UNITEDHEALTH GROUP INC

Previous wording

Through our risk-based benefit products, we assume the risk of both medical and administrative costs for our customers in return for monthly premiums. We generally use approximately 80% to 85% of our premium revenues to pay the costs of health care services delivered to these customers. The profitability of our products depends in large part on our ability to predict and effectively price for and manage medical costs. Our Optum Health business also enters into fully accountable value-based arrangements with payers. Premium revenues from risk-based products constitute nearly 80% of our total consolidated revenues. Estimates of benefit expense payments involve extensive judgement and are subject to considerable inherent variability. Relatively small differences between predicted and actual medical costs, or utilization rates as a percentage of revenues, can result in significant changes in our financial results. If we fail to predict accurately, or effectively price for or manage, the costs of providing care under risk-based arrangements, our results of operations could be materially and adversely affected.

Current wording

Through our risk-based benefit products, we assume the risk of both medical and administrative costs for our customers in return for monthly premiums. The profitability of our products depends in large part on our ability to predict and effectively price for and manage medical costs. Our Optum Health business also enters into fully accountable value-based arrangements with payers. Premium revenues from risk-based products constitute nearly 80% of our total consolidated revenues. Estimates of benefit expense payments involve extensive judgement and are subject to considerable inherent variability. Relatively small differences between predicted and actual medical costs, or utilization rates as a percentage of revenues, have resulted and in the future may result in significant changes in our financial results. If we fail to predict accurately, or effectively price for or manage, the costs of providing care under risk-based arrangements, our results of operations could be materially and adversely affected.

Previous wording

The volume of health care data generated, and the uses of data, including electronic health records, are rapidly expanding. We depend on the integrity of the data in our information systems to implement new and innovative services, automate and deploy new technologies to simplify administrative processes and clinical decision making, price our products and services adequately, provide effective service to our customers and consumers in an efficient and uninterrupted fashion, provide timely payments to care providers, and accurately report our results of operations. In addition, connectivity among technologies is becoming increasingly important and recent trends toward greater consumer engagement in health care require new and enhanced technologies, including more sophisticated applications for mobile devices and new tools and products that leverage AI/ML to improve the customer experience. We anticipate that fast-evolving AI/ML technologies, including generative AI, will play an increasingly important role in our information systems and customer-facing technology products. Our ability to protect and enhance existing systems and develop new systems to keep pace with changes in information processing technology (including AI/ML), regulatory standards and changing customer preferences will require an ongoing commitment of significant development and operational resources. If these commitments fail to provide the anticipated benefits, if we are unable to successfully anticipate future technology developments, or if the cost to keep pace with the technological changes exceed our estimates, we could be exposed to reputational harm and experience adverse effects on our business.

Current wording

The volume of health care data generated, and the uses of data, including electronic health records, are rapidly expanding. We depend on the integrity of the data in our information systems to implement new and innovative services, automate and deploy new technologies to simplify administrative processes and clinical decision making, price our products and services adequately, provide effective service to our customers and consumers in an efficient and uninterrupted fashion, provide timely payments to care providers, and accurately report our results of operations. In addition, increasing connectivity among technologies and recent trends toward greater consumer engagement in health care require new and enhanced technologies, including more sophisticated applications for mobile devices and new tools and products that leverage AI/ML to improve the customer experience. We anticipate that fast-evolving AI/ML technologies, including generative AI, will play an increasingly important role in our information systems and customer-facing technology products. Our ability to protect and enhance existing systems and develop new systems to keep pace with changes in information processing technology (including AI/ML), regulatory standards and changing customer preferences will require an ongoing commitment of significant development and operational resources. If these commitments fail to provide the anticipated benefits, if we are unable to successfully anticipate future technology developments, or if the cost to keep pace with the technological changes exceeds our estimates, we could be exposed to reputational harm and experience adverse effects on our business.

Previous wording

If we or third parties we rely on sustain cyber-attacks or other privacy or data security incidents resulting in disruption to our operations or the disclosure of protected personal information or proprietary or confidential information, we could suffer a loss of revenue and increased costs, negative operational affects, exposure to significant liability, reputational harm and other serious negative consequences.

Current wording

If we or third parties we rely on sustain cyberattacks or other privacy or data security incidents resulting in disruption to our operations or the disclosure of protected personal information or proprietary or confidential information, we could suffer a loss of revenue and increased costs, negative operational effects, exposure to significant liability, reputational harm and other serious negative consequences.

