HCA Healthcare Inc

Previous wording

As of December 31, 2023, our total indebtedness was $39.593 billion. As of December 31, 2023, we had availability of $3.487 billion under our senior secured cash flow credit facility and $2.620 billion under our senior secured asset-based revolving credit facility, after giving effect to letters of credit and borrowing base limitations. Our indebtedness could have important consequences, including:

Current wording

As of December 31, 2024, our total indebtedness was $43.031 billion. As of December 31, 2024, we had availability of $3.486 billion under our senior secured cash flow credit facility and $4.500 billion under our senior secured asset-based revolving credit facility, after giving effect to letters of credit and borrowing base limitations. Our indebtedness could have important consequences, including:

Previous wording

Our operations are dependent on the efforts, abilities and experience of our management and medical personnel, such as physicians, nurses, pharmacists and lab technicians. We compete with other health care providers in recruiting and retaining qualified management and personnel responsible for the daily operations of each of our hospitals and other facilities, including nurses and other nonphysician health care professionals. In some markets, the availability of nurses and other medical support personnel has been a significant operating issue to health care providers, including at certain of our facilities. The impact of labor shortages across the health care industry may result in other health care facilities, such as nursing homes, limiting admissions, which may constrain our ability to discharge patients to such facilities and further exacerbate the demand on our resources, supplies and staffing.

Current wording

Our operations are dependent on the efforts, abilities and experience of our management and medical personnel, such as physicians, nurses, pharmacists and lab technicians. We compete with other health care providers in recruiting and retaining qualified management and personnel responsible for the daily operations of each of our hospitals and other facilities, including nurses and other nonphysician health care professionals. We depend on the available labor pool of employees in each of the markets in which we operate to fill other necessary positions. In some markets, the availability of nonphysician health care professionals and medical support personnel has been a significant operating issue to health care providers, including at certain of our facilities. The impact of labor shortages across the health care industry may result in other health care facilities, such as nursing homes, limiting admissions, which may constrain our ability to discharge patients to such facilities, increase labor costs and further exacerbate the demand on our resources, supplies and staffing.

Previous wording

Economic conditions, increased inflationary pressure and COVID-19 have exacerbated workforce competition, shortages and capacity constraints. We may be required to increase wages and benefits to recruit and retain nurses and other medical support personnel and to hire more expensive temporary or contract personnel. As a result of labor shortages, competition and inflationary pressures, our labor costs could increase and our capacity could be negatively impacted. We also depend on the available labor pool of employees in each of the markets in which we operate to fill other necessary positions. If there is continued competition for these employees or additional union organizing activity or a significant portion of our employee base unionizes, it is possible our labor costs could increase.

Current wording

Economic conditions, including macroeconomic uncertainties and inflationary pressure, workforce burnout, and public health conditions have exacerbated workforce competition, personnel shortages and capacity constraints. We may be required to increase wages and benefits to recruit and retain nurses and other medical support personnel and to hire more expensive temporary or contract personnel.

Previous wording

When negotiating collective bargaining agreements with unions, whether such agreements are renewals or first contracts, we have experienced, and could experience in the future, labor strikes. Our continued operation during any strikes could result in an increase to our labor costs. In addition, upon the expiration of existing collective bargaining agreements, we may not reach new agreements without union action, and any such new agreements may not be on terms satisfactory to us. The unavailability of staff, or the inability of the Company to control labor costs, could have a material, adverse effect on our capacity, growth prospects and results of operations.

Current wording

If there is additional union organizing activity or a significant portion of our employee base unionizes, it is possible our labor costs could increase. When negotiating collective bargaining agreements with unions, whether such agreements are renewals or first contracts, we have experienced, and could experience in the future, labor strikes. Our continued operation during any strikes could result in an increase to our labor costs. In addition, upon the expiration of existing collective bargaining agreements, we may not reach new agreements without union action, and any such new agreements may not be on terms satisfactory to us. The unavailability of staff, or the inability of the Company to control labor costs, could have a material, adverse effect on our capacity, growth prospects and results of operations.

Previous wording

In addition, federal and state laws and regulations may increase our costs of maintaining qualified nurses and other medical support personnel. We operate in states that have adopted mandatory nurse-staffing ratios or mandate staffing committees to develop staffing plans. If these states reduce, or if additional states in which we operate adopt, mandatory nurse-staffing ratios or related measures, such changes could significantly affect labor costs and have an adverse impact on revenues if we are required to limit admissions or incur other costs in order to comply. If our labor costs continue to increase, we may not be able to offset these increased costs as a significant percentage of our revenues consists of fixed, prospective payments.

Current wording

In addition, federal and state laws and regulations may increase our costs of maintaining qualified nurses and other medical support personnel. We operate in states that have adopted mandatory nurse-staffing ratios or mandate staffing committees to develop staffing plans. If these states reduce, or if additional states in which we operate adopt or the federal government adopts, mandatory nurse-staffing ratios or related measures, our compliance with such measures could significantly affect labor costs and have an adverse impact on revenues or our results of operations if we are required to limit admissions, hire additional personnel or otherwise incur additional costs. If our labor costs continue to increase, we may not be able to offset these increased costs, as a significant percentage of our revenues are based on reimbursement rates that are fixed or negotiated no less frequently than annually.

