Item 8.01 section not located in normalized markdown

hstm20260729_8k.htm
     Generated by ThunderDome Portal - 7/29/2026 4:11:39 PM

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

FORM 8-K

CURRENT REPORT

Pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934

Date of Report (Date of earliest event reported):  July 29, 2026

HealthStream, Inc.

(Exact name of Registrant as Specified in Its Charter)

Tennessee

000-27701

62-1443555

(State or Other Jurisdiction

of Incorporation)

(Commission File Number)

(IRS Employer

Identification No.)

500 11th Avenue North, Suite 850,

Nashville, Tennessee

37203

(Address of Principal Executive Offices)

(Zip Code)

Registrant’s Telephone Number, Including Area Code: 615-301-3100

Not Applicable

(Former Name or Former Address, if Changed Since Last Report)

Securities registered pursuant to Section 12(b) of the Act:

Title of each Class

Trading Symbol(s)

Name of each exchange on which registered

Common Stock (Par Value $0.00)

HSTM

Nasdaq Global Select Market

Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the registrant under any of the following provisions (see General Instructions A.2. below):

Written communications pursuant to Rule 425 under the Securities Act (17 CFR 230.425)

Soliciting material pursuant to Rule 14a-12 under the Exchange Act (17 CFR 240.14a-12)

Pre-commencement communications pursuant to Rule 14d-2(b) under the Exchange Act (17 CFR 240.14d-2(b))

Pre-commencement communications pursuant to Rule 13e-4(c) under the Exchange Act (17 CFR 240.13e-4(c))

Indicate by check mark whether the registrant is an emerging growth company as defined in Rule 405 of the Securities Act of 1933 (§ 230.405 of this chapter) or Rule 12b-2 of the Securities Exchange Act of 1934 (§ 240.12b-2 of this chapter).

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Item         8.01          Other Events.

HealthStream, Inc. (the “Company”) recently detected that the Company had experienced a cybersecurity incident in which an unauthorized third party gained access to a limited portion of files on the Company’s corporate file server as described below. Following such detection, the Company initiated response protocols, launched an investigation, which remains ongoing, engaged the services of cybersecurity and forensics specialists and advisors, and notified certain law enforcement authorities.

Based on the Company’s investigation to date, we do not believe that any customer-facing systems were accessed or compromised. In addition, the Company has not identified evidence to date that protected health information, as defined by the Health Insurance Portability and Accountability Act (“HIPAA”) was accessed or exfiltrated. Moreover, the Company has not identified any evidence indicating that any files were encrypted by the unauthorized third party. We have not experienced any interruption in our product or service delivery to customers or to our business operations.

Based on the Company’s investigation to date, the Company believes that certain information of the Company’s employees, as well as billing related information of certain customers and vendors, and corporate and legal information of the Company, was accessed and/or exfiltrated from the Company’s corporate file servers as the result of the incident. In addition, for approximately 75 of our credentialing customers, the Company had copied certain customer data to the Company’s corporate file servers for purposes of data conversion, analytics, and troubleshooting for these customers. The Company has notified such customers regarding this incident.

We have incurred, and expect to continue to incur, certain expenses related to this incident, i