Elevance Health, Inc.

Previous wording

In evaluating our business, the risks described below, as well as the other information contained in this Annual Report on Form 10-K, should be carefully considered. Any one or more of such risks could materially and adversely affect our business, financial condition, results of operations and stock price and could cause our actual results of operations and financial condition to vary materially from past or anticipated future results of operations and financial condition. Additional risks and uncertainties not presently known to us or that we currently believe to be immaterial may also adversely affect us.

Current wording

In evaluating our business, the risks described below, as well as the other information contained in this Annual Report on Form 10-K, should be carefully considered. Any one or more of such risks could materially and adversely affect our business, financial condition, results of operations and stock price and could cause our actual results of operations and financial condition to vary materially from past or anticipated future results of operations and financial condition. Additional risks and uncertainties not presently known to us or that we currently believe to be immaterial may also materially and adversely affect us.

Previous wording

If we fail to appropriately predict, price for and manage healthcare costs, the profitability of our products and services could decline, which could materially adversely affect our business, cash flows, financial condition and results of operations.

Current wording

If we fail to appropriately predict, price for and manage healthcare costs, the profitability of our products and services could decline, which could adversely affect our business, cash flows, financial condition and results of operations.

Previous wording

Our profitability depends on accurately predicting and pricing for healthcare costs. Profitability is also dependent on our ability to manage future healthcare costs through medical management, product design, negotiation of favorable provider contracts and underwriting criteria. Total healthcare costs are affected by the type, number and unit cost of individual services rendered. Numerous factors affecting healthcare costs may adversely affect our ability to predict and manage such costs, and may impact our business, cash flows, financial condition and results of operations. These factors include, among others: changes in healthcare practices; healthcare utilization patterns; demographic characteristics including the aging population; previously uninsured members entering the healthcare system; short and long-term risks associated with our members' lifestyle decisions; medical cost inflation; increased labor costs; provider and member fraud; evolution of new technologies, drugs and treatments; increased cost of individual services; increased number and cost of prescription drugs; direct-to-consumer marketing by drug manufacturers; clusters of high cost cases; increased use of services, including resulting from pandemics, large-scale medical emergencies, increasing natural

Current wording

Our profitability depends on our ability to appropriately predict and price for healthcare costs. It also depends on our ability to manage future healthcare costs through medical management, product design, negotiation of favorable provider contracts and underwriting criteria. Total healthcare costs are affected by the type, number and unit cost of individual services rendered. Numerous factors affecting healthcare costs may adversely affect our ability to predict and manage such costs, and could adversely impact our business, cash flows, financial condition and results of operations. These factors include, among others: changes in healthcare practices; healthcare utilization patterns; demographic characteristics including the aging population; previously uninsured members entering the healthcare system; short and long-term risks associated with our members' lifestyle decisions; medical cost inflation; increased labor costs; provider and member fraud; evolution of new technologies, drugs and treatments; increased cost of individual services; increased number and cost of prescription drugs; direct-to-consumer marketing by drug manufacturers; clusters of high cost cases; increased use of services, including resulting from pandemics, large-scale medical emergencies, natural disasters, geopolitical instability and other public health crises; and new mandated benefits and treatment guidelines and changes to other regulations impacting our business.

Previous wording

We participate in the Public Exchange in many of the states where we offer Medicaid health plans. The Public Exchange markets in general are highly volatile and unpredictable from year to year. We develop each state's Public Exchange market premium rates during the spring of each year for policies effective in the following calendar year. Legislation, regulation enforcement activity and judicial decisions that cause the Public Exchange to operate in a manner different than we projected in setting premium rates, including the potential expiration of enhanced PTCs at the end of 2025, could affect our results. In addition, any variation from our cost expectations regarding acuity, enrollment levels, adverse selection, or other assumptions utilized in setting premium rates, could have a material adverse effect on our results of operations, financial position, and cash flows.

Current wording

We participate in the Public Exchange in many of the states where we offer Medicaid health plans. The Public Exchange markets in general are highly volatile and unpredictable from year to year. We develop each state's Public Exchange market premium rates during the spring of each year for policies effective in the following calendar year. Legislation, regulation enforcement activity and judicial decisions that cause the Public Exchange to operate in a manner different than we projected in setting premium rates, including any potential changes relating to the expiration of enhanced PTCs at the end of 2025, could affect our results. In addition, any variation from our cost expectations regarding acuity, enrollment levels, adverse selection, or other assumptions utilized in setting premium rates, could have an adverse effect on our results of operations, financial position, and cash flows.

