UNITEDHEALTH GROUP INC

Our businesses are subject to comprehensive U.S. federal and state and international laws and regulations. We are regulated by government agencies, which generally have discretion to issue regulations and interpret and enforce laws and regulations. U.S. federal and state and international governments continue to consider and enact various legislative and regulatory proposals which could materially impact certain aspects of the health care system and our operations. New laws and regulations, or changes in the interpretation of existing laws and regulations, including as a result of changes in the political environment, could adversely affect our businesses.

See Part I, Item 1A, “Risk Factors” for a discussion of the risks related to our compliance with U.S. federal and state and international laws and regulations.

U.S. Federal Laws and Regulation

When we contract with the federal government, we are subject to federal laws and regulations relating to the award, administration and performance of U.S. government contracts. CMS regulates our UnitedHealthcare businesses and certain aspects of our Optum businesses. Payments by CMS to our businesses are subject to regulations, including those governing fee-for-service and the submission of information relating to the health status of enrollees for purposes of determining the amounts of certain payments to us. CMS also has the right to audit our performance to determine our compliance with CMS contracts and regulations and the quality of care we provide to Medicare beneficiaries. Our commercial business is further subject to CMS audits related to medical loss ratios (MLRs) and risk adjustment data.

UnitedHealthcare Community & State has Medicaid and CHIP contracts, which are subject to federal regulations regarding services to be provided to Medicaid enrollees, payment for those services and other aspects of these programs. There are many regulations affecting Medicare and Medicaid compliance, and the regulatory environment with respect to these programs is complex.

Our businesses are also subject to laws and regulations relating to consumer protection, anti-fraud and abuse, anti-kickbacks, false claims, prohibited referrals, inappropriate reduction or limitation of health care services, anti-money laundering and securities and antitrust compliance.

Privacy, Security and Data Standards Regulation. Certain of our operations are subject to regulation under the administrative simplification provisions of the Health Insurance Portability and Accountability Act of 1996, as amended (HIPAA), which apply to both the group and individual health insurance markets, including self-funded employee benefit plans. Federal regulations related to HIPAA contain minimum standards for electronic transactions and code sets and for the privacy and security of protected health information.

Our businesses must comply with the Health Information Technology for Economic and Clinical Health Act (HITECH), which regulates matters relating to privacy, security and data standards. HITECH imposes requirements on uses and disclosures of health information; includes contracting requirements for HIPAA business associate agreements; extends parts of HIPAA privacy and security provisions to business associates; adds federal data breach notification requirements for covered entities and business associates and reporting requirements to HHS and the Federal Trade Commission (FTC) and, in some cases, to the local media; strengthens enforcement and imposes higher financial penalties for HIPAA violations and, in certain cases, imposes criminal penalties for individuals, including employees. In the conduct of our business, depending on the circumstances, we may act as either a covered entity or a business associate.

The use and disclosure of individually identifiable health data by our businesses are also regulated in some instances by other federal laws, including the Gramm-Leach-Bliley Act (GLBA) or state statutes implementing GLBA. These federal laws and state statutes generally require insurers to provide customers with notice regarding how their non-public personal health and financial information is used and the opportunity to “opt out” of certain disclosures before the insurer shares such information with a third party, and generally prescribe safeguards for the protection of personal information. Neither the GLBA nor HIPAA privacy regulations preempt more stringent state laws and regulations, which may apply to us, as discussed below. Federal consumer protection laws may also apply in some instances to privacy and security practices related to personally identifiable information.

ERISA. The Employee Retirement Income Security Act of 1974, as amended (ERISA), regulates how our services are provided to or through certain types of employer-sponsored health benefit plans. ERISA is a set of laws and regulations subject to interpretation by the U.S. Department of Labor (DOL) as well as the federal courts. ERISA sets forth standards on how our business units may do business with employers who sponsor employee health benefit plans, particularly those that maintain self-funded plans. Regulations established by the DOL subject us to additional requirements for administration of benefits, claims payment and member appeals under health care plans governed by ERISA.

State Laws and Regulation

Health Care Regulation. Our insurance and HMO subsidiaries must be licensed by the jurisdictions in which they conduct business. All of the states in which our subsidiaries offer insurance and HMO products regulate those products and operations. The states require periodic financial reports and establish minimum capital or restricted cash reserve requirements. The National Association of Insurance Commissioners (NAIC) has adopted model regulations which require expanded governance practices and risk and solvency assessment reporting. Most states have adopted these or similar measures to expand the scope of regulations relating to corporate governance and internal control activities of HMOs and insurance companies. We are required to maintain a risk management framework and file a confidential self-assessment report with state insurance regulators. We file reports annually with Connecticut, our lead regulator, and with New York, as required by the state’s regulation.