Previous wording

The success of our hospitals depends in part on the number and quality of the physicians on the medical staffs of our hospitals, the admission and utilization practices of those physicians, maintaining good relations with those physicians and controlling costs related to their employment or affiliation with our hospitals. Although we employ some physicians, physicians are often not employees of the hospitals at which they practice and instead affiliate with us and use our facilities as an extension of their practices. In many of the markets we serve, physicians may have admitting privileges at other hospitals in addition to our hospitals. We continue to face increasing competition to recruit and retain quality physicians, as well as increasing cost to contract with hospital-based physicians. Such physicians may terminate their affiliation with our hospitals at any time. We anticipate facing increased challenges in this area as the physician population reaches retirement age, especially if there is a shortage of physicians willing and able to provide comparable services. If we are unable to recruit and retain quality physicians to affiliate with our hospitals, enter into contractual arrangements with hospital-based physicians, or provide adequate support personnel or technologically advanced equipment and hospital facilities that meet the needs of those physicians and their patients, our admissions may decrease, our operating performance may decline, and our capacity and growth prospects may be materially adversely affected.

Current wording

The success of our hospitals depends in part on the number and quality of the physicians on the medical staffs of our hospitals, the admission and utilization practices of those physicians, maintaining good relations with those physicians and controlling costs related to their employment or affiliation with our hospitals. Although we employ some physicians, physicians are often not employees of the hospitals at which they practice and instead affiliate with us and use our facilities as an extension of their practices. In many of the markets we serve, physicians may have admitting privileges at other hospitals in addition to our hospitals. We continue to face increasing competition to recruit and retain quality physicians, as well as increasing costs to contract with hospital-based physicians. Such physicians may terminate their affiliation with our hospitals at any time. If states enact legal restrictions on the provision of medical care, such restrictions may impact providers' recruitment and retention efforts in certain states. We anticipate facing increased challenges in this area as the physician population reaches retirement age, especially if there is a shortage of physicians willing and able to provide comparable services. If we are unable to recruit and retain quality physicians to affiliate with our hospitals, enter into contractual arrangements with hospital-based physicians, or provide adequate support personnel or technologically advanced equipment and hospital facilities that meet the needs of those physicians and their patients, our admissions may decrease, our operating performance may decline, and our capacity and growth prospects may be materially adversely affected.

Previous wording

We may be unable to attract, hire and retain a highly qualified and diverse workforce, including key management.

Current wording

We may be unable to attract, hire and retain a highly qualified workforce, including key management.

Previous wording

The talents and efforts of our employees, particularly our key management, are vital to our success. The members of our management team have significant industry experience, and if any member leaves the Company, such member would be difficult to replace. In addition, institutional knowledge may be lost in any potential managerial transition. We may be unable to retain key management or attract other highly qualified employees, particularly if we do not offer employment terms that are competitive with the rest of the labor market. Failure to attract, hire, develop, motivate, and retain highly qualified and diverse employee talent, or failure to develop and implement an adequate succession plan for the management team, could disrupt our operations and adversely affect our business and our future success.

Current wording

The talents and efforts of our employees, particularly our key management, are vital to our success. The members of our management team have significant industry experience, and if any member leaves the Company, such member would be difficult to replace. While we have adopted succession plans to prepare for such an event, our succession plans may not result in a successful transition. Further, institutional knowledge may be lost in any potential managerial transition. We may be unable to retain key management or attract other highly qualified employees, particularly if we do not offer employment terms that are competitive with the rest of the labor market. Failure to attract, hire, develop, motivate, and retain highly qualified employee talent or failure to develop and implement an adequate succession plan for the management team could disrupt our operations and adversely affect our business and our future success.

Previous wording

Cybersecurity incidents or other forms of data breaches could result in the compromise of our facilities, confidential data or critical data systems. A cybersecurity incident or other form of data breach could also give rise to potential harm to patients; remediation and other expenses; and exposure to liability under HIPAA, consumer protection laws, common law theories or other laws. Such incidents could subject us to litigation and foreign, federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business.

Current wording

Cybersecurity incidents or other forms of data breaches could result in the compromise of our facilities, confidential data or critical data systems, causing our operations to be impaired or impacted. A cybersecurity incident or other form of data breach could also give rise to potential harm to patients; remediation and other expenses; and exposure to liability under privacy and security laws, consumer protection laws, common law theories or other laws. Such incidents could subject us to litigation and foreign, federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business.

Previous wording

We, directly and through our vendors and other third parties, collect and store on our networks and devices and third-party technology platforms sensitive information, including intellectual property, proprietary business information, personally identifiable information and protected health information of our patients and personally identifiable information of our employees and consumers. Our facilities use EHRs and medical devices that store or transmit information that are integral to the provision of patient care, and these systems and devices are increasingly connected to the internet, hospital networks and other medical devices. The secure maintenance of this information and technology is critical to our business operations.

Current wording

We, directly and through our vendors and other third parties, collect and store on our networks and devices and third-party technology platforms sensitive information, including intellectual property, proprietary business information, protected health information of our patients and personally identifiable information of our employees, patients and consumers. Our facilities use EHRs and medical devices that store or transmit information that are integral to the provision of patient care, and these systems and devices are increasingly connected to the internet, hospital networks and other medical devices. The secure maintenance of this information and technology is critical to our business operations.