Previous wording

We routinely process, store and transmit large amounts of data in our operations, including protected personal information subject to privacy, security or data breach notification laws, as well as proprietary or confidential information relating to our business or third parties. Some of the data we process, store and transmit may be outside of the United States due to our information technology systems and international business operations. We are regularly the target of attempted cyber-attacks and other security threats and have previously been, and may in the future be, subject to compromises of the information technology systems we use, information we hold, or information held on our behalf by third parties. While we have programs in place to detect, contain and respond to data security incidents and provide employee awareness training regarding phishing, malware and other cyber threats to protect against cyber risks and security incidents, we expect that we will continue to experience these incidents, some of which may negatively affect our business. Further, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are increasing in sophistication, in part due to use of evolving AI/ML technologies (including generative AI), and because our businesses are changing as well, we may be unable to anticipate these techniques and threats, detect data security incidents or implement adequate preventive measures. Threat actors and hackers have previously been, and may in the future be, able to negatively affect our operations by penetrating our security controls and causing system and operational disruptions or shutdowns, accessing, misappropriating or otherwise compromising protected personal information or proprietary or confidential information or that of third parties, and developing and deploying viruses, ransomware and other malware that can attack our systems, exploit any security vulnerabilities, and disrupt or shutdown our systems and operations. In addition, hardware, software, or applications we develop or procure from third parties may contain defects or other problems which could unexpectedly compromise our information security controls. Our systems may also be vulnerable to financial fraud schemes, misplaced or lost data, human error, malicious social engineering, or other events which could negatively affect the data or financial accounts, proprietary or confidential information relating to our business or third parties, or our operations. There have previously been and may be in the future heightened vulnerabilities due to the lack of physical supervision and on-site infrastructure for remote workforce operations and for recently-acquired or non-integrated businesses. We rely in some circumstances on third-party vendors to process, store and transmit large amounts of data for our business whose operations are subject to similar risks.

Current wording

While we have programs in place to detect, contain and respond to data security incidents and provide employee awareness training regarding phishing, malware and other cyber threats to protect against cybersecurity risks and incidents, we expect that we will continue to experience these incidents, some of which may negatively affect our business. Further, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are increasing in sophistication, in part due to use of evolving AI/ML technologies (including generative AI), and because our businesses are changing as well, we may be unable to anticipate these techniques and threats, timely detect data security incidents or implement adequate preventive measures. Threat actors and hackers have previously been, and may in the future be, able to negatively affect our operations by penetrating our security controls and causing system and operational disruptions or shutdowns, accessing, misappropriating or otherwise compromising protected personal information or proprietary or confidential information or that of third parties, and developing and deploying viruses, ransomware and other malware that can attack our systems, exploit any security vulnerabilities, and disrupt or shutdown our systems and operations. In addition, hardware, software, or applications we develop or procure from third parties may contain defects or other problems which could unexpectedly compromise our information security controls. Our systems may also be vulnerable to financial fraud schemes, misplaced or lost data, error, malicious social engineering, or other events which could negatively affect the data or financial accounts, proprietary or confidential information relating to our business or third parties, or our operations. There have previously been and may be in the future heightened vulnerabilities due to recently-acquired or non-integrated businesses. We rely in some circumstances on third-party vendors to process, store and transmit large amounts of data for our business. The operations of these vendors are subject to similar risks, but are outside our direct oversight and control.

Previous wording

The costs to eliminate or address the foregoing security threats and vulnerabilities before or after a cyber-incident could be material. We have business continuation and resiliency plans which are maintained, updated and tested regularly in an effort to contain and remediate potential disruptions or cyber events. If our remediation efforts are not successful, we may experience operational interruptions, delays, or cessation of service and loss of existing or potential customers. In addition, compromises of our security measures or the unauthorized dissemination of sensitive personal information, proprietary information or confidential information about us, our customers or other third parties, previously and in the future, could expose us or them to the risk of financial or medical identity theft, negative operational affects, expose us or them to a risk of loss or misuse of this information, result in litigation and liability, including regulatory penalties, for us, damage our brand and reputation, or otherwise harm our business.

Current wording

The costs to eliminate or address the foregoing security threats and vulnerabilities before or after a cybersecurity incident could be material. We have business continuation and resiliency plans which we maintain, update and test regularly in an effort to contain and remediate potential disruptions or cybersecurity events. If our remediation efforts are not successful, we may experience operational interruptions, delays, or cessation of service and loss of existing or potential customers. In addition, compromises of our security measures or the unauthorized dissemination of sensitive personal information, proprietary information or confidential information about us, our customers or other third parties, previously and in the future, could expose us or them to the risk of financial or medical identity theft, negative operational impacts, and loss or misuse of this information, result in litigation and liability, including regulatory penalties, for us, damage our brand and reputation, or otherwise harm our business.

Previous wording

The success of some of our businesses depends on maintaining satisfactory relationships with physicians as our employees, independent contractors or joint venture partners. The physicians who practice medicine or contract with our affiliated physician organizations could terminate their provider contracts or otherwise become unable or unwilling to continue practicing medicine or contracting with us. We face and will likely continue to face heightened competition to acquire or manage physician practices or to employ or contract with individual physicians. Our revenues could be materially and adversely affected if we are unable to maintain or expand satisfactory relationships with physicians, to acquire, recruit or, in some instances, employ physicians, or to retain enrollees following physician departures. In addition, our affiliated physician organizations contract with competitors of UnitedHealthcare. Our businesses could suffer if our affiliated physician organizations fail to maintain relationships with or fail to adequately price their contracts with these third-party payer competitors.

