UNITEDHEALTH GROUP INC

Our businesses are subject to comprehensive U.S. federal and state and international laws and regulations. We are regulated by agencies which generally have discretion to issue regulations and interpret and enforce laws and rules. U.S. federal and state and international governments continue to consider and enact various legislative and regulatory proposals which could materially impact certain aspects of the health care system. New laws, regulations and rules, or changes in the interpretation of existing laws, regulations and rules, including as a result of changes in the political environment, could adversely affect our businesses.

See Part I, Item 1A, “Risk Factors” for a discussion of the risks related to our compliance with U.S. federal and state and international laws and regulations.

U.S. Federal Laws and Regulation

When we contract with the federal government, we are subject to federal laws and regulations relating to the award, administration and performance of U.S. government contracts. CMS regulates our UnitedHealthcare businesses and certain aspects of our Optum businesses. Payments by CMS to our businesses are subject to regulations, including those governing fee-for-service and the submission of information relating to the health status of enrollees for purposes of determining the amounts of certain payments to us. CMS also has the right to audit our performance to determine our compliance with CMS contracts and regulations and the quality of care we provide to Medicare beneficiaries. Our commercial business is further subject to CMS audits related to medical loss ratios (MLRs) and risk adjustment data.

UnitedHealthcare Community & State has Medicaid and CHIP contracts, which are subject to federal regulations regarding services to be provided to Medicaid enrollees, payment for those services and other aspects of these programs. There are many regulations affecting Medicare and Medicaid compliance, and the regulatory environment with respect to these programs is complex.

Our businesses are also subject to laws and regulations relating to consumer protection, anti-fraud and abuse, anti-kickbacks, false claims, prohibited referrals, inappropriate reduction or limitation of health care services, anti-money laundering and securities and antitrust compliance.

Privacy, Security and Data Standards Regulation. Certain of our operations are subject to regulation under the administrative simplification provisions of the Health Insurance Portability and Accountability Act of 1996, as amended (HIPAA), which apply to both the group and individual health insurance markets, including self-funded employee benefit plans. Federal regulations related to HIPAA contain minimum standards for electronic transactions and code sets and for the privacy and security of protected health information.

Our businesses must comply with the Health Information Technology for Economic and Clinical Health Act (HITECH), which regulates matters relating to privacy, security and data standards. HITECH imposes requirements on uses and disclosures of health information; includes contracting requirements for HIPAA business associate agreements; extends parts of HIPAA privacy and security provisions to business associates; adds federal data breach notification requirements for covered entities and business associates and reporting requirements to HHS and the Federal Trade Commission (FTC) and, in some cases, to the local media; strengthens enforcement and imposes higher financial penalties for HIPAA violations and, in certain cases, imposes criminal penalties for individuals, including employees. In the conduct of our business, depending on the circumstances, we may act as either a covered entity or a business associate.

The use and disclosure of individually identifiable health data by our businesses are also regulated in some instances by other federal laws, including the Gramm-Leach-Bliley Act (GLBA) or state statutes implementing GLBA. These federal laws and state statutes generally require insurers to provide customers with notice regarding how their non-public personal health and financial information is used and the opportunity to “opt out” of certain disclosures before the insurer shares such information with a third party, and generally prescribe safeguards for the protection of personal information. Neither the GLBA nor HIPAA privacy regulations preempt more stringent state laws and regulations, which may apply to us, as discussed below. Federal consumer protection laws may also apply in some instances to privacy and security practices related to personally identifiable information.

ERISA. The Employee Retirement Income Security Act of 1974, as amended (ERISA), regulates how our services are provided to or through certain types of employer-sponsored health benefit plans. ERISA is a set of laws and regulations subject to interpretation by the U.S. Department of Labor (DOL) as well as the federal courts. ERISA sets forth standards on how our business units may do business with employers who sponsor employee health benefit plans, particularly those who maintain self-funded plans. Regulations established by the DOL subject us to additional requirements for administration of benefits, claims payment and member appeals under health care plans governed by ERISA.

State Laws and Regulation

Health Care Regulation. Our insurance and HMO subsidiaries must be licensed by the jurisdictions in which they conduct business. All of the states in which our subsidiaries offer insurance and HMO products regulate those products and operations. The states require periodic financial reports and establish minimum capital or restricted cash reserve requirements. The National Association of Insurance Commissioners (NAIC) has adopted model regulations, which require expanded governance practices and risk and solvency assessment reporting. Most states have adopted these or similar measures to expand the scope of regulations relating to corporate governance and internal control activities of HMOs and insurance companies. We are required to maintain a risk management framework and file a confidential self-assessment report with state insurance regulators. We file reports annually with Connecticut, our lead regulator, and with New York, as required by the state’s regulation.