Previous wording

Despite our efforts to mitigate our exposure to cyberattack, even an advanced internal control environment is vulnerable to compromise. In July 2023, we disclosed a security incident in which an unauthorized party accessed information at an external storage location exclusively used to automate the formatting of email messages. Approximately 11 million patients were affected by the security incident. In response to this security incident, we reinforced our cybersecurity systems, protocols and monitoring procedures, particularly focusing on data interfaces with third party storage locations. We continue to be the target of attempted cybersecurity and other threats that could have a security impact, including those by third parties to access, misappropriate, corrupt or manipulate our information or disrupt our operations. We expect to continue to experience an increase in cybersecurity threats in the future, as the volume and intensity of cyberattacks on hospitals, health systems and other health care entities continue to increase. Threats from malicious persons and groups, new vulnerabilities and advanced new attacks against our, or our vendors’, information systems and devices create risk of cybersecurity incidents, including ransomware, malware and phishing incidents, in which third parties attempt to fraudulently induce our employees or our vendors’ employees into disclosing usernames, passwords or other sensitive information, which can in turn be used for unauthorized access to our or our vendors’ systems. The rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks by making cyberattacks more difficult to detect, contain or mitigate. We have seen, and believe we will continue to see, widespread vulnerabilities that could affect our or other third parties’ data or systems. Mitigation and remediation recommendations continue to evolve, and addressing this and other critical vulnerabilities pertaining to widely used systems, platforms and infrastructure is a priority for us. Internal access management failures could result in the compromise or unauthorized exposure of confidential data. Moreover, hardware, software or applications we use may have inherent vulnerabilities or defects of design, manufacture or operations or could be inadvertently or intentionally implemented or used in a manner that could compromise information security. There can be no assurance that we or our vendors and other third parties will not be subject to additional cybersecurity threats and incidents that bypass our or their security measures, impact the integrity, availability or privacy of personal health information or other data subject to privacy laws or disrupt our or their information systems, devices or business, including our ability to provide various health care services. In such an event, we may incur substantial costs, including but not limited to, costs associated with remediating the effects of th…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We have implemented multiple layers of security measures, including cybersecurity and information security systems, protocols and monitoring procedures, intended to protect the confidentiality, integrity and availability of our data and the systems and devices that store and transmit such data. In addition, we rely on various third parties to have appropriate controls to protect our information that is on their systems or otherwise in their control, and we seek to obtain assurances that such third parties will protect our information. However, despite our efforts to mitigate our exposure to cyberattack, even an advanced internal control environment is vulnerable to compromise. We have seen, and believe we will continue to see, widespread vulnerabilities that could affect our or other third parties’ data or systems. We rely on a substantial number of employees, contractors, personnel, hardware, software, applications, and third-party vendors, platforms and technologies, each of which may represent an attack surface for threat actors. Threats from malicious threat actors, including nation-state actors and ransomware groups, new vulnerabilities and advanced new attacks against our, or our vendors’, information systems and devices create risk of cybersecurity incidents, including ransomware, malware and phishing incidents, in which third parties attempt to fraudulently induce our employees or our vendors’ employees into disclosing usernames, passwords or other sensitive information, which can in turn be used for unauthorized access to our or our vendors’ systems. We, our vendors and other third parties have experienced cybersecurity incidents in the past and continue to be the target of attempted cybersecurity and other threats that could have a significant impact on our business, including threats by third parties seeking to access, misappropriate, corrupt, or manipulate our information or disrupt our operations. We expect that we, our vendors and other third parties will continue to experience an increase in cybersecurity threats in the future, both directly and indirectly through threats targeting third parties, as the volume and intensity of cyberattacks on hospitals, health systems and other health care entities continue to increase. Furthermore, because the tools and techniques used by attackers change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We, our vendors and other third parties may experience security incidents that may remain undetected for an extended period. Even if identified, we, our vendors and other third parties may be unable to adequately investigate or remediate incidents or breaches, including due to attackers increasingly using tools and techniques that are designed to circumvent controls, avoid detection and remove or obfuscate forensic evidence. State-sponsored threat actors are increasingly targeting cr…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Cybersecurity, privacy, physical security and the continued development and enhancement of our controls, processes and practices designed to protect our facilities, information systems and data from attack, damage or unauthorized access remain a priority for us. As cyber threats continue to evolve, along with their increased volume and sophistication, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any cybersecurity vulnerabilities or incidents. Although to date no cyberattack or other information or security breach, including those experienced by us in 2023, has resulted in material losses or other material consequences to us, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover our losses in excess of what we self-insure, or all types of claims that may arise. The occurrence of any of these events could result in (i) harm to patients; (ii) business interruptions and delays; (iii) the loss, misappropriation, corruption or unauthorized access of data; (iv) litigation and potential liability under privacy, security, breach notification and consumer protection laws, common law theories or other applicable laws; (v) reputational damage; and (vi) foreign, federal and state governmental inquiries, any of which could have a material, adverse effect on our financial position and results of operations and harm our business reputation.

Current wording

Cybersecurity, privacy, physical security and the continued development and enhancement of our controls, processes and practices designed to protect our facilities, information systems and data from attack, damage or unauthorized access remain a priority for us. As cyber threats continue to evolve, along with their increased volume and sophistication, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any cybersecurity vulnerabilities or incidents, and such measures may decrease the efficiency of our operations. We may also be required to expend additional resources to comply with evolving federal and state requirements related to cybersecurity and information security, including those focused on health care providers. Although, to date, no cyberattack or other information or security breach has resulted in material losses or other material consequences to us, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical cybersecurity, information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover our losses in excess of what we self-insure, or all types of claims that may arise. The occurrence of any of these events could result in (i) harm to patients; (ii) business interruptions and delays; (iii) the loss, misappropriation, corruption or unauthorized access of data; (iv) litigation and potential liability under privacy, security, breach notification and consumer protection laws, common law theories or other applicable laws; (v) reputational damage; and (vi) foreign, federal and state governmental inquiries, any of which could have a material, adverse effect on our financial position and results of operations and harm our business reputation.

Previous wording

Information systems may be vulnerable to damage from a variety of sources, including telecommunications or network failures, human acts such as inadvertent or intentional misuse by employees, natural disasters and cyberattacks, including ransomware and data theft, such as the data security incident we disclosed in July 2023. Moreover, we rely on various third-party technology platforms, which are increasingly important to our business and continue to grow in complexity and scope. Failure to adequately manage implementations of new technology, updates or enhancements of such platforms or interfaces between platforms could place us at a competitive disadvantage, disrupt our operations, and have a material, adverse impact on our business and results of operations.

