AMGEN INC

Previous wording

Sales of our products depend on the availability and extent of coverage and reimbursement from third-party payers, including government healthcare programs and private insurance plans. Governments and private payers continue to pursue initiatives to manage drug utilization and contain costs. Further, pressures on healthcare budgets from the economic downturn and inflation continue and are likely to increase across the markets we serve. Payers are increasingly focused on costs, which have resulted, and are expected to continue to result, in lower reimbursement rates for our products or narrower populations for which payers will reimburse. Continued intense public scrutiny of the price of drugs and other healthcare costs, together with payer dynamics, have limited, and are likely to continue to limit, our ability to set or adjust the price of our products based on their value, which can have a material adverse effect on our business. In the United States, particularly over the past few years, a number of legislative and regulatory proposals have been introduced and/or signed into law that attempt to lower drug prices. These include the IRA legislation that enables the U.S. government to set prices for certain drugs in Medicare, redesigns Medicare Part D benefits to shift a greater portion of the costs to manufacturers and enables the U.S. government to impose penalties if drug prices are increased at a rate faster than inflation (IRA Inflation Penalties). Additional proposals focused on drug pricing continue to be debated, and additional executive orders focused on drug pricing and competition are likely to be adopted and implemented in some form. In March 2024, the Administration released its budget plan for fiscal year 2025 that included proposals to expand the IRA’s drug price setting to more drugs and sooner after launch and making IRA Inflation Penalties applicable to commercial health insurance. Government actions or ballot initiatives at the state level also represent a highly active area of policymaking and experimentation, including pursuit of proposals that limit drug reimbursement under state run Medicaid programs based on reference prices or permitting importation of drugs from Canada. Such state policies may also eventually be adopted at the federal level.

Current wording

Sales of our products depend on the availability and extent of coverage and reimbursement from third-party payers, including government healthcare programs and private insurance plans. Governments and private payers continue to pursue initiatives to manage drug utilization and contain costs. Further, pressures on healthcare budgets from the economic downturn and inflation continue and are likely to increase across the markets we serve. Payers are increasingly focused on costs, which have resulted, and are expected to continue to result, in lower reimbursement rates for our products or narrower populations for which payers will reimburse. Continued intense public scrutiny of the price of drugs and other healthcare costs, together with payer dynamics, have limited, and are likely to continue to limit, our ability to set or adjust the price of our products based on their value, which can have a material adverse effect on our business. In the United States, particularly over the past few years, a number of legislative and regulatory proposals have been introduced and/or signed into law that attempt to lower drug prices. These include the IRA law that enables the U.S. government to set prices for certain drugs in Medicare, redesigns Medicare Part D benefits to shift a greater portion of the costs to manufacturers and enables the U.S. government to impose penalties if drug prices are increased at a rate faster than inflation (IRA Inflation Penalties). Additional proposals focused on drug pricing continue to be debated, and additional executive orders focused on drug pricing and competition are likely to be adopted and implemented in some form. In March 2024, the Administration released its budget plan for fiscal year 2025 that included proposals to expand the IRA’s drug price setting to more drugs and sooner after launch and making IRA Inflation Penalties applicable to commercial health insurance. Government actions or ballot initiatives at the state level also represent a highly active area of policymaking and experimentation, including proposals that limit drug reimbursement under state run Medicaid programs based on decisions of drug affordability boards, use of reference prices, or permitting importation of drugs from Canada. Such state policies may also eventually be adopted at the federal level.

Previous wording

A substantial portion of our U.S. business relies on reimbursement from federal government healthcare programs and commercial insurance plans regulated by federal and state governments. See Part I, Item 1. Business—Reimbursement, of our Annual Report on Form 10-K for the year ended December 31, 2023. Our business has been and will continue to be affected by legislative actions changing U.S. federal reimbursement policy. For example, in 2022, the IRA was enacted and includes provisions requiring that beginning in 2026, mandatory price setting be introduced in Medicare for certain drugs paid for under Parts B and D, whereby manufacturers must accept a price established by the government or face penalties on all U.S. sales (starting with 10 drugs in 2026, adding 15 in 2027 and 2028, and adding 20 in 2029 and subsequent years such that by 2031 approximately 100 drugs could be subject to such set prices). The Medicare price setting process began on August 29, 2023 when CMS announced the first 10 drugs for Medicare price setting, which includes ENBREL. Our wholly owned subsidiary, Immunex Corporation, which holds the rights to the ENBREL Biologics License Application, entered into an agreement with the U.S. government to participate in the price setting process and submitted the required data to CMS for ENBREL, including certain price, cost and patent data. On April 2, 2024, HHS announced that CMS responded to counteroffers from all manufacturers and invited manufacturers to participate in further discussions. The Medicare price setting process will conclude by August 1, 2024, and by September 1, 2024, CMS will publish prices that will be applicable to these 10 drugs in the Medicare program beginning January 1, 2026. Also under the IRA, starting on January 1, 2024, Medicare Part D was redesigned to cap beneficiary out-of-pocket costs and, beginning January 1, 2025, Federal reinsurance will be reduced in the catastrophic phase (resulting in a shift and increase of such costs to Part D plans and manufacturers, including by requiring manufacturer discounts on certain drugs). Further, the IRA created a mechanism for CMS to collect rebates from manufacturers if price increases outpace inflation. Rebate obligations began to accrue October 1, 2022 for Medicare Part D and January 1, 2023 for Medicare Part B, but CMS has not yet issued invoices and has some discretion as to when to issue such invoices to manufacturers. We expect that several of our products will be subject to these inflation rebates, and several of our products have been on lists that are issued and updated on a quarterly basis by CMS under a related program under which Medicare beneficiaries are charged reduced coinsurance if price increases exceed inflation. The IRA’s drug pricing controls and Medicare redesign are likely to have a material adverse effect on our sales, our business and our results of operations, and such impact is expected to increase through the end of the decade and will de…