Our health plans and insurance companies are regulated under state insurance holding company regulations. Such regulations generally require registration with applicable state departments of insurance and the filing of reports describing capital structure, ownership, financial condition, certain affiliated transactions and general business operations. Most state insurance holding company laws and regulations require prior regulatory approval of acquisitions and material affiliated transfers of assets, as well as transactions between the regulated companies and their parent holding companies or affiliates. These laws may restrict the ability of our regulated subsidiaries to pay dividends to our holding companies.

Some of our business activity is subject to other health care-related regulations and requirements, including PPO, Managed Care Organization (MCO), utilization review (UR), TPA, pharmacy care services, durable medical equipment or care provider-related regulations and licensure requirements. These regulations differ from state to state and may contain network, contracting, product and rate, licensing and financial and reporting requirements. Health care-related laws and regulations set specific standards for delivery of services, appeals, grievances and payment of claims, adequacy of health care professional networks, fraud prevention, protection of consumer health information, pricing and underwriting practices and covered benefits and services. State health care anti-fraud and abuse prohibitions encompass a wide range of activities, including kickbacks for referral of members, billing for unnecessary medical services and improper marketing. Certain of our businesses are subject to state general agent, broker and sales distribution laws and regulations. UnitedHealthcare Community & State and certain of our Optum businesses are subject to regulation by state Medicaid agencies which oversee the provision of benefits to our Medicaid and CHIP beneficiaries and to our beneficiaries dually eligible for Medicare and Medicaid. We also contract with state governmental entities and are subject to state laws and regulations relating to the award, administration and performance of state government contracts.

State Privacy and Security Regulations. A number of states have adopted laws and regulations which may affect our privacy and security practices, such as state laws governing the use, disclosure and protection of social security numbers and protected health information or which are designed to implement GLBA or protect credit card account data. State and local authorities increasingly focus on the importance of protecting individuals from identity theft, with a significant number of states enacting laws requiring businesses to meet minimum cyber-security standards and notify individuals of security breaches involving personal information. State consumer protection laws may also apply to privacy and security practices related to personally identifiable information, including information related to consumers and care providers. Different approaches to state privacy and insurance regulation and varying enforcement philosophies may materially and adversely affect our ability to standardize our products and services across state lines. See Part I, Item 1A, “Risk Factors” for a discussion of the risks related to compliance with state privacy and security regulations.

Corporate Practice of Medicine and Fee-Splitting Laws. Certain of our businesses function as direct medical service providers and, as such, are subject to additional laws and regulations. Some states have corporate practice of medicine laws prohibiting specific types of entities from practicing medicine or employing physicians to practice medicine. Moreover, some states prohibit certain entities from engaging in fee-splitting practices, which involve sharing in the fees or revenues of a professional practice. These prohibitions may be statutory or regulatory, or may be imposed through judicial or regulatory interpretation. The laws, regulations and interpretations in certain states have been subject to limited judicial and regulatory interpretation and are subject to change.

Pharmacy and Pharmacy Benefits Management (PBM) Regulations

Optum Rx’s businesses include home delivery, specialty and compounding pharmacies, as well as clinic-based pharmacies which must be licensed as pharmacies in the states in which they are located. Certain of our pharmacies must also register with the U.S. Drug Enforcement Administration (DEA) and individual state controlled substance authorities to dispense controlled substances. In addition to adhering to the laws and regulations in the states where our pharmacies are located, we also are required to comply with laws and regulations in some non-resident states where we deliver pharmaceuticals, including those requiring us to register with the board of pharmacy in the non-resident state. These non-resident states generally expect our pharmacies to follow the laws of the state in which the pharmacies are located, but some non-resident states also require us to comply with their laws where pharmaceuticals are delivered. Additionally, certain of our pharmacies which participate in programs for Medicare and state Medicaid providers are required to comply with applicable Medicare and Medicaid provider rules and regulations. Other laws and regulations affecting our pharmacies include federal and state statutes and regulations governing the labeling, packaging, advertising and adulteration of prescription drugs and dispensing of controlled substances. See Part I, Item 1A, “Risk Factors” for a discussion of the risks related to our pharmacy care services businesses.

Federal and state legislation regulating PBM activities affects both our ability to limit access to a pharmacy provider network or remove network providers. Additionally, many states limit our ability to manage and establish maximum allowable costs for generic prescription drugs. With respect to formulary services, a number of government entities, including CMS, HHS and state departments of insurance, regulate the administration of prescription drug benefits offered through federal or state exchanges. Many states also regulate the scope of prescription drug coverage, as well as the delivery channels to receive such prescriptions, for insurers, MCOs and Medicaid managed care plans. These regulations could limit or preclude (i) certain plan designs, (ii) limited networks, (iii) use of particular care providers or distribution channels, (iv) copayment differentials among providers and (v) formulary tiering practices.