Current wording

Information systems may be vulnerable to damage from a variety of sources, including telecommunications or network failures, human acts such as inadvertent or intentional misuse by employees, natural disasters and cyberattacks, including ransomware and data theft. Moreover, we rely on various third-party technology platforms, which are increasingly important to our business and continue to grow in complexity and scope. Failure to adequately and timely manage implementations of new technology, updates or enhancements of such platforms or interfaces between platforms could place us at a competitive disadvantage, disrupt our operations, and have a material, adverse impact on our business and results of operations.

Previous wording

We have taken precautionary measures to prevent unanticipated problems that could affect our information systems. Nevertheless, we or our vendors and other third parties that we rely upon may experience system failures and disruptions. The occurrence of any system failure could result in interruptions, delays, the loss or corruption of data and cessations or interruptions in the availability of systems, any of which could have a material, adverse effect on our financial position and results of operations and harm our business reputation.

Current wording

We have taken precautionary measures designed to prevent problems that could affect our information systems. Nevertheless, we or our vendors and other third parties that we rely upon may experience system failures and disruptions. The occurrence of any system failure could result in interruptions, delays, the loss or corruption of data and cessations or interruptions in the availability of systems, any of which could have a material, adverse effect on our financial position and results of operations and harm our business reputation.

Previous wording

Health care technology initiatives, particularly those related to sharing patient data and interoperability, may adversely affect our operations.

Current wording

Health care technology initiatives, particularly those related to sharing patient data and interoperability and AI, involve risks that may adversely affect our operations.

Previous wording

The federal government is working to promote the adoption of health information technology and the promotion of nationwide health information exchange to improve health care. For example, HHS incentivizes the adoption and meaningful use of certified EHR technology through its Promoting Interoperability Programs. Eligible hospitals and eligible professionals, including our hospitals and employed professionals, are subject to reduced payments from Medicare if they fail to demonstrate meaningful use of certified EHR technology. As these technologies have become widespread, the focus has shifted to increasing patient access to health care data and interoperability. The 21 st Century Cures Act and its implementing regulations promote information sharing by prohibiting information blocking by health care providers and certain other entities. Information blocking is defined as engaging in activities likely to interfere with the access, exchange or use of electronic health information, except as required by law or specified by HHS as a reasonable and necessary activity. Under a rule proposed by HHS in November 2023, a hospital found to have engaged in information blocking would not qualify as a “meaningful electronic health record user” under the Medicare Promoting Interoperability Program and as a result would lose 75% of the annual market basket increase it would otherwise receive.

Current wording

As EHR technologies have become widespread, the federal government has increased its focus on promoting patient access to health care data and interoperability. The 21st Century Cures Act and its implementing regulations prohibit information blocking by health care providers and certain other entities. Information blocking is defined as engaging in activities likely to interfere with the access, exchange or use of electronic health information, except as required by law or specified by HHS as a reasonable and necessary activity. Under a rule finalized by HHS in July 2024, a hospital found to have engaged in information blocking will not qualify as a “meaningful electronic health record user” under the Medicare Promoting Interoperability Program and as a result will lose 75% of the annual market basket increase it would otherwise receive, and MIPS-eligible clinicians, ACOs and ACO participants face similar disincentives.

Previous wording

COVID-19 has affected, and may continue to affect, our operations. In addition, the emergence and effects related to a potential future pandemic, epidemic or outbreak of an infectious disease could adversely affect our business and operations.

Current wording

The emergence and effects related to a potential future pandemic, epidemic or outbreak of an infectious disease could adversely affect our business and operations.

Previous wording

As a front-line provider of health care services, we have been and continue to be affected by the health and economic effects of COVID-19. COVID-19 continues to evolve, and we may not be able to predict or effectively respond to future developments.

Current wording

As a front-line provider of health care services, we are subject to the health and economic effects of public health conditions.

Previous wording

If another pandemic, epidemic, outbreak of an infectious disease or other public health crisis were to occur in an area in which we operate, our operations could be adversely affected. Such a crisis could diminish the public trust in health care facilities, especially hospitals that fail to accurately or timely diagnose, or are treating (or have treated) patients affected by infectious diseases. If any of our facilities are involved, or perceived as being involved, in treating patients from such an infectious disease, other patients might cancel elective procedures or fail to seek needed care at our facilities, and our reputation may be negatively affected. Patient volumes may decline or volumes of uninsured and underinsured patients may increase, depending on the economic circumstances surrounding the pandemic, epidemic or outbreak. Further, a pandemic, epidemic or outbreak might adversely affect our operations by causing a temporary shutdown or diversion of patients, causing disruption or delays in supply chains for materials and products or causing staffing shortages in our facilities. Although we have contingency plans in place, including infection control and disaster plans, the potential impact of, as well as the public’s and the government’s response to, a future pandemic, epidemic or outbreak is difficult to predict and could adversely affect our business, results of operations, financial condition and cash flows.

Current wording

If a pandemic, epidemic, outbreak of an infectious disease or other public health crisis were to occur in an area in which we operate, our operations could be adversely affected. Such a crisis could diminish the public trust in health care facilities, especially hospitals that fail to accurately or timely diagnose, or are treating (or have treated) patients affected by infectious diseases. If any of our facilities are involved, or perceived as being involved, in treating patients from such an infectious disease, other patients might cancel elective procedures or fail to seek needed care at our facilities, and our reputation may be negatively affected. Patient volumes may decline or volumes of uninsured and underinsured patients may increase, depending on the economic circumstances surrounding the pandemic, epidemic or outbreak. Further, a pandemic, epidemic or outbreak might adversely affect our operations by causing a temporary shutdown or diversion of patients, causing disruption or delays in supply chains for materials and products or causing staffing shortages in our facilities. Although we have contingency plans in place, including infection control and disaster plans, the potential impact of, as well as the public’s and the government’s response to, a future pandemic, epidemic or outbreak is difficult to predict and could adversely affect our business, results of operations, financial condition and cash flows.