Excerpt shortened here; the source contains the full paragraph.

Current wording

A substantial portion of our U.S. business relies on reimbursement from federal government healthcare programs and commercial insurance plans regulated by federal and state governments. See Part I, Item 1. Business—Reimbursement, of our Annual Report on Form 10-K for the year ended December 31, 2023. Our business has been and will continue to be affected by legislative actions changing U.S. federal reimbursement policy. For example, in 2022, the IRA was enacted and includes provisions requiring that beginning in 2026, mandatory price setting be introduced in Medicare for certain drugs paid for under Parts B and D, whereby manufacturers must accept a price established by the government or face penalties on all U.S. sales (starting with 10 drugs in 2026, adding 15 in 2027 and 2028, and adding 20 in 2029 and subsequent years such that by 2031 approximately 100 drugs could be subject to such set prices). The Medicare price setting process began in August 2023 when CMS announced the first 10 drugs for Medicare price setting, which includes ENBREL, currently a product that generates considerable revenue. Effective July 30, 2024, CMS has set a price for ENBREL in Medicare Part D that will be applicable beginning on January 1, 2026, which we expect will negatively impact its profitability. See Part I, Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations—Results of operations—Product sales—ENBREL. Depending on the growth and success of our medicines, other of our medicines may also be subject to selection by CMS in the next, or in a future, cycle of mandatory Medicare price setting. If other of our medicines are selected by CMS for mandatory price setting, we may be required to accept a price set by the government similar to the process that was applied to ENBREL. Also under the IRA, starting on January 1, 2024, Medicare Part D was redesigned to cap beneficiary out-of-pocket costs and, beginning January 1, 2025, Federal reinsurance will be reduced in the catastrophic phase (resulting in a shift and increase of such costs to Part D plans and manufacturers, including by requiring manufacturer discounts on certain drugs). Further, the IRA created a mechanism for CMS to collect rebates from manufacturers if price increases outpace inflation. Rebate obligations began to accrue October 1, 2022 for Medicare Part D and January 1, 2023 for Medicare Part B, but CMS has not yet issued invoices and has some discretion as to when to issue such invoices to manufacturers. We expect that several of our products will be subject to these inflation rebates, and several of our products have been on lists that are issued and updated on a quarterly basis by CMS under a related program under which Medicare beneficiaries are charged reduced coinsurance if price increases exceed inflation. The IRA’s drug pricing controls and Medicare redesign are likely to have a material adverse effect on our sales, our business and our results of operati…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

At the state level, government actions or ballot initiatives can also affect how our products are covered and reimbursed and/or create additional pressure on our pricing decisions. Existing and proposed state pricing laws have added complexity to the pricing of drugs and may already be affecting industry pricing decisions. A number of states have adopted, and many other states are considering, drug importation programs and other pricing actions, including proposals designed to require biopharmaceutical manufacturers to report to the state proprietary pricing information or provide advance notice of certain price increases.

Current wording

At the state level, legislation, government actions, and ballot initiatives can also affect how our products are covered and reimbursed and/or create additional pressure on our pricing decisions. Existing and proposed state pricing laws have added complexity to the pricing of drugs and may already be affecting industry pricing decisions. A number of states have adopted, and many other states are considering, PDABs, drug importation programs, and other pricing actions, including proposals designed to require biopharmaceutical manufacturers to report to the state proprietary pricing information or provide advance notice of certain price increases.