Current wording

The success of some of our businesses depends on maintaining satisfactory relationships with employed, affiliated, and independently contracted physicians and joint venture partners. The physicians who practice medicine or contract with our affiliated physician organizations could terminate their provider contracts or otherwise become unable or unwilling to continue practicing medicine or contracting with us. We face and will likely continue to face heightened competition to acquire or manage physician practices or to employ or contract with individual physicians. Our revenues could be materially and adversely affected if we are unable to maintain or expand satisfactory relationships with physicians, to acquire, recruit or, in some instances, employ physicians, or to retain enrollees following physician departures. In addition, our affiliated physician organizations contract with competitors of UnitedHealthcare. Our businesses could suffer if our affiliated physician organizations fail to maintain relationships with or fail to adequately price their contracts with these third-party payer competitors.

Previous wording

Our businesses face significant competition in all of the geographic markets in which we operate. In particular geographies or product segments, our competitors may have certain competitive advantages. Our competitive position may also be adversely affected by significant merger and acquisition activity in the industries in which we operate, among both our competitors and suppliers. Consolidation may make it more difficult for us to retain or increase our customer base, improve the terms on which we do business with our suppliers, or maintain or increase our profitability.

Current wording

Our businesses face significant competition in all of the markets in which we operate. In many geographies or product segments, our competitors have and may continue to have certain competitive advantages. Our competitive position may also be adversely affected by significant merger and acquisition activity in the industries in which we operate, among both our competitors and suppliers. Consolidation among competitors may make it more difficult for us to retain or increase our customer base, maintain or improve the terms on which we do business with our suppliers, or maintain or increase our profitability.

Previous wording

In addition, our success in the health care marketplace and future growth depends on our ability to develop and deliver innovative and potentially disruptive products and services to satisfy evolving market demands. If we do not continue to innovate and provide products and services which are useful and relevant to health care payers, consumers and our customers, we may not remain competitive and risk losing market share to existing competitors and disruptive new market entrants. We may face risks from new technologies and market entrants which could affect our existing relationship with health plan enrollees in these areas. We could sustain competitive disadvantages and loss of market share if we fail to continue developing innovative care models, including by accelerating the transition of care to value-based models that achieve higher quality outcomes and better experiences at lower costs and expand access to virtual and in-home care. Additionally, our competitive position could be adversely affected by any failure to develop and apply innovative technologies and other effective data and analytics capabilities or to provide services to our clients focused on these technologies and capabilities.

Current wording

In addition, our success in the health care marketplace and future growth depends on our ability to develop and deliver innovative and potentially disruptive products and services to satisfy evolving market demands. If we do not continue to innovate and provide products and services which are useful and relevant to health care payers, consumers and our customers, we may not remain competitive and risk losing market share to existing competitors and disruptive new market entrants. We may face risks from new technologies and market entrants which could affect our existing relationship with health plan enrollees in the affected markets. We could sustain competitive disadvantages and loss of market share if we fail to continue developing innovative care models, including by accelerating the transition of care to value-based models that achieve higher quality outcomes and better experiences at lower costs and expand access to virtual and in-home care. If health care payers or providers are unwilling or unable to enter into value-based agreements with us, we may be unable to successfully establish or maintain the contractual or employment relationships necessary to achieve the quality and cost objectives we have for value-based contracting. Additionally, our competitive position could be adversely affected by any failure to develop and apply innovative technologies and other effective data and analytics capabilities or to provide services to our clients focused on these technologies and capabilities.

Previous wording

Our business, results of operations, financial position and cash flows also could be materially and adversely affected if we do not compete effectively in our markets, if we set rates too high or too low in highly competitive markets, if we do not design and price our products properly and competitively, if we are unable to innovate and deliver products and services demonstrating value to our customers, if we do not provide a satisfactory level of services, if membership or demand for other services does not increase as we expect or declines, or if we lose accounts with more profitable products while retaining or increasing membership in accounts with less profitable products. The resumption of Medicaid redeterminations has impacted our membership levels and may impact our ability to maintain market share if we are unable to retain or add new consumers to other benefit offerings.

Current wording

Our business, results of operations, financial position and cash flows also could be materially and adversely affected if we do not compete effectively in our markets, if our reputation suffers harm, if we set rates too high or too low in highly competitive markets, if we do not design and price our products properly and competitively, if we are unable to innovate and deliver products and services demonstrating value to our customers, if we do not provide a satisfactory level of services, if membership or demand for other services does not increase as we expect or declines, or if we lose accounts with more profitable products while retaining or increasing membership in accounts with less profitable products.