Previous wording

Our business and results of operations may be adversely affected by health care reform efforts. We are unable to predict whether, what, and when additional health reform measures will be adopted or implemented, and the effects and ultimate impact of any such measures are uncertain and may adversely affect our business and results of operations.

Current wording

Our business, financial condition and results of operations may be adversely affected by changes and uncertainty in the health care industry, including health care public policy developments and other changes to laws and regulations. We are unable to predict whether, what, and when changes in the health care industry may occur, and the effects and ultimate impact of any changes are uncertain and may adversely affect our business and results of operations.

Previous wording

Changes in government health care programs may adversely affect our revenues.

Current wording

Changes in government health care programs may adversely affect our revenues and business.

Previous wording

In recent years, legislative and regulatory changes have resulted in limitations on and, in some cases, reductions in levels of payments to health care providers for certain services under the Medicare program. For example, Congress established automatic spending reductions, referred to as sequestration, under the BCA, resulting in a 2% reduction in Medicare payments that extends through the first seven months of federal fiscal year 2032. In addition, as a result of the ARPA, an additional Medicare payment reduction of up to 4% was required to take effect in January 2022; however, Congress has delayed implementation of this reduction until 2025. These reductions are in addition to reductions mandated by other laws. It is difficult to predict whether, when or what other deficit reduction initiatives may be proposed by Congress, but future legislation may include additional Medicare spending reductions.

Current wording

In recent years, legislative and regulatory changes have resulted in limitations on and, in some cases, reductions in levels of payments to health care providers for certain services under the Medicare program. For example, Congress established automatic spending reductions, referred to as sequestration, under the BCA, resulting in a 2% reduction in Medicare payments that extends through the first eight months of federal fiscal year 2032. These reductions are in addition to reductions mandated by other laws. It is difficult to predict whether, when or what other deficit reduction initiatives may be proposed by Congress, but we anticipate that efforts to address the federal budget deficit will continue to place pressures on government health care programs and that future legislation may include additional Medicare spending reductions.

Previous wording

From time to time, CMS revises the reimbursement systems used to reimburse health care providers, including changes to the inpatient hospital MS-DRG system and other payment systems, which may result in reduced Medicare payments. For example, under a site neutrality policy, clinic visit services provided by off-campus provider-based departments that were formerly paid under the outpatient PPS are now paid under the Physician Fee Schedule. Further, to address past changes to the 340B Drug Pricing Program that were invalidated by the U.S. Supreme Court, CMS finalized payment reductions under the outpatient PPS. Payment rates were reduced for non-drug services in calendar year 2023, and additional reductions to payments for non-drug item and services will take effect in calendar year 2026 and continue for approximately 16 years. As another example, CMS recently finalized changes to the Medicaid fraction of the Medicare DSH payment formula that will result in lower DSH payments for many hospitals. These payment policies and future changes to payment policies may adversely impact our results of operations, and any potential legal challenges to changes may take years to resolve. Payment policies for different types of providers and for various items and services continue to evolve. Congress and/or CMS may implement further changes to reimbursement for items or services that result in payment reductions for other items or services or that otherwise affect our business and operations.

Current wording

From time to time, CMS revises the reimbursement systems used to reimburse health care providers, including changes to the inpatient hospital MS-DRG system and other payment systems, which may result in reduced Medicare payments. For example, under a site neutrality policy, clinic visit services provided by off-campus provider-based departments are generally not covered as outpatient department services under the outpatient PPS, but instead are paid at the Physician Fee Schedule rate, which is generally substantially lower than the outpatient PPS rate. Further, to address past changes to the 340B Drug Pricing Program that were invalidated by the U.S. Supreme Court, CMS finalized payment reductions under the outpatient PPS. Payment rates were reduced for non-drug services in calendar year 2023, and additional reductions to payments for non-drug item and services will take effect in calendar year 2026 and continue for approximately 16 years. As another example, CMS recently finalized changes to the Medicaid fraction of the Medicare DSH payment formula that will result in lower DSH payments for many hospitals. These payment policies and future changes to payment policies may adversely impact our results of operations, and any potential legal challenges to changes may take years to resolve. Payment policies for different types of providers and for various items and services continue to evolve. Congress and/or CMS may implement further changes to reimbursement for items or services that result in payment reductions for other items or services or that otherwise affect our business and operations. In some cases, private third-party payers rely on all or portions of Medicare payment systems to determine payment rates. Changes to government health care programs that reduce payments under these programs may negatively impact payments from private third-party payers.

Previous wording

Because most states must operate with balanced budgets and the Medicaid program is often a state’s largest program, some states have enacted or may consider enacting legislation designed to reduce their Medicaid expenditures. Further, many states have also adopted, or are considering, legislation designed to reduce coverage, enroll Medicaid recipients in managed care programs, and/or impose additional taxes on hospitals to help finance or expand the states’ Medicaid systems. Periods of economic weakness may increase the budgetary pressures on many states, and these budgetary pressures may result in decreased spending, or decreased spending growth, for Medicaid programs and the Children’s Health Insurance Program in many states. Some states that provide Medicaid supplemental payments are reviewing these programs or have filed requests with CMS to replace these programs, and CMS has performed and continues to perform compliance reviews of some states’ programs and is considering changes to the requirements for such programs, which could result in Medicaid supplemental payments being reduced or eliminated. We may also be impacted by SDP arrangements, which allow states to direct certain Medicaid managed plan expenditures, particularly as funding may be diverted from other payment programs, and we may not satisfy applicable criteria when payments are directed to a specific subset of providers. Further, legislation and administrative actions at the federal level may impact the funding for, or structure of, the Medicaid program, and may shape the administration of the Medicaid program at the state level. Federal Medicaid policies are subject to change, including as a result of changes in the presidential administration. For example, where states had previously been permitted to condition Medicaid enrollment on work or other community engagement, the approvals of waivers permitting these conditions have been rescinded. However, a federal court is permitting Georgia to impose work and community engagement requirements under a Medicaid demonstration program that launched in mid-2023. Some members of Congress are also reexamining block grant funding structures.