Our health plans and insurance companies are regulated under state insurance holding company regulations. Such regulations generally require registration with applicable state departments of insurance and the filing of reports describing capital structure, ownership, financial condition, certain affiliated transactions and general business operations. Most state insurance holding company laws and regulations require prior regulatory approval of acquisitions and material affiliated transfers of assets, as well as transactions between the regulated companies and their parent holding companies or affiliates. These laws and regulations may restrict the ability of our regulated subsidiaries to pay dividends to our holding companies.

Some of our business activity is subject to other health care-related regulations and requirements, including PPO, Managed Care Organization (MCO), utilization review (UR), behavioral health, TPA, pharmacy care services, durable medical equipment or care provider-related regulations and licensure requirements. These regulations differ from state to state and may contain network, contracting, product and rate, licensing and financial and reporting requirements. Health care-related laws and regulations set specific standards for delivery of services, mental health parity, appeals, grievances and payment of claims, adequacy of health care professional networks, fraud prevention, protection of consumer health information, pricing and underwriting practices and covered benefits and services. State health care anti-fraud and abuse prohibitions encompass a wide range of activities, including kickbacks for referral of members, billing for unnecessary medical services and improper marketing. Certain of our businesses are subject to state general agent, broker and sales distribution laws and regulations. UnitedHealthcare Community & State and certain of our Optum businesses are subject to regulation by state Medicaid agencies which oversee the provision of benefits to our Medicaid and CHIP beneficiaries and to our beneficiaries dually eligible for Medicare and Medicaid. We also contract with state governmental entities and are subject to state laws and regulations relating to the award, administration and performance of state government contracts.

State Privacy and Security Regulations. A number of states have adopted laws and regulations which may affect our privacy and security practices, such as state laws governing the use, disclosure and protection of social security numbers and protected health information or which are designed to implement GLBA or protect credit card account data. State and local authorities increasingly focus on the importance of protecting individuals from identity theft, with a significant number of states enacting laws requiring businesses to meet minimum cyber-security standards and notify individuals of security breaches involving personal information. State consumer protection laws may also apply to privacy and security practices related to personally identifiable information, including information related to consumers and care providers. Different approaches to state privacy and insurance regulation and varying enforcement philosophies may materially and adversely affect our ability to standardize our products and services across state lines. See Part I, Item 1A, “Risk Factors” for a discussion of the risks related to compliance with state privacy and security regulations.

Corporate Practice of Medicine and Fee-Splitting Laws. Certain of our businesses function as direct medical service providers and, as such, are subject to additional laws and regulations. Some states have corporate practice of medicine laws prohibiting specific types of entities from practicing medicine or employing physicians to practice medicine. Moreover, some states prohibit certain entities from engaging in fee-splitting practices, which involve sharing in the fees or revenues of a professional practice. These prohibitions may be statutory or regulatory, or may be imposed through judicial or regulatory interpretation. The laws, regulations and interpretations in certain states have been subject to limited judicial and regulatory interpretation and are subject to change. In addition, some states have begun to consider new laws to expand or change the scope of corporate practice of medicine laws. Any such changes could adversely impact how we structure transactions and contract with and support physicians in those states.

Pharmacy and Pharmacy Benefits Management (PBM) Regulations

Optum Rx’s businesses include home delivery, specialty and compounding pharmacies, as well as clinic-based pharmacies which must be licensed as pharmacies in the states in which they are located. Certain of our pharmacies must also register with the U.S. Drug Enforcement Administration (DEA) and individual state controlled substance authorities to dispense controlled substances. In addition to adhering to the laws and regulations in the states where our pharmacies are located, we also are required to comply with laws and regulations in some non-resident states where we deliver pharmaceuticals, including those requiring us to register with the board of pharmacy in the non-resident state. These non-resident states generally expect our pharmacies to follow the laws of the state in which the pharmacies are located, but some non-resident states also require us to comply with their laws if pharmaceuticals are delivered within those states. Additionally, certain of our pharmacies which participate in programs for Medicare and state Medicaid providers are required to comply with applicable Medicare and Medicaid provider rules and regulations. Other laws and regulations affecting our pharmacies include federal and state statutes and regulations governing the labeling, packaging, advertising and adulteration of prescription drugs and dispensing of controlled substances. See Part I, Item 1A, “Risk Factors” for a discussion of the risks related to our pharmacy care services businesses.