Previous wording

States are also enacting laws referencing the IRA and seeking to regulate the 340B Drug Pricing Program. For example, following the passage of the IRA, bills have been proposed in multiple states that would apply the drug price caps set by HHS for Medicare to drug prices in an individual state. For Medicaid patients, states have established a Medicaid drug spending cap (New York) and implemented a new review and supplemental rebate negotiation process (Massachusetts). Eight states (Colorado, Maine, New Hampshire, New Jersey, Maryland, Minnesota, Oregon and Washington) have enacted laws that establish PDABs to identify drugs that pose affordability challenges, and four such states include authority for the state PDAB to set upper payment limits on certain drugs for in-state patients, payers and providers. So far in 2024, no fewer than 15 states have pending PDAB legislation. States with enacted PDAB laws are in various phases of implementation, with Colorado’s PDAB being the furthest along. In August 2023, the Colorado PDAB announced the first five drugs to undergo an affordability review, one of which is ENBREL. In February of 2024, the Colorado PDAB determined that ENBREL is “unaffordable” and is moving forward on rulemaking to establish an Upper Payment Limit (UPL) for ENBREL that could be effective beginning in the second quarter of 2025. Further, Louisiana, Arkansas and West Virginia enacted laws with mandates on manufacturers participating in the 340B drug pricing program, and thus far in 2024, no fewer than 23 states have considered similar legislation. These bills vary, but include provisions on restricting a manufacturer’s ability to direct drugs in 340B channels, recognizing 340B contract pharmacies and a prohibition on requiring the inclusion of 340B claims modifiers. In March 2024, the U.S. Court of Appeals for the 8 th Circuit ruled that Arkansas’ Act 1103, which prohibits drugmakers from restricting the acquisition or delivery of 340B drugs to covered entities and their contract pharmacies, was not preempted by the federal 340B statute. The decision could increase the number of states that will consider similar legislation. Further, in Genesis Health Care, Inc. v. Becerra, the U.S. District Court for the District of South Carolina issued an order in November 2023 that enjoins the Health Resources and Services Administration from enforcing its more restrictive interpretation of what is considered a patient under the 340B program, to the potential benefit of healthcare systems seeking to expand the application of 340B discounts.

Current wording

States are also enacting laws referencing the IRA and seeking to regulate the 340B Drug Pricing Program. For example, following the passage of the IRA, bills have been proposed in multiple states that would apply the drug price caps set by HHS for Medicare to drug prices in an individual state, and such references to IRA price caps have also been included in PDAB legislation. For Medicaid patients, states have established a Medicaid drug spending cap (New York) and implemented a new review and supplemental rebate negotiation process (Massachusetts). Eight states (Colorado, Maine, New Hampshire, New Jersey, Maryland, Minnesota, Oregon and Washington) have enacted laws that establish PDABs to identify drugs that pose affordability challenges, and four such states include authority for the state PDAB to set upper payment limits on certain drugs for in-state patients, payers and providers. In 2024, no fewer than 16 states introduced PDAB legislation. The eight states with enacted PDAB laws are in various phases of implementation, with Colorado’s PDAB being the furthest along. In August 2023, the Colorado PDAB announced the first five drugs to undergo an affordability review, three of which, including ENBREL, have since been deemed “unaffordable” and will be subject to rulemaking to establish an Upper Payment Limit (UPL). For ENBREL, a UPL could be effective as soon as the second quarter of 2025. Further, Louisiana, Arkansas, West Virginia, Minnesota, Kansas, Mississippi, Missouri and Maryland have enacted laws with mandates on manufacturers participating in the 340B drug pricing program, and, thus far in 2024, no fewer than 25 states have considered similar legislation. These bills vary, but include provisions on restricting a manufacturer’s ability to direct drugs in 340B channels, recognizing 340B contract pharmacies and a prohibition on requiring the inclusion of 340B claims modifiers. In March 2024, the U.S. Court of Appeals for the 8 th Circuit ruled that Arkansas’ Act 1103, which prohibits drugmakers from restricting the acquisition or delivery of 340B drugs to covered entities and their contract pharmacies, was not preempted by the federal 340B statute. The decision could increase the number of states that will consider similar legislation. Further, in Genesis Health Care, Inc. v. Becerra, the U.S. District Court for the District of South Carolina issued an order in November 2023 that enjoins the Health Resources and Services Administration from enforcing its more restrictive interpretation of what is considered a patient under the 340B program, to the potential benefit of healthcare systems seeking to expand the application of 340B discounts.

Previous wording

Payers, including healthcare insurers, PBMs, integrated healthcare delivery systems (vertically-integrated organizations built from consolidations of healthcare insurers and PBMs) and group purchasing organizations, increasingly seek ways to reduce their costs. With increasing frequency, payers are adopting benefit plan changes that shift a greater proportion of drug costs to patients. Such measures include more limited benefit plan designs, high deductible plans, higher patient co-pay or coinsurance obligations and more significant limitations on patients’ use of manufacturer commercial co-pay assistance programs. Further, government regulation of payers may affect these trends. For example, CMS finalized a policy for plan years starting on or after January 1, 2021 that has caused commercial payers to more widely adopt co-pay accumulator adjustment programs. While the U.S. District Court for the District of Columbia struck down this policy in September 2023 and further clarified in December 2023 that its ruling had the effect of reinstating the co-pay accumulator adjustment policy from 2020, CMS and HHS have signaled that they do not intend to enforce certain restrictions from the 2020 policy that would reduce the adoption of co-pay accumulator adjustment programs. Payers, including PBMs, have sought, and continue to seek, price discounts or rebates in connection with the placement of our products on their formularies or those they manage, and to also impose restrictions on access to or usage of our products (such as Step Therapy), require that patients receive the payer’s prior authorization before covering the product, and/or chosen to exclude certain indications for which our products are approved. For example, some payers require physicians to demonstrate or document that the patients for whom Repatha has been prescribed meet their utilization criteria, and these requirements have served to limit and may continue to limit patient access to Repatha treatment. In an effort to reduce barriers to access, we reduced the net price of Repatha by providing greater discounts and rebates to payers (including PBMs that administer Medicare Part D prescription drug plans), and in response to a very high percentage of Medicare patients abandoning their Repatha prescriptions rather than paying their co-pay, we introduced a set of new National Drug Codes to make Repatha available at a lower list price. However, affordability of patient out-of-pocket co-pay cost has limited and may continue to limit patient use. Further, despite these net and list price reductions, some payers have restricted, and may continue to restrict, patient access and may seek further discounts or rebates or take other actions, such as changing formulary coverage for Repatha, that could reduce our sales of Repatha. These factors have limited, and may continue to limit, patient affordability and use, negatively affecting Repatha sales.

