expectations, there can be no assurances as to the ultimate impact of this incident, which may result in harm to our reputation and client relationships.
Read it in the 10-Q at sec.govopen_in_new
Added10-Q Nov 2, 2026 vs 10-K Feb 17, 2026
Techniques used to gain unauthorized access to or acquisitions of data and systems, disable or degrade service, or sabotage systems, are constantly evolving (including through the use of AI), and we are unable to anticipate all techniques
Read it in the 10-Q at sec.govopen_in_new
Reworded10-Q Nov 2, 2026 vs 10-K Feb 17, 2026
In addition to extracting personal information and other sensitive or confidential information, such attacks could include involve the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering, and other means to affect service reliability and threaten the confidentiality, integrity, security, and availability of our information or information technology systems.
Read it in the 10-Q at sec.govopen_in_newThe 10-K sentenceopen_in_new
Reworded10-Q Nov 2, 2026 vs 10-K Feb 17, 2026
We collect, create, receive, maintain, process, use, transmit, disclose, transfer, alter, and store (collectively, “Process”) significant amounts of patients' personal information (including PHI) received in connection with the utilization of our platform and otherwise in connection with the operation of our business, as well as other sensitive, confidential, and proprietary information such as trade secrets, source code and payment data.
Read it in the 10-Q at sec.govopen_in_newThe 10-K sentenceopen_in_new
Reworded10-Q Nov 2, 2026 vs 10-K Feb 17, 2026
In addition, some of our third-party service providers and vendors also Process our personal information confidential and other sensitive information such as our clients’ data on our behalf.
Read it in the 10-Q at sec.govopen_in_newThe 10-K sentenceopen_in_new
Show the other 1
Quiet changes10-Q Nov 2, 2026 vs 10-K Feb 17, 2026
Any A substantially adverse impact to the availability, integrity, or confidentiality of our information technology systems or data, or the information technology systems or data of third parties upon which we rely, could require us to expend significant resources to mitigate the breach of security, pay any applicable fines, and address matters related to any such breach, including notifying impacted individuals, the media, or regulators, making public disclosures, and addressing reputational harm.
Read it in the 10-Q at sec.govopen_in_newThe 10-K sentenceopen_in_new
In connection with the implementation of the necessary procedures and practices related to internal control over financial reporting, we may identify deficiencies that we may not be able to remediate in time to meet the deadline imposed by the Sarbanes-Oxley Act for compliance with the requirements of Section 404. In addition, we may encounter problems or delays in completing the remediation of any deficiencies identified by us or our independent registered public accounting firm in connection with the issuance of their attestation report. Our testing, or the subsequent testing (if...
In the 10-K filed Feb 18, 2025open_in_new
We cannot predict whether investors will find our common stock less attractive if we rely on the exemptions and relief granted by the JOBS Act. For example, if we do not adopt a new or revised accounting standard, our future results of operations may not be as comparable to the results of operations of certain other companies in our industry that adopted such standards. If some investors find our common stock less attractive as a result, there may be a less active trading market for our common stock, and our stock price may decline and/or become more volatile.
In the 10-K filed Feb 18, 2025open_in_new
In addition, Section 107 of the JOBS Act provides that an emerging growth company can take advantage of the extended transition period provided in Section 7(a)(2)(B) of the Securities Act for complying with new or revised accounting standards, meaning that we can delay the adoption of certain accounting standards until those standards would otherwise apply to private companies. We have elected to take advantage of this extended transition period, and as a result, our financial statements may not be comparable with similarly situated public companies.
In the 10-K filed Feb 18, 2025open_in_new
We will remain an “emerging growth company” until the earliest to occur of (1) our reporting of $1.24 billion or more in annual gross revenue; (2) our becoming a “large accelerated filer,” with at least $700 million of equity securities held by non-affiliates; (3) our issuance, in any three year period, of more than $1.0 billion in non-convertible debt; and (4) the fiscal year end following the fifth anniversary of the completion of our initial public offering.
In the 10-K filed Feb 18, 2025open_in_new
Sources
Item 1A of each 10-K and 10-Q on EDGAR, quoted exactly. Each paragraph links to the filing at sec.gov.
Also
10-K change: what was reworded or cut, section by section.
Work with it
Excel workbook · CSV. Google Sheet that stays up to date: paste =IMPORTDATA("https://tickdelta.com/company/WAY/export.csv") into a cell.