Federal and state legislation regulating PBM activities affects both our ability to limit access to a pharmacy provider network or remove network providers. Many states limit our ability to manage and establish maximum allowable costs for generic prescription drugs and regulate various pharmacy reimbursement measures. With respect to formulary services, a number of government entities, including CMS, HHS and state departments of insurance, regulate the administration of prescription drug benefits offered through federal or state exchanges. Many states also regulate the scope of prescription drug coverage, as well as the delivery channels to receive such prescriptions, for insurers, MCOs and Medicaid managed care plans. These regulations could limit or preclude (i) certain plan designs, (ii) limited networks, (iii) use of particular care providers or distribution channels, (iv) copayment differentials among providers and (v) formulary tiering practices.

Legislation seeking to regulate PBM activities introduced or enacted at the federal or state level could impact our business practices with others in the pharmacy supply chain, including pharmaceutical manufacturers and network providers. In addition, organizations like the NAIC periodically issue model regulations while credentialing organizations, like the National Committee for Quality Assurance (NCQA) and the Utilization Review Accreditation Commission (URAC), may establish standards impacting PBM pharmacy activities. Although these model regulations and standards do not have the force of law, they may influence states to adopt their recommendations and impact the services we deliver to our clients.

Consumer Protection Laws

Certain of our businesses participate in direct-to-consumer activities and are subject to regulations applicable to online communications and other general consumer protection laws and regulations such as the Federal Tort Claims Act, the Federal Postal Service Act and the FTC’s Telemarketing Sales Rule. Most states also have similar consumer protection laws.

Certain laws, such as the Telephone Consumer Protection Act, give the FTC, the Federal Communications Commission (FCC) and state attorneys general the ability to regulate, and bring enforcement actions relating to, telemarketing practices and certain automated outbound contacts such as phone calls, texts or emails. Under certain circumstances, these laws may provide consumers with a private right of action to enforce those laws. Violations of these laws could result in substantial statutory penalties and other sanctions.

Banking Regulation

Optum Bank is subject to supervision and regulation by the Utah State Department of Financial Institutions, which carries out annual examinations to ensure the bank is operating in accordance with state safety and soundness requirements and performs periodic examinations of the bank’s compliance with applicable state banking statutes, regulations and agency guidelines. Optum Bank is also subject to regulation by federal banking regulators, including the Federal Deposit Insurance Corporation (FDIC), which performs annual examinations to ensure the bank is operating in accordance with federal safety and soundness requirements, and the Consumer Financial Protection Bureau, which may perform periodic examinations to ensure the bank is in compliance with applicable consumer protection statutes, regulations and agency guidelines. In the event of unfavorable examination results or an enforcement action from these state or federal agencies, the bank could become subject to civil litigation, increased operational expenses and capital requirements, enhanced governmental oversight, monetary penalties and other sanctions.

Non-U.S. Regulation

Certain of our businesses operate internationally and are subject to regulation in the jurisdictions in which they are organized or conduct business. These regulatory regimes vary from jurisdiction to jurisdiction. In addition, our non-U.S. businesses and operations are subject to U.S. laws regulating the conduct and activities of U.S.-based businesses operating outside the United States, such as the Foreign Corrupt Practices Act (FCPA), which prohibits offering, promising, providing or authorizing others to give anything of value to a foreign government official to obtain or retain business or otherwise secure a business advantage.

COMPETITION

As a diversified health care company, we operate in highly competitive markets across the full expanse of health care benefits and services. Our competitors include organizations ranging from startups to highly sophisticated Fortune 50 global enterprises, for-profit and non-profit companies, and private and government-sponsored entities. New entrants to our markets and business combinations among our competitors and suppliers also contribute to a dynamic and competitive environment. We compete fundamentally on the quality and value we provide to those we serve, which can include elements such as product and service innovation; use of technology; consumer and provider engagement and satisfaction; and sales, marketing and pricing. See Part I, Item 1A, “Risk Factors” for additional discussion of our risks related to competition.

INTELLECTUAL PROPERTY RIGHTS

We have obtained trademark registration for the UnitedHealth Group, Optum and UnitedHealthcare names and logos. We own registrations for certain of our other trademarks in the United States and abroad. We hold a portfolio of patents and have patent applications pending from time to time. We are not substantially dependent on any single patent or group of related patents.

Unless otherwise noted, trademarks appearing in this report are trademarks owned by us. We disclaim any proprietary interest in the marks and names of others.

HUMAN CAPITAL RESOURCES

As of December 31, 2025, we had more than 390,000 employees, of whom nearly 165,000 were clinical professionals.