Previous wording

Pharmaceutical products and services are a significant component of our healthcare costs. Evolving regulations and state and federal mandates regarding coverage may impact the ability of our health plans to continue to receive existing price discounts on pharmaceutical products for our members. Other factors affecting our pharmaceutical costs include, but are not limited to, existing prices, geographical variation in utilization of new FDA-approved pharmaceuticals and new FDA-approved indications for existing pharmaceuticals, and changes in discounts.

Current wording

Pharmaceutical products and services are a significant component of our healthcare costs. Evolving regulations and state and federal mandates regarding coverage may impact the ability of our health plans to continue to receive existing price discounts on pharmaceutical products for our members. Other factors affecting our pharmaceutical costs include, but are not limited to, existing prices, geographical variation in utilization of new FDA-approved pharmaceuticals and new FDA-approved indications for existing pharmaceuticals, current and potential future tariffs and changes in discounts.

Previous wording

A significant reduction in the number of enrollees in our health benefits programs, pharmacy services, or diversified products and services could adversely affect our business, cash flows, financial condition and results of operations. Factors that have contributed, and may continue to contribute, to a reduction in enrollment include: reductions in workforce by existing customers; a reduction in Medicaid membership due to the end of the temporary suspension of eligibility redetermination for Medicaid recipients in response to the COVID-19 pandemic; a general economic upturn that results in fewer individuals being eligible for Medicaid programs; a general economic downturn that results in business failures and high unemployment rates; employers no longer offering certain healthcare coverage as an employee benefit or electing to offer coverage on a voluntary, employee-funded basis; participation on Public Exchanges; federal and state regulatory changes; failure to obtain new customers or retain existing customers; premium increases and benefit changes; our exit from a specific market; negative publicity and news coverage; and, failure to attain or maintain nationally recognized accreditations.

Current wording

A significant reduction in the number of enrollees in our health benefits programs, pharmacy services, or diversified products and services could adversely affect our business, cash flows, financial condition and results of operations. Factors that have contributed, and may continue to contribute, to a reduction in enrollment include: reductions in workforce by existing customers; a reduction in Medicaid membership due to the implementation of more stringent eligibility redetermination protocols by state agencies; a general economic upturn that results in fewer individuals being eligible for Medicaid programs; a general economic downturn that results in business failures and high unemployment rates; employers no longer offering certain healthcare coverage as an employee benefit or electing to offer coverage on a voluntary, employee-funded basis; participation on Public Exchanges; federal and state regulatory changes, including Medicaid community engagement requirements; changes in procurement practices or funding structures by government agencies; failure to obtain new customers or retain existing customers; premium increases and benefit changes; our exit from a specific market or health plan offering; negative publicity and news coverage; and failure to attain or maintain nationally recognized accreditations.

Previous wording

The states in which we operate with the largest concentrations of revenues include California, Virginia, New York, Ohio, Indiana, Florida, Texas and Georgia. Due to this concentration of business in these states, we are exposed to potential losses resulting from the risk of state-specific or regional economic downturns or healthcare coverage changes impacting these states. If any such negative economic conditions do not improve, we may experience a reduction in existing and new business, which could have a material adverse effect on our business, cash flows, financial condition and results of operations.

Current wording

The states in which we operate with the largest concentrations of revenues include California, New York, Virginia, Indiana, Ohio, Georgia, Florida and Texas. Due to this concentration of business in these states, we are exposed to potential losses resulting from the risk of state-specific or regional economic downturns or healthcare coverage changes impacting these states. If any such negative economic conditions fail to improve, we may experience a reduction in existing and new business, which could have an adverse effect on our business, cash flows, financial condition and results of operations.

Previous wording

A cyber-attack or other privacy or data security incident sustained by us or third parties we rely on could result in an unauthorized disclosure of sensitive or confidential information, cause a loss of data, disrupt our operations, give rise to remediation or other expenses, expose us to liability under our contracts, federal, state and international laws, and subject us to litigation and investigations, which could have an adverse effect on our business, reputation, cash flows, financial condition and results of operations.

Current wording

A cyber-attack or other privacy or data security incident sustained by us or third parties we rely on could result in an unauthorized disclosure of sensitive or confidential information, cause a loss of data, disrupt our operations, give rise to remediation or other expenses, expose us to liability under our contracts and federal, state and international laws, and subject us to litigation and investigations, which could have an adverse effect on our business, reputation, cash flows, financial condition and results of operations.