Previous wording

Legal actions to which we are a party have included and in the future could include matters related to health care benefits coverage and payment of claims (including disputes with enrollees, customers and contracted and non-contracted physicians, hospitals and other health care professionals), tort claims (including claims related to the delivery of health care services, such as medical malpractice by personnel at our affiliates’ facilities, or by health care practitioners who are employed by us, have contractual relationships with us, or serve as providers to our managed care networks, including as a result of a failure to adhere to applicable clinical, quality and/or patient safety standards), antitrust claims (including as a result of changes in the enforcement of antitrust laws), whistleblower claims (including claims under the False Claims Act or similar statutes), matters related to our use of personal information or other proprietary data, claims related to alleged failure of our technology products to operate properly or fairly, contract and labor disputes, tax claims and claims related to disclosure of certain business practices. In addition, some of our pharmacy services operations are subject to clinical quality, patient safety and other risks inherent in the dispensing, packaging and distribution of drugs, including claims related to purported dispensing and other operational errors. We may also be party to certain class action lawsuits brought by health care professional groups and consumers. We operate in jurisdictions outside of the United States where contractual rights, tax positions and applicable regulations may be subject to interpretation or uncertainty to a greater degree than in the United States, and therefore subject to dispute by customers, government authorities or others.

Current wording

Legal actions to which we are a party have included and in the future could include matters related to health care benefits coverage and payment of claims (including disputes with enrollees, customers and contracted and non-contracted physicians, hospitals and other health care professionals), tort claims (including claims related to the delivery of health care services, such as medical malpractice by personnel at our affiliates’ facilities, or by health care practitioners who are employed by us, have contractual relationships with us, or serve as providers to our managed care networks, including as a result of a failure to adhere to applicable clinical, quality and/or patient safety standards), antitrust claims (including as a result of changes in the enforcement of antitrust laws), whistleblower claims (including claims under the False Claims Act or similar statutes), matters related to our use of or alleged failure to adequately safeguard personal information or other proprietary data, claims related to alleged failure of our technology products to operate properly or fairly, contract and labor disputes, tax claims and claims related to disclosure of certain business practices. In addition, some of our pharmacy services operations are subject to clinical quality, patient safety and other risks inherent in the dispensing, packaging and distribution of drugs, including claims related to purported dispensing and other operational errors. We may also be party to certain class action lawsuits brought by health care professional groups and consumers. We operate in jurisdictions outside of the United States where contractual rights, tax positions and applicable regulations may be subject to interpretation or uncertainty to a greater degree than in the United States, and therefore subject to dispute by customers, government authorities or others.

Previous wording

We are largely self-insured with regard to litigation risks, including claims of medical malpractice against our affiliated physicians and us. Although we record liabilities for our estimates of the probable costs resulting from self-insured matters, it is possible the level of actual losses will significantly exceed the liabilities recorded. Additionally, physicians and other healthcare providers have become subject to an increasing number of legal actions alleging medical malpractice and general professional liabilities. Even in states that have imposed caps on damages for such actions, litigants are seeking recoveries under new theories of liability that might not be subject to the caps on damages. These actions involve significant defense costs and could result in substantial monetary damages or damage to our reputation.

Current wording

We are largely self-insured with regard to litigation risks, including claims of medical malpractice against our affiliated physicians and us. Although we record liabilities for our estimates of the probable costs resulting from self-insured matters, it is possible the level of actual losses will significantly exceed the liabilities recorded. Additionally, physicians and other healthcare providers have become subject to an increasing number of legal actions alleging medical malpractice and general professional liabilities. Even in states that have imposed caps on damages for such actions, litigants are seeking recoveries under theories of liability that might not be subject to the caps on damages. These actions involve significant defense costs and could result in substantial monetary damages or damage to our reputation.

Previous wording

We cannot predict the outcome of significant legal actions in which we are involved. Even in situations where we engage external insurers, our coverage may not be sufficient to cover the entirety of certain claims. We incur expenses to resolve these matters and current and future legal actions could further increase our cost of doing business and materially and adversely affect our results of operations, financial position and cash flows. Moreover, certain legal actions could result in adverse publicity which could damage our reputation and materially and adversely affect our ability to retain our current business or grow our market share in some markets and businesses.

Current wording

We cannot predict the outcome of significant legal actions in which we are involved. Even in situations where we engage external insurers, our coverage may be disputed or may not be sufficient to cover the entirety of certain claims. We incur expenses to resolve these matters and current and future legal actions could further increase our cost of doing business, require us to potentially change the way we conduct our business, and materially and adversely affect our results of operations, financial position and cash flows. Moreover, certain legal actions could result in adverse publicity which could damage our reputation and materially and adversely affect our ability to retain our current business or grow our market share in some markets and businesses.

Previous wording

Our business could suffer, and our results of operations, financial position and cash flows could be materially and adversely affected, if we fail to successfully manage our strategic alliances, to complete, manage or integrate acquisitions and other significant strategic transactions or relationships domestically or outside the United States.

Current wording

Our business could suffer, and our results of operations, financial position and cash flows could be materially and adversely affected, if we fail to successfully manage our strategic alliances, or to complete, manage or integrate acquisitions and other significant strategic transactions or relationships.