Current wording

Payers, including healthcare insurers, PBMs, integrated healthcare delivery systems (vertically-integrated organizations built from consolidations of healthcare insurers and PBMs) and group purchasing organizations, increasingly seek ways to reduce their costs. With increasing frequency, payers are adopting benefit plan changes that shift a greater proportion of drug costs to patients. Such measures include more limited benefit plan designs, high deductible plans, higher patient co-pay or coinsurance obligations and more significant limitations on patients’ use of manufacturer commercial co-pay assistance programs. Further, government regulation of payers may affect these trends. For example, CMS finalized a policy for plan years starting on or after January 1, 2021 that has caused commercial payers to more widely adopt co-pay accumulator adjustment programs. While the U.S. District Court for the District of Columbia struck down this policy in September 2023 and further clarified in December 2023 that its ruling had the effect of reinstating the co-pay accumulator adjustment policy from 2020, CMS and HHS have signaled that they do not intend to enforce certain restrictions from the 2020 policy that would reduce the adoption of co-pay accumulator adjustment programs. Payers, including PBMs, have sought, and continue to seek, price discounts or rebates in connection with the placement of our products on their formularies or those they manage, and to also impose restrictions on access to or usage of our products (such as Step Therapy), require that patients receive the payer’s prior authorization before covering the product, and/or chosen to exclude certain indications for which our products are approved. For example, some payers require physicians to demonstrate or document that the patients for whom Repatha has been prescribed meet their utilization criteria, and these requirements have served to limit and may continue to limit patient access to

Previous wording

Further, significant consolidation in the health insurance industry has resulted in a few large insurers and PBMs, which places greater pressure on pricing and usage negotiations with biopharmaceutical manufacturers, significantly increasing discount and rebate requirements and limiting patient access and usage. For example, in the United States, as of the beginning of 2024, the top five integrated health plans and PBMs controlled about 92% of all pharmacy prescriptions. This high degree of consolidation among insurers, PBMs and other payers, including integrated healthcare delivery systems and/or with specialty or mail-order pharmacies and pharmacy retailers, has increased the negotiating leverage such entities have over us and other biopharmaceutical manufacturers and has resulted in greater price discounts, rebates and service fees realized by those payers from our business. Each of CVS, Express Scripts and United Health Group (among the top five integrated health plans and PBMs), have Rebate Management Organizations that further increase their leverage to negotiate deeper discounts. Ultimately, additional discounts, rebates, fees, coverage changes, plan changes, restrictions or exclusions imposed by these commercial payers could have a material adverse effect on our product sales, business and results of operations. Policy reforms advanced by Congress or the Administration that refine the role of PBMs in the U.S. marketplace could have downstream implications or consequences for our business and how we interact with these entities. For example, in June 2022, the FTC launched an inquiry into the business practices of PBMs and subsequently expanded the investigation to the three rebate management organizations owned by the three largest PBMs. In addition, multiple Congressional Committees are investigating PBM practices and have also proposed legislation that could increase transparency and reporting of these practices and/or impact rebates and service fees. The results of such inquiry could have an effect on manufacturer interactions with PBMs, resulting in changes to access for certain medicines. See our Annual Report on Form 10-K for the year ended December 31, 2023, Part I, Item 1A. Risk Factors—Concentration of sales at certain of our wholesaler distributors, and consolidation of private payers, such as insurers, and PBMs has negatively affected, and may continue to negatively affect, our business.