Current wording

In addition, several states in which we operate face budgetary challenges that have resulted, and likely will continue to result, in reduced Medicaid funding levels to hospitals and other providers. Because most states must operate with balanced budgets and the Medicaid program is often a state’s largest program, some states have enacted or may consider enacting legislation designed to reduce their Medicaid expenditures. Many states have also adopted, or are considering, legislation designed to reduce coverage, change patient eligibility requirements, enroll Medicaid recipients in managed care programs, and/or impose additional taxes on hospitals to help finance or expand the states’ Medicaid systems. Periods of economic weakness may increase the budgetary pressures on many states, and these budgetary pressures may result in decreased spending, or decreased spending growth, for Medicaid programs and the Children’s Health Insurance Program in many states. Further, we may be impacted by developments at the federal and state levels related to Medicaid supplemental payments, which are state payments that are separate from fee-for-service base payments, and SDP arrangements, which allow states to direct certain Medicaid managed plan expenditures. Structural and other changes to these programs could result in such payments being reduced or eliminated, for example if funding for SDP arrangements is diverted from other payment programs, and if we do not satisfy applicable criteria when payments are directed to a specific subset of providers. Further, legislation and administrative actions at the federal level may impact the funding for, or structure of, the Medicaid program, and may shape the administration of the Medicaid program at the state level. Changes to the federal funding formula for Medicaid could have a particularly significant impact on coverage and reimbursement in states that expanded Medicaid under the Affordable Care Act, as states might not be able to offset decreases in federal funding for expansion populations. In addition, CMS administrators may make changes to Medicaid payment models and may grant states additional flexibility in the administration of state Medicaid programs, including by allowing states to impose eligibility restrictions such as work and community engagement requirements.

Previous wording

Current or future health care reform and deficit reduction efforts, changes in laws or regulations regarding government health care programs, other changes in the administration of government health care programs and changes by private third-party payers in response to health care reform and other changes to government health care programs could have a material, adverse effect on our financial position and results of operations.

Current wording

Current or future health care reform and deficit reduction efforts, changes or delays in laws or regulations regarding government health care programs, other changes in the administration of government health care programs and changes by private third-party payers in response to health care reform and other changes to government health care programs could have a material, adverse effect on our financial position and results of operations.

Previous wording

necessity and adequacy of medical care;

Current wording

necessity, appropriateness and adequacy of medical care;

Previous wording

qualifications of medical and support personnel;

Current wording

qualifications and supervision of medical and support personnel;

Previous wording

the confidentiality, maintenance, interoperability, exchange, data breach, identity theft and security of health-related and personal information and medical records;

Current wording

the confidentiality, maintenance, interoperability, exchange and security of health-related and personal information and medical records, including data breach, ransomware and identity theft issues;

Previous wording

the development and use of artificial intelligence and other predictive algorithms, including those used in clinical decision support tools;

Current wording

the development and use of AI and other predictive algorithms, including those used in clinical decision support tools;

Previous wording

the distribution, maintenance and dispensing of pharmaceuticals and controlled substances;

Current wording

the manufacture, distribution, maintenance and dispensing of pharmaceuticals, controlled substances and medical devices;

Previous wording

debt collection, limits or prohibitions on balance billing and billing for out of network services;

Current wording

debt collection, balance billing and billing for out of network services;

Previous wording

the addition of facilities and services; and

Current wording

addition of facilities and services; and

Previous wording

Our financial relationships with referring physicians and their immediate family members must comply with the Stark Law by meeting an exception. We attempt to structure our relationships to meet an exception to the Stark Law, but the regulations implementing the exceptions are detailed and complex and are subject to continuing legal and regulatory change. Thus, we cannot provide assurance that every relationship complies fully with the Stark Law. Unlike the Anti-kickback Statute, failure to meet an exception under the Stark Law results in a violation of the Stark Law, even if such violation is technical in nature.

Current wording

Our financial relationships with physicians who make referrals for designated health services and their immediate family members must comply with the Stark Law by meeting an exception. We attempt to structure our relationships to meet an exception to the Stark Law, but the regulations implementing the exceptions are detailed and complex. We do not always have the benefit of significant regulatory or judicial interpretations of the Stark Law and its implementing regulations. Thus, we cannot provide assurance that every relationship complies fully with the Stark Law. Unlike the Anti-kickback Statute, failure to meet an exception under the Stark Law results in a violation of the Stark Law, even if such violation is technical in nature.