Previous wording

Successful acquisitions also require us to effectively integrate the acquired business into our existing operations, including our internal control environment and culture, or otherwise leveraging its operations which may present risks different from those presented by organic growth and may be difficult for us to manage. In addition, even with appropriate diligence, pre-acquisition practices of an acquired business have in the past and may in the future expose us to legal challenges and investigations that could subject us to criminal fines or reputational harm. Even if we are ultimately successful, defending such claims may be costly and result in negative publicity. If we cannot successfully integrate our acquired businesses and realize contemplated revenue growth opportunities, cost savings and other synergies, our business, prospects, results of operations, financial position and cash flows could be materially and adversely affected.

Current wording

Successful acquisitions also require us to effectively integrate the acquired business into our existing operations, including our internal control environment and culture, or otherwise leveraging its operations which may present risks different from those presented by organic growth and may be difficult for us to manage. For example, we have experienced and in the future may encounter more acute information technology system vulnerabilities or different litigation risk profiles in recently acquired business than we have historically managed. We may be unable to address such vulnerabilities, inadequacies, differences, or failures soon after acquiring a business, which could undermine integration activities, delay launch of acquired products, and increase infrastructure risk. In addition, even with appropriate diligence, pre-acquisition practices of an acquired business have exposed us in the past and may expose us in the future to legal challenges and investigations that could subject us to criminal fines or reputational harm. Even if we are ultimately successful in resolving these matters, defending such claims may be costly and result in negative publicity. If we cannot successfully integrate our acquired businesses and realize contemplated revenue growth opportunities, cost savings and other synergies, our business, prospects, results of operations, financial position and cash flows could be materially and adversely affected.

Previous wording

We are subject to risks associated with public health crises arising from large-scale medical emergencies, pandemics, natural disasters and other extreme events, which have and could have an adverse effect on our business, results of operations, financial condition and financial performance.

Current wording

We are subject to risks associated with public health crises arising from large-scale medical emergencies, pandemics, natural disasters and other extreme events, which have had and could have an adverse effect on our business, results of operations, financial condition and financial performance.

Previous wording

We depend on our ability to attract, develop and retain qualified employees and executives, including those with diverse backgrounds, experiences and skills, to operate and expand our business. While we have development and succession plans in place for our key employees and executives, these plans do not guarantee that the services of our key employees and executives will continue to be available to us. If we are unable to attract, develop, retain and effectively manage the development and succession plans for key employees and executives, our business, results of operations and future performance could be adversely affected. Experienced and highly skilled employees and executives in the health care and technology industries are in high demand and the market for their services is competitive. We may have difficulty in replacing key executives because of the limited number of qualified individuals in these industries with the breadth of skills and experience required to operate and successfully expand our business. Adverse changes to our corporate culture could harm our business operations and our ability to retain key employees and executives.

Current wording

We depend on our ability to attract, develop and retain qualified employees and executives, including those with diverse talents, backgrounds, experiences and perspectives, to operate and expand our business. While we have development and succession plans in place for our key employees and executives, these plans do not guarantee that the services of our key employees and executives will continue to be available to us. If we are unable to attract, develop, retain and effectively manage the development and succession plans for key employees and executives, our business, results of operations and future performance could be adversely affected. Experienced and highly skilled employees and executives in the health care and technology industries are in high demand and the market for their services is competitive. We may have difficulty in replacing key executives because of the limited number of qualified individuals in these industries with the breadth of skills and experience required to operate and successfully expand our business. Adverse changes to our corporate culture could harm our business operations and our ability to retain key employees and executives.

Previous wording

As of December 31, 2023, our goodwill and other intangible assets had a carrying value of $119 billion, representing 43% of our total consolidated assets. We periodically evaluate our goodwill and other intangible assets to determine whether all or a portion of their carrying values may be impaired, in which case a charge to earnings may be necessary. The value of our goodwill may be materially and adversely impacted if businesses we acquire perform in a manner inconsistent with our assumptions. In addition, from time to time we divest businesses, and any such divestiture could result in significant asset impairment and disposition charges, including those related to goodwill and other intangible assets. Any future evaluations requiring an impairment of our goodwill and other intangible assets could materially and adversely affect our results of operations and equity in the period in which the impairment occurs. A material decrease in equity could, in turn, adversely affect our credit ratings.

Current wording

As of December 31, 2024, our goodwill and other intangible assets had a carrying value of $130 billion, representing 44% of our total consolidated assets. We periodically evaluate our goodwill and other intangible assets to determine whether all or a portion of their carrying values may be impaired, in which case a charge to earnings may be necessary. The value of our goodwill may be materially and adversely impacted if businesses we acquire perform in a manner inconsistent with our assumptions. In addition, from time to time we divest businesses, and any such divestiture could result in significant asset impairment and disposition charges, including those related to goodwill and other intangible assets. Any future evaluations requiring an impairment of our goodwill and other intangible assets could materially and adversely affect our results of operations and equity in the period in which the impairment occurs. A material decrease in equity could, in turn, adversely affect our credit ratings.