Current wording

Further, significant consolidation in the health insurance industry has resulted in a few large insurers and PBMs, which places greater pressure on pricing and usage negotiations with biopharmaceutical manufacturers, significantly increasing discount and rebate requirements and limiting patient access and usage. For example, in the United States, as of the beginning of 2024, the top five integrated health plans and PBMs controlled about 92% of all pharmacy prescriptions. This high degree of consolidation among insurers, PBMs and other payers, including integrated healthcare delivery systems and/or with specialty or mail-order pharmacies and pharmacy retailers, has increased the negotiating leverage such entities have over us and other biopharmaceutical manufacturers and has resulted in greater price discounts, rebates and service fees realized by those payers from our business. Each of CVS, Express Scripts and United Health Group (among the top five integrated health plans and PBMs) have Rebate Management Organizations that further increase their leverage to negotiate deeper discounts. Ultimately, additional discounts, rebates, fees, coverage changes, plan changes, restrictions or exclusions imposed by these commercial payers could have a material adverse effect on our product sales, business and results of operations. Policy reforms advanced by Congress or the Administration that refine the role of PBMs in the U.S. marketplace could have downstream implications or consequences for our business and how we interact with these entities. For example, in June 2022, the FTC launched an inquiry into the business practices of PBMs and subsequently expanded the investigation to the three rebate management organizations owned by the three largest PBMs, and in July 2024, the FTC published initial findings from its investigation. In addition, multiple Congressional Committees are investigating PBM practices and have also proposed legislation that could increase transparency and reporting of these practices and/or impact rebates and service fees. The results of such inquiries could have an effect on manufacturer interactions with PBMs, resulting in changes to access for certain medicines. See our Annual Report on Form 10-K for the year ended December 31, 2023, Part I, Item 1A. Risk Factors—Concentration of sales at certain of our wholesaler distributors, and consolidation of private payers, such as insurers, and PBMs has negatively affected, and may continue to negatively affect, our business.

Previous wording

Outside the United States, we expect countries will also continue to take actions to reduce their drug expenditures and to reduce intellectual property protections. See Part I, Item 1. Business—Reimbursement, of our Annual Report on Form 10-K for the year ended December 31, 2023. Pressures to decrease drug expenditures may intensify as governments take actions to address budgets strained by high inflation, expenditures to respond to the COVID-19 pandemic and weak economic conditions, including in Europe where the effects of the Russia–Ukraine conflict have challenged the economies in that region. Further, the EU is currently undergoing a review and revision of its pharmaceutical legislation that, while full implementation is not expected before 2027, could lead to proposals that will reduce intellectual property protection for new products (including potentially shortening the duration of regulatory data exclusivity and orphan drug exclusivity protections), as well as change the reimbursement and regulatory landscape. International reference pricing has been widely used by many countries outside the United States to control costs based on an external benchmark of a product’s price in other countries. International reference pricing policies can change quickly and frequently and may not reflect differences in the burden of disease, indications, market structures or affordability differences across countries or regions. Other expenditure control practices, including but not limited to the use of revenue clawbacks, rebates and caps on product sales, are used in various foreign jurisdictions as well. In addition, countries may refuse to reimburse or may restrict the reimbursed population for a product when their national health technology assessments do not consider a medicine to demonstrate sufficient clinical benefit beyond existing therapies or to meet certain cost effectiveness thresholds. For example, despite the EMA’s approval of Repatha for the treatment of patients with established atherosclerotic disease, prior to 2020, the reimbursement of Repatha in France was limited to a narrower patient population (such as those with homozygous familial hypercholesterolemia (HoFH)) following a national health technology assessment. Many countries decide on reimbursement between potentially competing products through national or regional tenders that often result in one product receiving most or all of the sales in that country or region. Failure to obtain coverage and reimbursement for our products, a deterioration in their existing coverage and reimbursement or a decline in the timeliness or certainty of payment by payers to hospitals and other providers has negatively affected, and may further negatively affect, the ability or willingness of healthcare providers to prescribe our products for their patients and otherwise negatively affect the use of our products or the prices we realize for them. Such changes have had, and could in the future have, a m…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Outside the United States, we expect countries will also continue to take actions to reduce their drug expenditures and to reduce intellectual property protections. See Part I, Item 1. Business—Reimbursement, of our Annual Report on Form 10-K for the year ended December 31, 2023. Pressures to decrease drug expenditures may intensify as governments take actions to address budgets strained by high inflation, expenditures to respond to the COVID-19 pandemic and weak economic conditions, including in Europe where the effects of the Russia–Ukraine conflict have challenged the economies in that region. Further, the EU is currently undergoing a review and revision of its pharmaceutical legislation that, while full implementation is not expected before 2027, has led to proposals that would reduce intellectual property protection for new products (including potentially shortening the duration of regulatory data exclusivity and orphan drug exclusivity protections), as well as change the reimbursement and regulatory landscape. International reference pricing has been widely used by many countries outside the United States to control costs based on an external benchmark of a product’s price in other countries. International reference pricing policies can change quickly and frequently and may not reflect differences in the burden of disease, indications, market structures or affordability differences across countries or regions. Other expenditure control practices, including but not limited to the use of revenue clawbacks, rebates and caps on product sales, are used in various foreign jurisdictions as well. In addition, countries may refuse to reimburse or may restrict the reimbursed population for a product when their national health technology assessments do not consider a medicine to demonstrate sufficient clinical benefit beyond existing therapies or to meet certain cost effectiveness thresholds. For example, despite the EMA’s approval of Repatha for the treatment of patients with established atherosclerotic disease, prior to 2020, the reimbursement of Repatha in France was limited to a narrower patient population (such as those with homozygous familial hypercholesterolemia (HoFH)) following a national health technology assessment. Many countries decide on reimbursement between potentially competing products through national or regional tenders that often result in one product receiving most or all of the sales in that country or region. Failure to obtain coverage and reimbursement for our products, a deterioration in their existing coverage and reimbursement or a decline in the timeliness or certainty of payment by payers to hospitals and other providers has negatively affected, and may further negatively affect, the ability or willingness of healthcare providers to prescribe our products for their patients and otherwise negatively affect the use of our products or the prices we realize for them. Such changes have had, and could in the future have, a mat…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Our information technology systems are highly integrated into our business, including our R&D efforts, our clinical and commercial manufacturing processes and our product sales and distribution processes. Further, as the majority of our employees work remotely for some portion of their jobs in our hybrid work environment, our reliance on our and third-party information technology systems has increased substantially and is expected to continue to increase. Remote and hybrid working arrangements, including those of at many third-party providers, can increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. The complexity and interconnected nature of software, hardware and our systems make them vulnerable to breakdown or other service interruptions, and to software errors or defects, misconfiguration and other security vulnerabilities. Upgrades or changes to our systems or the software that we use have resulted and we expect, in the future, will result in the introduction of new cybersecurity vulnerabilities and risks. In 2022, we identified a number of security vulnerabilities introduced into our information systems as a result of flaws that we subsequently identified in software that we had purchased and installed, and these flaws required that we apply emergency patches to certain of our systems. While we did not experience any significant adverse effects as a result of these vulnerabilities, there can be no assurance that we will timely identify and address future vulnerabilities. Our systems are also subject to frequent perimeter network reconnaissance and scanning, phishing and other cyberattacks. For example, as a result of our cybersecurity monitoring of the Horizon legacy information systems, we detected phishing activity in the accounts of two Horizon executives. These accounts were de-activated, the incidents were investigated and the determination was made separately by both our internal cybersecurity team and our external digital forensics and incident response supplier that no confidential information had been exfiltrated. As the cyber-threat landscape evolves, these attacks are growing in frequency, sophistication, and intensity, and are becoming increasingly difficult to detect and increasingly sophisticated in using techniques and tools—including artificial intelligence—that circumvent security controls, evade detection and remove forensic evidence. Such attacks could include the use of harmful and virulent malware, including ransomware or other denials of service, which can be deployed through various means, including the software supply chain, e-mail, malicious websites and/or the use of social engineering/phishing.