Legislation seeking to regulate PBM activities introduced or enacted at the federal or state level could impact our business practices with others in the pharmacy supply chain, including pharmaceutical manufacturers and network providers. In addition, organizations like the NAIC periodically issue model regulations while credentialing organizations, like the National Committee for Quality Assurance (NCQA) and the Utilization Review Accreditation Commission (URAC), may establish standards impacting PBM pharmacy activities. Although these model regulations and standards do not have the force of law, they may influence states to adopt their recommendations and impact the services we deliver to our clients.

Consumer Protection Laws

Certain of our businesses participate in direct-to-consumer activities and are subject to regulations applicable to online communications and other general consumer protection laws and regulations such as the Federal Tort Claims Act, the Federal Postal Service Act and the FTC’s Telemarketing Sales Rule. Most states also have similar consumer protection laws.

Certain laws, such as the Telephone Consumer Protection Act, give the FTC, the Federal Communications Commission (FCC) and state attorneys general the ability to regulate, and bring enforcement actions relating to, telemarketing practices and certain automated outbound contacts such as phone calls, texts or emails. Under certain circumstances, these laws may provide consumers with a private right of action. Violations of these laws could result in substantial statutory penalties and other sanctions.

Banking Regulation

Optum Bank is subject to regulation by federal banking regulators, including the Federal Deposit Insurance Corporation (FDIC), which performs annual examinations to ensure the bank is operating in accordance with federal safety and soundness requirements, and the Consumer Financial Protection Bureau, which may perform periodic examinations to ensure the bank is in compliance with applicable consumer protection statutes, regulations and agency guidelines. Optum Bank is also subject to supervision and regulation by the Utah State Department of Financial Institutions, which carries out annual examinations to ensure the bank is operating in accordance with state safety and soundness requirements and performs periodic examinations of the bank’s compliance with applicable state banking statutes, regulations and agency guidelines. In the event of unfavorable examination results from any of these agencies, the bank could become subject to increased operational expenses and capital requirements, enhanced governmental oversight and monetary penalties.

Non-U.S. Regulation

Certain of our businesses operate internationally and are subject to regulation in the jurisdictions in which they are organized or conduct business. These regulatory regimes vary from jurisdiction to jurisdiction. In addition, our non-U.S. businesses and operations are subject to U.S. laws regulating the conduct and activities of U.S.-based businesses operating outside the United States, such as the Foreign Corrupt Practices Act (FCPA), which prohibits offering, promising, providing or authorizing others to give anything of value to a foreign government official to obtain or retain business or otherwise secure a business advantage.

COMPETITION

As a diversified health care company, we operate in highly competitive markets across the full expanse of health care benefits and services. Our competitors include organizations ranging from startups to highly sophisticated Fortune 50 global enterprises, for-profit and non-profit companies, and private and government-sponsored entities. New entrants to our markets and business combinations among our competitors and suppliers also contribute to a dynamic and competitive environment. We compete fundamentally on the quality and value we provide to those we serve which can include elements such as product and service innovation; use of technology; consumer and provider engagement and satisfaction; and sales, marketing and pricing. See Part I, Item 1A, “Risk Factors” for additional discussion of our risks related to competition.

INTELLECTUAL PROPERTY RIGHTS

We have obtained trademark registration for the UnitedHealth Group, Optum and UnitedHealthcare names and logos. We own registrations for certain of our other trademarks in the United States and abroad. We hold a portfolio of patents and have patent applications pending from time to time. We are not substantially dependent on any single patent or group of related patents.

Unless otherwise noted, trademarks appearing in this report are trademarks owned by us. We disclaim any proprietary interest in the marks and names of others.

HUMAN CAPITAL RESOURCES

Our nearly 400,000 employees, as of December 31, 2024, including more than 140,000 clinical professionals, are guided by our mission to help people live healthier lives and help make the health system work better for everyone. Our mission and cultural values of integrity, compassion, inclusion, relationships, innovation, performance and quality align with our long-term business strategy to increase access to care, make care more affordable, enhance the care experience, improve health outcomes and advance health equity. Our mission and values attract individuals who are determined to make a difference – individuals whose talent, innovation, engagement and empowerment are critical in our ability to achieve our mission.