Previous wording

The health care industry is regularly subject to negative publicity, including as a result of governmental investigations, adverse media coverage and political debate concerning industry regulation. Negative publicity may adversely affect our stock price and damage our reputation, and expose us to unexpected or unwarranted regulatory scrutiny.

Current wording

The health care industry is regularly subject to negative publicity, including as a result of governmental investigations, adverse media coverage and political debate concerning industry regulation. Negative publicity may adversely affect our stock price, damage our reputation, and expose us to unexpected or unwarranted regulatory scrutiny.

Previous wording

Under the Medicaid managed care program, state Medicaid agencies solicit bids from eligible health plans to continue their participation in the acute care Medicaid health programs. If we are not successful in obtaining renewals of state Medicaid managed care contracts, we risk losing the members who were enrolled in those Medicaid programs. Under the Medicare Part D program, to qualify for automatic enrollment of low income members, our bids must result in an enrollee premium below a regional benchmark, which is calculated by the government after all regional bids are submitted. If the enrollee premium is not below the government benchmark, we risk losing the members who were auto-assigned to us and will not have additional members auto-assigned to us. Chronic failure to meet the benchmarks could result in termination of these government contracts. In general, our bids are based upon certain assumptions regarding enrollment, utilization, medical costs and other factors. If any of these assumptions are materially incorrect, either as a result of unforeseen changes to the programs on which we bid, implementation of material program or policy changes after our bid submission, or submission by our competitors at lower rates than our bids, our results of operations, financial position and cash flows could be materially and adversely affected.

Current wording

Under the Medicaid managed care program, state Medicaid agencies solicit bids from eligible health plans to continue their participation in the acute care Medicaid health programs. If we are not successful in obtaining renewals of state Medicaid managed care contracts, we risk losing the members who were enrolled in those Medicaid programs. Under the Medicare Part D program, to qualify for automatic enrollment of low income members, our bids must result in an enrollee premium below a regional benchmark, which is calculated by the government after all regional bids are submitted. If the enrollee premium is not below the government benchmark, we risk losing the members who were auto-assigned to us and will not have additional members auto-assigned to us. Chronic failure to meet the benchmarks could result in termination of these government contracts. In general, our bids are based upon certain assumptions regarding enrollment, utilization, medical costs and other factors. If any of these assumptions are materially incorrect, either as a result of unforeseen changes to the programs on which we bid, implementation of material program or policy changes after our bid submission, or submissions by our competitors at lower rates than our bids, our results of operations, financial position and cash flows could be materially and adversely affected.

Previous wording

Many of the government health care coverage programs we participate in are subject to the prior satisfaction of certain conditions or performance standards or benchmarks. For example, as part of the ACA, CMS has a system providing various quality bonus payments to Medicare Advantage plans meeting specified quality star ratings at the individual plan or local contract level. The star rating system considers various measures adopted by CMS, including, among others, quality of care, preventive services, chronic illness management, handling of appeals and customer satisfaction. Plans must have a rating of four stars or higher to qualify for bonus payments. If we do not maintain or continue to improve our star ratings, our plans may not be eligible for quality bonuses and we may experience a negative impact on our revenues and the benefits our plans can offer, which could materially and adversely affect the marketability of our plans and the number of people we serve. Any changes in standards or care delivery models applying to government health care programs, including Medicare and Medicaid, or our inability to maintain or improve our quality scores and star ratings to meet evolving government performance requirements or to match the performance of our competitors could result in limitations to our participation in or exclusion from these or other government programs, which could materially and adversely affect our results of operations, financial position and cash flows.

Current wording

Many of the government health care coverage programs we participate in are subject to the prior satisfaction of certain conditions or performance standards or benchmarks. For example, as part of the ACA, CMS has a system providing various quality bonus payments to Medicare Advantage plans meeting specified quality star ratings at the individual plan or local contract level. The star rating system considers various measures adopted by CMS, including, among others, quality of care, preventive services, chronic illness management, handling of appeals and customer satisfaction. Plans must have a rating of four stars or higher to qualify for bonus payments, and CMS has and may make changes to the star rating program that impact the ability of plans to achieve four-star or higher ratings. If we do not maintain or continue to improve our star ratings, our plans may not be eligible for quality bonuses and we may experience a negative impact on our revenues and the benefits our plans can offer, which could materially and adversely affect the marketability of our plans and the number of people we serve. Any changes in standards or care delivery models applying to government health care programs, including Medicare and Medicaid, or our inability to maintain or improve our quality scores and star ratings to meet evolving government performance requirements or to match the performance of our competitors could result in limitations to our participation in or exclusion from these or other government programs, which could materially and adversely affect our results of operations, financial position and cash flows.