Current wording

Our information technology systems are highly integrated into our business, including our R&D efforts, our clinical and commercial manufacturing processes and our product sales and distribution processes. Further, as the majority of our employees work remotely for some portion of their jobs in our hybrid work environment, our reliance on our and third-party information technology systems has increased substantially and is expected to continue to increase. Remote and hybrid working arrangements, including those of at many third-party providers, can increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. The complexity and interconnected nature of software, hardware and our systems make them vulnerable to breakdown or other service interruptions, and to software errors or defects, misconfiguration and other security vulnerabilities. For example, in July 2024, businesses worldwide were affected by an information technology outage due to a faulty software update issued by a cybersecurity firm. Although our systems and operations were temporarily affected by the outage, the impact of this firm’s faulty update on the Company was immaterial to our business operations. However, there can be no assurance that a future similar incident would not result in a material adverse effect on our business or results of operations. Upgrades or changes to our systems or the software that we use have resulted and we expect, in the future, will result in the introduction of new cybersecurity vulnerabilities and risks. In 2022, we identified a number of security vulnerabilities introduced into our information systems as a result of flaws that we subsequently identified in software that we had purchased and installed, and these flaws required that we apply emergency patches to certain of our systems. While we did not experience any significant adverse effects as a result of these vulnerabilities, there can be no assurance that we will timely identify and address future vulnerabilities. Our systems are also subject to frequent perimeter network reconnaissance and scanning, phishing and other cyberattacks. For example, as a result of our cybersecurity monitoring of the Horizon legacy information systems, we detected phishing activity in the accounts of two Horizon executives. These accounts were de-activated, the incidents were investigated and the determination was made separately by both our internal cybersecurity team and our external digital forensics and incident response supplier that no confidential information had been exfiltrated. As the cyber-threat landscape evolves, these attacks are growing in frequency, sophistication, and intensity, and are becoming increasingly difficult to detect and increasingly sophisticated in using techniques and tools—including artificial intelligence—that circumvent security controls, evade detection and …