Previous wording

A variety of state, national, foreign and international laws and regulations apply to the collection, use, retention, protection, security, disclosure, transfer and other processing of personal information. Various states, including California, Colorado, Connecticut, Utah and Virginia, have passed privacy laws and regulations that impose restrictive requirements on the use and disclosure of personal information, and many other state and federal privacy laws have been proposed. In many cases, these laws are more restrictive or impose more obligations than, and may not be preempted by, the HIPAA privacy and security regulations, may apply to employees and business contacts in addition to patients, and may be subject to new and varying interpretations by courts and government agencies, creating complex compliance issues and potentially exposing us to additional expense, adverse publicity and liability. The potential effects of these laws are far-reaching and may require us to modify our data processing practices and policies and to incur substantial costs and expenses in order to comply. Failure to comply with these and any other comprehensive privacy laws passed at the state or federal level may result in regulatory enforcement action and damage to our reputation. In the United Kingdom, we are subject to the UK Data Protection Legislation, which contains stricter privacy restrictions than laws and regulations in the United States and provides for significant fines in the event of violations. These administrative fines are based on a multi-factored approach. Moreover, rules for data transfers outside of the United Kingdom and European Economic Area are subject to increased regulation, and such regulations are frequently subject to further revision and updated regulator guidance, making necessary compliance measures challenging to ascertain and implement with respect to our United Kingdom operations. We expect that there will continue to be new or modified laws, regulations, regulatory guidance and industry standards concerning privacy, data protection and information security proposed and enacted in various jurisdictions, which could impact our operations and cause us to incur substantial costs.

Current wording

A variety of state, national, foreign and international laws and regulations apply to the collection, use, retention, protection, security, disclosure, transfer and other processing of personal information. Various states in which we operate have passed privacy laws and regulations that impose restrictive requirements on the use and disclosure of personal information, and many other state and federal privacy laws have been proposed. In many cases, these laws are more restrictive or impose more obligations than, and may not be preempted by, the HIPAA privacy and security regulations, may apply to employees and business contacts in addition to patients, and may be subject to new and varying interpretations by courts and government agencies. The potential effects of these laws are far-reaching and may require us to incur substantial expenses, including costs associated with modifying our data processing practices and policies. Failure to comply with these and any other comprehensive privacy laws passed at the state or federal level may result in regulatory enforcement actions, penalties and damage to our reputation. As a result of our operations in the United Kingdom, we are subject to the UK Data Protection Act, which contains stricter privacy restrictions than laws and regulations in the United States and provides for significant fines in the event of violations. These administrative fines are based on a multi-factored approach. Moreover, rules for data transfers outside of the United Kingdom and European Economic Area are subject to increased regulation, and such regulations are frequently subject to further revision and updated regulator guidance, making necessary compliance measures challenging to ascertain and implement with respect to our United Kingdom operations. We expect that there will continue to be new or modified laws, regulations, regulatory guidance and industry standards concerning privacy, data protection and information security proposed and enacted in various jurisdictions, which could impact our operations and cause us to incur substantial costs.

Previous wording

We send short message service, or SMS, text messages to patients. While we obtain consent from these individuals to send text messages, federal or state regulatory authorities or private litigants may claim that the notices and disclosures we provide, form of consents we obtain or our SMS texting practices are not adequate or violate applicable law. In addition, we must ensure that our SMS texting practices comply with regulations and agency guidance under the Telephone Consumer Protection Act (the “TCPA”), a federal statute that protects consumers from unwanted telephone calls, faxes and text messages. While we strive to adhere to strict policies and procedures that comply with the TCPA, the Federal Communications Commission, as the agency that implements and enforces the TCPA, may disagree with our interpretation of the TCPA and subject us to penalties and other consequences for noncompliance. Determination by a court or regulatory agency that our SMS texting practices violate the TCPA could subject us to civil penalties and could require us to change some portions of our business. Even an unsuccessful challenge by patients or regulatory authorities of our activities could result in adverse publicity and could require a costly response from and defense by us. Moreover, if wireless carriers or their trade associations, which issue guidelines for texting programs, determine that we have violated their guidelines, our ability to engage in texting programs may be curtailed or revoked, which could impact our operations and cause us to incur costs related to implementing a workaround solution.

Current wording

Federal Communications Commission, as the agency that implements and enforces the TCPA, may disagree with our interpretation of the TCPA and subject us to penalties and other consequences for noncompliance. Determination by a court or regulatory agency that our SMS texting practices violate the TCPA could subject us to civil penalties and could require us to change some portions of our business. Even an unsuccessful challenge by patients or regulatory authorities of our activities could result in adverse publicity and could require a costly response from and defense by us. Moreover, if wireless carriers or their trade associations, which issue guidelines for texting programs, determine that we have violated their guidelines, our ability to engage in texting programs may be curtailed or revoked, which could impact our operations and cause us to incur costs related to implementing a workaround solution.

Previous wording

Finally, we are subject to various federal, state and local statutes and ordinances regulating the discharge of materials into the environment. For example, our health care operations generate medical waste, such as pharmaceuticals, biological materials and disposable medical instruments that must be handled, stored, transported, treated and disposed of in compliance with federal, state and local environmental laws and regulations. Environmental regulations also may apply when we build new facilities or renovate existing facilities. If we are found not to be in compliance with such laws and regulations, we may be liable for significant investigation and clean-up costs or be subject to enforcement actions by governmental authorities or lawsuits by private plaintiffs. Moreover, any changes in the environmental regulatory framework (including legislative or regulatory efforts designed to address climate change) could have a material, adverse effect on our business.

Current wording

We are also subject to various international, federal, state and local statutes and ordinances regulating the discharge of materials into the environment. For example, our health care operations generate medical waste, such as pharmaceuticals, biological materials and disposable medical instruments that must be handled, stored, transported, treated and disposed of in compliance with federal, state and local environmental laws and regulations. Environmental regulations also may apply when we build new facilities or renovate existing facilities. If we are found not to be in compliance with such laws and regulations, we may be liable for significant investigation and clean-up costs or be subject to enforcement actions by governmental authorities or lawsuits by private plaintiffs. Moreover, any changes in the environmental regulatory framework (including legislative or regulatory efforts designed to address changing global weather patterns) could have a material, adverse effect on our business.