Previous wording

We have been involved, and in the future may become involved in routine, regular and special governmental investigations, audits, reviews and assessments. Such investigations, audits, reviews or assessments sometimes arise out of, or prompt claims by private litigants or whistleblowers regarding, among other allegations, claims that we failed to disclose certain business practices or, as a government contractor, submitted false or erroneous claims to the government. Government investigations, audits, reviews and assessments could lead to government actions, which have resulted and in future periods could result in adverse publicity, the assessment of damages, civil or criminal fines or penalties, or other sanctions, including restrictions or changes in the way we conduct business, loss of licensure or exclusion from participation in government programs, any of which could have a material adverse effect on our business, results of operations, financial position and cash flows.

Current wording

We have been and in the future may become involved in routine, regular and special governmental investigations, audits, reviews and assessments. Such investigations, audits, reviews or assessments sometimes arise out of, or prompt claims by private litigants or whistleblowers regarding, among other allegations, claims that we failed to disclose certain business practices or, as a government contractor, submitted false or erroneous claims to the government. Government investigations, audits, reviews and assessments could lead to government actions, which have resulted and in future periods could result in adverse publicity, the assessment of damages, civil or criminal fines or penalties, or other sanctions, including restrictions or changes in the way we conduct business, loss of licensure or exclusion from participation in government programs, any of which could have a material adverse effect on our business, results of operations, financial position and cash flows.

Previous wording

We provide pharmacy care services through our Optum Rx and UnitedHealthcare businesses. Each business is subject to federal and state anti-kickback, beneficiary inducement and other laws governing the relationships of the business with pharmaceutical manufacturers, physicians, pharmacies, customers and consumers. In addition, federal and state legislatures regularly consider new regulations for the industry which could materially affect current industry practices, including potential new legislation and regulations regarding the receipt or disclosure of rebates and other fees from pharmaceutical companies, the development and use of formularies and other utilization management tools, the use of average wholesale prices or other pricing benchmarks, pricing for specialty pharmaceuticals, limited access to networks and pharmacy network reimbursement methodologies. Further, various governmental agencies have conducted and continue to conduct investigations and studies into certain PBM practices, which have resulted and in future periods may result in PBMs agreeing to civil penalties, including the payment of money and entry into corporate integrity agreements, or could materially and adversely impact the PBM business model. As a provider of pharmacy benefit management services, Optum Rx is also subject to an increasing number of licensure, registration and other laws and accreditation standards. Optum Rx conducts business through home delivery, specialty and compounding pharmacies, pharmacies located in community mental health centers and home infusion, which subjects it to extensive federal, state and local laws and regulations, including those of the DEA and individual state controlled substance authorities, the Food and Drug Administration (FDA) and Boards of Pharmacy.

Current wording

We provide pharmacy care services through our Optum Rx and UnitedHealthcare businesses. Each business is subject to federal and state anti-kickback, beneficiary inducement and other laws governing the relationships of the business with pharmaceutical manufacturers, physicians, pharmacies, customers and consumers. In addition, federal and state legislatures regularly consider new regulations for the industry which could materially affect current industry practices, including potential new legislation and regulations regarding the receipt or disclosure of rebates and other fees from pharmaceutical companies, the development and use of formularies and other utilization management tools, the use of average wholesale prices or other pricing benchmarks, pricing for specialty pharmaceuticals, limited access to networks and pharmacy network reimbursement methodologies. Further, various governmental agencies have conducted and continue to conduct investigations and studies into certain PBM practices, which have resulted and in future periods may result in PBMs agreeing to civil penalties, including the payment of money and entry into corporate integrity agreements, or could materially and adversely impact the PBM business model. As a provider of pharmacy benefit management services, Optum Rx is also subject to an increasing number of licensure, registration and other laws and accreditation standards. Optum Rx conducts business through home delivery, specialty and compounding pharmacies, pharmacies located in community mental health centers and home infusion, which subjects it to extensive federal, state and local laws and regulations, including those of the DEA and individual state controlled substance authorities, the Food and Drug Administration and Boards of Pharmacy.

Previous wording

The collection, maintenance, protection, use, transmission, disclosure and disposal of protected personal information are regulated at the federal, state, international and industry levels and addressed in requirements imposed on us by contracts with customers. Additionally, legislative and regulatory action in the United States at the federal, state and local levels, as well as internationally, is emerging in the areas of AI/ML and automation. These laws, regulations and requirements are subject to change. Compliance with new privacy, security, technology and data laws, regulations and requirements may result in increased operating costs, and may constrain or require us to alter our business model or operations.

Current wording

The collection, maintenance, protection, use, transmission, disclosure and disposal of protected personal information are regulated at the federal, state, international and industry levels and addressed in requirements of our customer contracts. Additionally, legislative and regulatory action in the United States at the federal, state and local levels, as well as internationally, is emerging in the areas of AI/ML and automation. These laws, regulations and requirements are subject to change. Compliance with new privacy, security, technology and data laws, regulations and requirements may result in increased operating costs, and may constrain or require us to alter our business model or operations.