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Our systems also contain and use a high volume of sensitive data, including intellectual property, trade secrets and other proprietary business information, financial information, regulatory information, strategic plans, sales trends and forecasts, litigation materials and/or personal identifiable information belonging to us, our staff, our patients, customers and/or other parties. In some cases, we utilize third-party service providers to collect, process, store, manage or transmit such data, which have increased our risk. Intentional or inadvertent data privacy or security breaches (including cyberattacks) resulting from attacks or lapses by employees, service providers (including providers of information technology-specific services), business partners, nation states (including groups associated with or supported by foreign intelligence agencies), organized crime organizations, “hacktivists” or others, create risks that our sensitive data may be exposed to unauthorized persons, our competitors or the public. System vulnerabilities and/or cybersecurity breaches experienced by our third-party service providers have constituted a substantial share of the information security risks that have affected us. For example, in the first half of 2021, a supplier experienced a data breach in which an unauthorized third party acquired access to certain information provided to the supplier in the course of its provision of services to us, including business documents and certain personally identifiable patient information (not including social security or other financial or health insurance information). As required, we promptly notified the applicable state attorneys general and the individuals whose personally identifiable information was affected of this data breach at the supplier. In the third quarter of 2022, another service provider experienced a similar cybersecurity breach in which an attacker exfiltrated certain data (including non-significant Amgen data) from the service provider’s systems. Although these supplier data breaches have not resulted in material adverse effects on our business, there can be no assurance that a similar future cybersecurity incident would not result in a material adverse effect on our business or results of operations. Further, the timeliness of our awareness of a cybersecurity incident affects our ability to respond to and work to mitigate the severity of such events. For example, in 2020 and 2022, two of our vendors experienced cyberattacks and each initially reported to us that neither event involved our data. However, upon further investigation, they each subsequently informed us that the attackers had accessed limited, non-significant Amgen information. Although neither of these breaches had a significant adverse effect on our business, in the future we may again not receive timely reporting of cybersecurity events and such events could have a material adverse effect on our business.

Current wording

Our systems also contain and use a high volume of sensitive data, including intellectual property, trade secrets and other proprietary business information, financial information, regulatory information, strategic plans, sales trends and forecasts, litigation materials and/or personal identifiable information belonging to us, our staff, our patients, customers and/or other parties. In some cases, we utilize third-party service providers to collect, process, store, manage or transmit such data, which have increased our risk. Intentional or inadvertent data privacy or security breaches (including cyberattacks) resulting from attacks or lapses by employees, service providers (including providers of information technology-specific services), business partners, nation states (including groups associated with or supported by foreign intelligence agencies), organized crime organizations, “hacktivists” or others, create risks that our sensitive data may be exposed to unauthorized persons, our competitors or the public. System vulnerabilities and/or cybersecurity breaches experienced by our third-party service providers have constituted a substantial share of the information security risks that have affected us. For example, in the first half of 2021, a supplier experienced a data breach in which an unauthorized third party acquired access to certain information provided to the supplier in the course of its provision of services to us, including business documents and certain personally identifiable patient information (not including social security or other financial or health insurance information). As required, we promptly notified the applicable state attorneys general and the individuals whose personally identifiable information was affected of this data breach at the supplier. In the third quarter of 2022, another service provider experienced a similar cybersecurity breach in which an attacker exfiltrated certain data (including non-significant Amgen data) from the service provider’s systems. Additionally, in April 2024, one of our former vendors notified us that its subsidiary that had provided us with certain patient support services until mid-2022, experienced a cybersecurity incident that it discovered in February 2024 and that data containing individually identifiable health information of over 1.7 million Amgen patients (that was retained as required by FDA regulations) was involved in the incident. Pursuant to the Health Breach Notification Rule requirements, we notified the FTC of this incident. Although these supplier data breaches have not resulted in material adverse effects on our business, there can be no assurance that a similar future cybersecurity incident would not result in a material adverse effect on our business or results of operations. Further, the timeliness of our awareness of a cybersecurity incident affects our ability to respond to and work to mitigate the severity of such events. For example, in 2020 and 2022, two of our…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Domestic and global government regulators, our business partners, suppliers with whom we do business, companies that provide us or our partners with business services and companies we have acquired or may acquire face similar risks. Security breaches of their systems or service outages have adversely affected systems and could, in the future, affect our systems and security, leave us without access to important systems, products, raw materials, components, services or information, or expose our confidential data or sensitive personal information. For example, in 2019, two vendors that perform testing and analytical services that we use in developing and manufacturing our products experienced cyberattacks, and in April and September of 2020, vendors that provide us with information technology services and clinical data services, respectively, each experienced ransomware attacks. Although there was no breach of our systems, each of these incidents required us to disconnect our systems from those vendors’ systems. While we were able to reconnect our systems following restoration of these vendors’ capabilities without significantly affecting product availability, a more extended service outage affecting these or other vendors, particularly where such vendor is the single source from which we obtain the services, could have a material adverse effect on our business or results of operations. In February 2024, Change Healthcare, a large U.S. insurance claim and co-pay card processing clearinghouse, experienced a ransomware attack that has caused significant disruptions to healthcare provider and pharmacy operations. While Change Healthcare does not directly provide us with services, disruptions to co-pay card support, insurance billing and Medicaid rebate processing led to lost sales and required us to take action to help patients access their medications and to provide extended payment terms to certain customers. Although services have been rerouted, and in some cases restored, and the impact on our business has been immaterial, similar disruptions may occur in the future stemming from the interconnectedness of the U.S. healthcare ecosystem and industry reliance on centralized claims processing systems and networks, and such future disruptions may have a material adverse effect on our business or results of operations. In addition, we distribute our products in the United States primarily through three pharmaceutical wholesalers, and a security breach that impairs the distribution operations of our wholesalers could significantly impair our ability to deliver our products to healthcare providers and patients. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our information technology systems and sensitive data.