We are committed to developing our people and culture by creating an inclusive environment where people of diverse talents, backgrounds, experiences and perspectives make us better. Our approach is data-driven and leader-led and uses enterprise and business scorecards to ensure our leaders are accountable for a consistent focus on hiring, developing, advancing and retaining diverse talent. We have embedded inclusion and diversity throughout our culture, including in our talent acquisition and talent management practices; leadership development; careers; learning and skills; and systems and processes. We strive to maintain a skilled, sustainable and diverse talent pipeline by building strong strategic partnerships and outreach through early career programs, internships and apprenticeships. We support career coaching, mentorship and accelerated leadership development programs to ensure mobility and advancement for our diverse talent. To foster an engaged workforce and an inclusive culture, we invest in a broad array of skills-based learning and culture development programs. We rely on a shared leadership framework, which clearly and objectively defines our expectations, enables an environment where everyone has the opportunity to learn and grow, and helps us identify, develop and deploy talent to help achieve our mission.

We prioritize pay equity by objectively and regularly evaluating and reviewing our compensation practices by performance, age, experience, gender, ethnicity and race. Receiving on-going feedback from our team members is another way to strengthen and reinforce a culture of inclusion. Our Employee Experience Index measures an employee’s sense of commitment and belonging to our company and is a metric in the Stewardship section of our annual incentive plan. Our Sustainability Report, which can be accessed on our website at www.unitedhealthgroup.com, provides further information about our people and culture.

INFORMATION ABOUT OUR EXECUTIVE OFFICERS

The following sets forth certain information regarding our executive officers as of February 27, 2025, including the business experience of each executive officer during the past five years:

Our Board of Directors elects executive officers annually. Our executive officers serve until their successors are duly elected and qualified, or until their earlier death, resignation, removal or disqualification.

Andrew Witty has served as Chief Executive Officer and a member of the Board of Directors of UnitedHealth Group since February 2021. Previously, Andrew served as Chief Executive Officer of Optum from July 2018 to April 2021, President of UnitedHealth Group from November 2019 to February 2021 and as a UnitedHealth Group director from August 2017 to March 2018. Prior to joining UnitedHealth Group, he was Chief Executive Officer and a board member of GlaxoSmithKline, a global pharmaceutical company, from 2008 to 2017.

John Rex has served as President and Chief Financial Officer of UnitedHealth Group since April 2024. Previously, John served as Chief Financial Officer of UnitedHealth Group since June 2016. From March 2012 to June 2016, he served as Executive Vice President and Chief Financial Officer of Optum. Prior to joining Optum in 2012, John was a Managing Director at JP Morgan, a global financial services firm.

Heather Cianfrocco has served as Chief Executive Officer of Optum since April 2024. Previously, Heather served as Optum's President and held numerous leadership roles since joining UnitedHealth Group from 2008 until April 2024, including serving as Chief Executive Officer of Optum Rx, Chief Executive Officer for Optum's Health Services and Chief Executive Officer of UnitedHealthcare Community & State.

Erin McSweeney has served as Executive Vice President and Chief People Officer of UnitedHealth Group since March 2022. From February 2021 to March 2022, Erin served as chief of staff to UnitedHealth Group’s Office of the Chief Executive. From January 2017 to February 2021, she served as Executive Vice President and Chief Human Resources Officer at Optum. Prior to joining UnitedHealth Group, Erin was Executive Vice President and Chief Human Resources Officer for EMC Corporation, an international technology company.

Tim Noel has served as Chief Executive Officer of UnitedHealthcare since January 2025. Previously, Tim served as Chief Executive Officer of UnitedHealthcare’s Medicare & Retirement business and held numerous leadership roles since joining UnitedHealth Group from 2007 until January 2025, including serving as Chief Financial Officer and Senior Vice President of federal products for Medicare & Retirement.

Tom Roos has served as Senior Vice President and Chief Accounting Officer of UnitedHealth Group since August 2015. Prior to joining UnitedHealth Group, Tom was a Partner at Deloitte & Touche LLP, an independent registered public accounting firm.

Chris Zaettahas served as Executive Vice President, Chief Legal Officer and Corporate Secretary of UnitedHealth Group since May 2024. Previously, Chris served as Chief Legal Officer of Optum from September 2020 until May 2024. Prior to joining Optum in 2020, Chris was Vice President at Johnson & Johnson, a pharmaceutical company. Chris also held several leadership roles at UnitedHealth Group from May 2011 to September 2019, including Head of Litigation and General Counsel of the organization’s government businesses.

ADDITIONAL INFORMATION

Our executive offices are located at 1 Health Drive, Eden Prairie, Minnesota 55344 and 655 New York Avenue, Washington, DC 20001; our telephone number is (800) 328-5979. You can access our website at www.unitedhealthgroup.com to learn more about our company. We make periodic and current reports and amendments available, free of charge, on our website, as soon as reasonably practicable after we file or furnish these reports to the Securities and Exchange Commission (SEC). Information on or linked to our website is neither part of nor incorporated by reference into this Annual Report on Form 10-K or any other SEC filings.