Previous wording

Internationally, many of the jurisdictions in which we operate have established their own data security and privacy legal framework with which we or our customers must comply. We expect there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection, information security, and AI/ML and automation in the European Union, UK, Chile, India and other jurisdictions, and we cannot yet determine the impacts such future laws, regulations and standards may have on our businesses or the businesses of our customers. For example, the European Union’s General Data Protection Regulation (GDPR) imposes stringent European Union data protection requirements on us or our customers, and prescribes substantial penalties for noncompliance.

Current wording

Internationally, many of the jurisdictions in which we operate have established their own data security and privacy legal framework with which we or our customers must comply. We expect there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection, information security, and AI/ML and automation in the European Union, UK, Chile, India and other jurisdictions, and we cannot yet determine the impacts such future laws, regulations and standards may have on our businesses or the businesses of our customers.

Previous wording

Many of our businesses are also subject to the Payment Card Industry Data Security Standard, which is a multifaceted security standard designed to protect payment card account data.

Current wording

Some of our businesses are also subject to the Payment Card Industry Data Security Standard, which is a multifaceted security standard designed to protect payment card account data.

Previous wording

HIPAA requires business associates as well as covered entities to comply with specified privacy and security requirements. While we provide for appropriate protections through our contracts with our third-party service providers and in certain cases assess their security controls, we have limited oversight or control over their actions and practices. Several of our businesses act as business associates to their covered entity customers and, as a result, collect, use, disclose and maintain protected personal information in order to provide services to these customers. HHS administers its audit program to assess HIPAA compliance efforts by covered entities and business associates. An audit resulting in findings or allegations of noncompliance could damage our reputation and subject us to monetary and other sanctions.

Current wording

HIPAA requires business associates as well as covered entities to comply with specified privacy and security requirements. While we provide for appropriate protections through our contracts with our third-party service providers and in certain cases assess their security controls, we have limited oversight or control over their actions and practices. Several of our businesses act as business associates to their covered entity customers and, as a result, collect, use, disclose and maintain protected personal information in order to provide services to these customers. If HHS alleges or finds noncompliance with HIPAA privacy or security requirements, the allegations or findings could damage our reputation and subject us to monetary and other sanctions.

Previous wording

Through our Optum businesses, we maintain a database of administrative and clinical data statistically de-identified in accordance with HIPAA standards. Noncompliance or findings of noncompliance with applicable laws, regulations or requirements, or the occurrence of any privacy or security breach involving the misappropriation, loss or other unauthorized disclosure of protected personal information, whether by us or by one of our third-party service providers, could have a material adverse effect on our reputation and business and, among other consequences, could subject us to mandatory disclosure to the media, loss of existing or new customers, significant increases in the cost of managing and remediating privacy or security incidents, and material fines, penalties and litigation awards. Any of these consequences could have a material and adverse effect on our results of operations, financial position and cash flows.

Current wording

Through our Optum businesses, we maintain a database of administrative and clinical data statistically de-identified in accordance with HIPAA standards. Noncompliance or findings of noncompliance with applicable laws, regulations or requirements, or the occurrence of any privacy or security breach involving the misappropriation, loss or other unauthorized disclosure of protected personal information, whether by us or by one of our third-party service providers, could have an adverse effect on our reputation and business and, among other consequences, could subject us to mandatory disclosure to affected customers and the media, loss of existing or new customers, significant increases in the cost of managing and remediating privacy or security incidents, and could also result in significant fines, penalties and litigation awards. Any of these consequences could have a material and adverse effect on our results of operations, financial position and cash flows.

Previous wording

As an enterprise, we increasingly rely on new and evolving technologies, including those powered by or incorporating AI/ML, as part of our internal operations and in the delivery of our products and services. New technologies have potential and power to improve and optimize operational processes and clinical outcomes across the healthcare system, but also present ethical, technological, legal, regulatory and other risks. With respect to AI/ML, we have developed and implemented policies and procedures intended to promote and sustain responsible design, development, and use of AI/ML, consistent with industry best practices. Any inadequacy or failure in compliance with our responsible use of AI/ML policies and procedures or emerging laws, regulations and standards governing AI/ML use could cause our technology products not to operate as intended or to produce outcomes that could have a material and adverse effect on our business, reputation, results of operations, financial position and cash flows.

Current wording

As an enterprise, we increasingly rely on new and evolving technologies, including those powered by or incorporating AI/ML, as part of our internal operations and in the delivery of our products and services. New technologies have potential and power to improve and optimize operational processes and clinical outcomes across the healthcare system, but also present ethical, technological, legal, regulatory and other risks. With respect to AI/ML, we have developed and implemented policies and procedures intended to promote and sustain responsible design, development, and use of AI/ML, consistent with industry best practices. Any inadequacy or failure in compliance with our responsible use of AI/ML policies and procedures or emerging laws, regulations and standards governing AI/ML use could cause our technology products not to operate as intended or to produce outcomes, including possible regulatory enforcement action or litigation that could have a material and adverse effect on our business, reputation, results of operations, financial position and cash flows.