Previous wording

We also operate health care facilities in the United Kingdom and have operations and commercial relationships with companies in other foreign jurisdictions and, as a result, are subject to certain U.S. and foreign laws applicable to businesses generally, including anti-corruption and anti-bribery laws. The Foreign Corrupt Practices Act regulates U.S. companies in their dealings with foreign officials, prohibiting bribes and similar practices, and requires that they maintain records that fairly and accurately reflect transactions and appropriate internal accounting controls. In addition, the United Kingdom Bribery Act has wide jurisdiction over certain activities occurring within the United Kingdom.

Current wording

We are also subject to various federal and state antitrust laws that, for example, restrict exclusive contracting relationships with health care providers, restrict sharing of cost and pricing data, prohibit competitors from taking collective action to set commercial payer reimbursement rates and establish integration requirements for joint ventures to contract with payers. We also operate health care facilities in the United Kingdom and have operations and commercial relationships with companies in other foreign jurisdictions and, as a result, are subject to certain U.S. and foreign laws applicable to businesses generally, including anti-corruption and anti-bribery laws. The Foreign Corrupt Practices Act regulates U.S. companies in their dealings with foreign officials, prohibiting bribes and similar practices, and requires that they maintain records that fairly and accurately reflect transactions and appropriate internal accounting controls. In addition, the United Kingdom Bribery Act has wide jurisdiction over certain activities occurring within the United Kingdom.

Previous wording

If we fail to comply with these or other applicable laws and regulations, which are subject to change, we could be subject to liabilities, including civil penalties, money damages, lapses in reimbursement, the loss of our licenses to operate one or more facilities, exclusion of one or more facilities from participation in the Medicare, Medicaid and other federal and state health care programs, civil lawsuits and criminal penalties. In addition, different interpretations or enforcement of, or amendments to, these and other laws and regulations in the future could subject our current or past practices to allegations of impropriety or illegality or could require us to make changes in our facilities, equipment, personnel, services, capital expenditure programs and operating expenses. The costs of compliance with, and the other burdens imposed by, these and other laws or regulatory actions may increase our operational costs, result in interruptions or delays in the availability of systems and/or result in a patient volume decline. We may also face audits or investigations by one or more domestic or foreign government agencies relating to our compliance with these regulations. An adverse outcome under any such investigation or audit, a determination that we have violated these or other laws or a public announcement that we are being investigated for possible violations could result in liability, could result in negative publicity and could adversely affect our business, financial condition, results of operations or prospects.

Current wording

If we fail to comply with these or other applicable laws and regulations, which are subject to change, we could be subject to liabilities, including civil penalties, money damages, lapses in reimbursement, the loss of our licenses to operate one or more facilities, exclusion of one or more facilities from participation in the Medicare, Medicaid and other federal and state health care programs, civil lawsuits and criminal penalties. In addition, different interpretations or enforcement of, or amendments to, these and other laws and regulations in the future could subject our current or past practices to allegations of impropriety or illegality or could require us to make changes in our facilities, equipment, personnel, services, capital expenditure programs and operating expenses. The costs of compliance with, and the other burdens imposed by, these and other laws or regulatory actions may increase our operational costs, result in interruptions or delays in the availability of systems and/or result in a patient volume decline. We may also face audits or investigations by one or more domestic or foreign government agencies relating to our compliance with these regulations. An adverse outcome under any such investigation or audit, a determination that we have violated these or other laws or a public announcement that we are being investigated for possible violations could result in liability, could result in negative publicity and an adverse impact on our reputation and could adversely affect our business, financial condition, results of operations or prospects.

Previous wording

We are subject to tax in the United States as well as those states and foreign jurisdictions in which we do business. Changes in tax laws, including increases in tax rates, or interpretations of tax laws by taxing authorities or other standard setting bodies could increase our tax obligations and have a material, adverse impact on our results of operations.

Current wording

We are subject to tax in the United States as well as those states and foreign jurisdictions in which we do business. Changes in tax laws, including increases in tax rates, interpretations of tax laws by taxing authorities, other standard setting bodies or judicial decisions, could increase our tax obligations and have a material, adverse impact on our results of operations.

Previous wording

Government agencies and their agents, such as the MACs, fiscal intermediaries and carriers, as well as the OIG, CMS and state Medicaid programs, conduct audits of our health care operations. CMS and state Medicaid agencies contract with RACs and other contractors on a contingency fee basis to conduct post-payment reviews to detect and correct improper payments in the Medicare program, including managed Medicare plans, and the Medicaid programs. RAC denials are appealable; however, in recent years, there have been significant delays in the Medicare appeals process. Although HHS has improved efficiency and effectively eliminated a years-long backlog, we may nevertheless experience delays in appealing RAC payment denials. Private third-party payers may conduct similar post-payment audits, and we also perform internal audits and monitoring. Depending on the nature of the conduct found in such audits and whether the underlying conduct could be considered systemic, the resolution of these audits could have a material, adverse effect on our financial position, results of operations and liquidity.

Current wording

Government agencies and their agents, such as the MACs, fiscal intermediaries and carriers, as well as the OIG, CMS and state Medicaid programs, conduct audits of our health care operations. CMS and state Medicaid agencies contract with RACs and other contractors on a contingency fee basis to conduct post-payment reviews to detect and correct improper payments in the Medicare program, including managed Medicare plans, and the Medicaid programs. RAC denials are appealable. However, the RAC audit and appeals processes can impose a significant administrative burden on providers, and we may experience delays in appealing RAC payment denials. Private third-party payers may conduct similar post-payment audits, and we also perform internal audits and monitoring. Depending on the nature of the conduct found in such audits and whether the underlying conduct could be considered systemic, the resolution of these audits could have a material, adverse effect on our financial position, results of operations and liquidity.