Our employees are guided by our mission to help people live healthier lives and help make the health system work better for everyone. Our mission and cultural values of integrity, compassion, inclusion, relationships, innovation and performance align with our long-term business strategy to increase access to care, make care more affordable, enhance the care experience and improve health outcomes. Our mission and values attract individuals who are determined to make a difference – individuals whose talent, innovation, engagement and empowerment are critical in our ability to achieve our mission.

We seek to maintain an inclusive environment where people of diverse talents, backgrounds, experiences and perspectives make us better. We promote an inclusive culture and a sense of belonging throughout our organization and operations, including in our talent acquisition and talent management practices; leadership development; careers; learning and skills; and systems and processes. We prioritize equal pay by objectively and regularly evaluating and reviewing our compensation practices by performance, experience, and other relevant measures.

INFORMATION ABOUT OUR EXECUTIVE OFFICERS

The following sets forth certain information regarding our executive officers as of March 2, 2026, including the business experience of each executive officer during the past five years:

Our Board of Directors elects executive officers annually. Our executive officers serve until their successors are duly elected and qualified, or until their earlier death, resignation, removal or disqualification.

Stephen Hemsleyhas served as Chief Executive Officer and Chair of the Board of UnitedHealth Group since May 2025. Steve previously served as Non-Executive Chair of the Board from November 2019 to May 2025, Executive Chair of the Board from September 2017 to November 2019, Chief Executive Officer from November 2006 to August 2017, President from May 1999 to November 2014, and Chief Operating Officer from November 1998 to November 2006. He joined the Company in 1997 and has been a member of the Board of Directors since 2000.

Wayne DeVeydt has served as Chief Financial Officer of UnitedHealth Group since September 2025. Prior to joining UnitedHealth Group, Wayne was Managing Director of Bain Capital, a private investment firm, from March 2022 to August 2025. Wayne previously served as Chief Executive Officer, from January 2018 to January 2020, and Executive Chairman of the Board of Directors, from January 2020 to August 2025, of Surgery Partners, an operator of surgical facilities and ancillary services, and Executive Vice President and Chief Financial Officer of Elevance Health (formerly known as Anthem), a health benefits and insurance provider, from 2007 to June 2016.

Dr. Patrick Conwayhas served as Chief Executive Officer of Optum since May 2025. Previously, Patrick served as Optum Rx’s Chief Executive Officer and held numerous leadership roles since joining UnitedHealth Group in February 2020, including service as Chief Executive Officer of Optum Health Care Solutions. Prior to joining UnitedHealth Group, Patrick held prominent senior leadership positions in the private and public sector and clinical settings, including service as Chief Medical Officer and acting administrator at Centers for Medicare and Medicaid Services, and as director of the CMS Innovation Center.

Erin McSweeney has served as Executive Vice President and Chief People Officer of UnitedHealth Group since March 2022. From February 2021 to March 2022, Erin served as chief of staff to UnitedHealth Group’s Office of the Chief Executive. From January 2017 to February 2021, she served as Executive Vice President and Chief Human Resources Officer at Optum. Prior to joining UnitedHealth Group, Erin was Executive Vice President and Chief Human Resources Officer for EMC Corporation, an international technology company.

Tim Noel has served as Chief Executive Officer of UnitedHealthcare since January 2025. Previously, Tim served as Chief Executive Officer of UnitedHealthcare’s Medicare & Retirement business and held numerous leadership roles since joining UnitedHealth Group from 2007 until January 2025, including serving as Chief Financial Officer and Senior Vice President of federal products for Medicare & Retirement.

Tom Roos has served as Senior Vice President and Chief Accounting Officer of UnitedHealth Group since August 2015. Prior to joining UnitedHealth Group, Tom was a Partner at Deloitte & Touche LLP, an independent registered public accounting firm.

Chris Zaettahas served as Executive Vice President, Chief Legal Officer and Corporate Secretary of UnitedHealth Group since May 2024. Previously, Chris served as Chief Legal Officer of Optum from September 2020 until May 2024. Prior to joining Optum in 2020, Chris was Vice President at Johnson & Johnson, a pharmaceutical company. Chris also held several leadership roles at UnitedHealth Group from May 2011 to September 2019, including Head of Litigation and General Counsel of the organization’s government businesses.

ADDITIONAL INFORMATION

Our executive offices are located at 1 Health Drive, Eden Prairie, Minnesota 55344 and 655 New York Avenue, Washington, DC 20001; our telephone number is (800) 328-5979. You can access our website at www.unitedhealthgroup.com to learn more about our company. We make periodic and current reports and amendments available, free of charge, on our website, as soon as reasonably practicable after we file or furnish these reports to the SEC. Information on or linked to our website is neither part of nor incorporated by reference into this Annual Report on Form 10-K or any other SEC filings.