Current wording

Domestic and global government regulators, our business partners, suppliers with whom we do business, companies that provide us or our partners with business services and companies we have acquired or may acquire face similar risks. Security breaches of their systems or service outages have adversely affected systems and could, in the future, affect our systems and security, leave us without access to important systems, products, raw materials, components, services or information, or expose our confidential data or sensitive personal information. For example, in 2019, two vendors that perform testing and analytical services that we use in developing and manufacturing our products experienced cyberattacks, and in April and September of 2020, vendors that provide us with information technology services and clinical data services, respectively, each experienced ransomware attacks. Although there was no breach of our systems, each of these incidents required us to disconnect our systems from those vendors’ systems. While we were able to reconnect our systems following restoration of these vendors’ capabilities without significantly affecting product availability, a more extended service outage affecting these or other vendors, particularly where such vendor is the single source from which we obtain the services, could have a material adverse effect on our business or results of operations. In February 2024, Change Healthcare, a large U.S. insurance claim and co-pay card processing clearinghouse, experienced a ransomware attack that has caused significant disruptions to healthcare provider and pharmacy operations. While Change Healthcare does not directly provide us with services, disruptions to co-pay card support, insurance billing and Medicaid rebate processing led to lost sales and required us to take action to help patients access their medications and to provide extended payment terms to certain customers. Although services have been rerouted and restored, and the impact on our business has been immaterial, similar disruptions may occur in the future stemming from the interconnectedness of the U.S. healthcare ecosystem and industry reliance on centralized claims processing systems and networks, and such future disruptions may have a material adverse effect on our business or results of operations. In addition, we distribute our products in the United States primarily through three pharmaceutical wholesalers, and a security breach that impairs the distribution operations of our wholesalers could significantly impair our ability to deliver our products to healthcare providers and patients. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our information technology systems and sensitive data.

Previous wording

We are also subject to various laws and regulations globally regarding privacy and data protection, including laws and regulations relating to the collection, storage, handling, use, disclosure, transfer and security of personal data. The legislative and regulatory environment regarding privacy and data protection is continuously evolving and developing and the subject of significant attention globally. For example, we are subject to the EU’s General Data Protection Regulation (GDPR), which became effective in May 2018, and the California Consumer Privacy Act (CCPA), which became effective in January 2020, both of which provide for substantial penalties for noncompliance. The CCPA was amended in late 2020, to create the California Privacy Rights Act to create opt in requirements for the use of sensitive personal data and the formation of a new dedicated agency for the enforcement of the law, the California Privacy Protection Agency. Similar consumer privacy laws went into effect in Virginia, Colorado, Utah, Connecticut and Florida in 2023. Consumer privacy laws were also passed in 11 other states, with the earliest effective dates later this year, and proposed in three additional states. Outside the United States, other jurisdictions where we operate have passed, or continue to propose, similar legislation and/or regulations. For example, in China, the Personal Information Protection Law and the Data Security Law, which regulate data processing activities associated with personal and nonpersonal data, are in effect and build upon the existing Cybersecurity Law. Failure to comply with these current and future laws could result in significant penalties and reputational harm and could have a material adverse effect on our business and results of operations.

Current wording

We are also subject to various laws and regulations globally regarding cybersecurity, privacy and data protection, including laws and regulations relating to the collection, storage, handling, use, disclosure, transfer and security of personal data. The legislative and regulatory environment regarding privacy and data protection is continuously evolving and developing and the subject of significant attention globally. For example, we are subject to the EU’s General Data Protection Regulation (GDPR), which became effective in May 2018, and the California Consumer Privacy Act (CCPA), which became effective in January 2020, both of which provide for substantial penalties for noncompliance. The CCPA was amended in late 2020, to create the California Privacy Rights Act to create opt in requirements for the use of sensitive personal data and the formation of a new dedicated agency for the enforcement of the law, the California Privacy Protection Agency. Similar consumer privacy laws went into effect in nine other states, have been enacted (but not yet in effect) in in 11 other states, and have been proposed in six additional states. Outside the United States, other jurisdictions where we operate have passed, or continue to propose, data privacy or cybersecurity legislation and/or regulations. For example, in China, the Personal Information Protection Law and the Data Security Law, which regulate data processing activities associated with personal and nonpersonal data, are in effect and build upon the existing Cybersecurity Law. Further, in March 2024, the European Parliament adopted the Artificial Intelligence Act that provides for EU-wide rules on data quality, transparency, human oversight and accountability with respect to the use of artificial intelligence. In April 2024, the EU also revised its Cybersecurity Directive NIS2 rules that create new cybersecurity risk management and reporting obligations. Failure to comply with these current and future laws could result in significant penalties and reputational harm and could have a material adverse effect on our business and results of operations.

Previous wording

•labor disputes (such as strikes) or shortages, including from the effects of health emergencies (such as novel viruses or pandemics) or natural disasters; and

Current wording

•labor disputes or shortages, including the effects of health emergencies (such as novel viruses or pandemics) or natural disasters;