Previous wording

As part of our normal operations, we collect, store, process, retain and analyze certain sensitive and confidential information, including personal information subject to privacy, security and data breach notification requirements. Some of the data we process, store and transmit is outside of the U.S. due to the structure of our information technology systems and our internal business operations. We are subject to a variety of continuously evolving federal, state and international laws and rules regarding collection, dissemination, receipt, maintenance, protection, use, transmission, disclosure, privacy, confidentiality, security, availability, integrity, creation, processing and disposal of sensitive or confidential information that, depending on the specific business and intended data use, include without limitation, HIPAA's privacy and security rules, HIPAA's HITECH rule, the Gramm-Leach-Bliley Act, the General Data Protection Regulation and numerous state laws governing personal information, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act. Regulators are also imposing new and greater monetary fines or penalties for privacy violations, and jurisdictions where we operate have passed, and continue to propose, data privacy legislation and/or regulations related to Artificial Intelligence (“AI”). We have programs in place to detect, contain and respond to data, privacy and security incidents and provide employee awareness training regarding phishing, malware, and other risks to protect against privacy and cybersecurity incidents. Our facilities and systems, and those of our third-party service providers, including our business associates, are regularly the target of, and may be vulnerable to, cyber-attacks, security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming and/or human errors, negligent or wrongful conduct by associates or others with permitted access to our systems and information, or other threats or catastrophic events. Additionally, there have been, and may in the future be, heightened vulnerabilities due to our remote or varied geographical workforce operations.

Current wording

As part of our normal operations, we collect, process, retain and analyze certain sensitive and confidential information, including personal information subject to privacy, security and data breach notification requirements. Some of the data we process, store and transmit is outside of the U.S. due to the structure of our information technology systems and our internal business operations. We are subject to a variety of continuously evolving federal, state and international laws and rules regarding collection, dissemination, receipt, maintenance, protection, use, transmission, disclosure, privacy, confidentiality, security, availability, integrity, creation, processing and disposal of sensitive or confidential information that, depending on the specific business and intended data use, include without limitation, HIPAA's privacy and security rules, HIPAA's HITECH rule, the Gramm-Leach-Bliley Act, the General Data Protection Regulation and numerous state laws governing personal information, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act. Regulators are also imposing new and greater monetary fines or penalties for privacy violations, and jurisdictions where we operate have passed, and continue to propose, data privacy legislation and/or regulations related to Artificial Intelligence (“AI”). We have programs in place to detect, contain and respond to data, privacy and security incidents and provide employee awareness training regarding phishing, malware, and other risks to protect against privacy and cybersecurity incidents. Our facilities and systems, and those of our third-party service providers, including our business associates, are regularly the target of, and may be vulnerable to, cyber-attacks, security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming and/or human errors, negligent or wrongful conduct by associates or others with permitted access to our systems and information, or other threats or catastrophic events. Additionally, there have been, and may in the future be, heightened vulnerabilities due to our remote or varied geographical workforce operations.

Previous wording

We cannot ensure that we or our third-party service providers will be able to identify, prevent or contain the effects of cyber-attacks or other cybersecurity risks that bypass our or their security measures or disrupt our or their information technology systems or business. Hardware, software or applications we develop or procure from third parties may contain defects in design, manufacturer defects or other problems that could unexpectedly compromise information security. In addition, because the techniques used to obtain unauthorized access, disable, disrupt or degrade service or sabotage systems change frequently, are becoming increasingly sophisticated (in part due to the use of evolving technologies), and may not immediately produce signs of intrusion, we may be unable to anticipate these techniques and threats, timely discover or counter them or implement adequate preventative measures. Viruses, worms, malicious software programs or other unauthorized methods of acquiring data may be used to attack our systems or otherwise exploit any security vulnerabilities which may cause system disruptions or shutdowns, or may cause personal, proprietary or confidential information to be disclosed, misappropriated or compromised. We have business continuation and resiliency plans which are maintained, updated and tested regularly in an effort to successfully contain and remediate potential disruptions or cyber events, but there is no guarantee that such efforts will be effective. If those efforts are not effective, the functionality of our information technology systems or those of third parties could be interrupted. Cybersecurity and the continued development and enhancement of our controls, processes and practices designed to protect our systems, computers, software, data and networks from attack, damage and unauthorized access remain a priority for us.

Current wording

-25- preventative measures. Viruses, worms, malicious software programs or other unauthorized methods of acquiring data may be used to attack our systems or otherwise exploit any security vulnerabilities which may cause system disruptions or shutdowns, or may cause personal, proprietary or confidential information to be disclosed, misappropriated or compromised. We have business continuation and resiliency plans which are maintained, updated and tested regularly in an effort to successfully contain and remediate potential disruptions or cyber events, but there is no guarantee that such efforts will be effective. If those efforts are not effective, the functionality of our information technology systems or those of third parties could be interrupted. Cybersecurity and the continued development and enhancement of our controls, processes and practices designed to protect our systems, computers, software, data and networks from attack, damage and unauthorized access remain a priority for us.

Previous wording

We have been, and may in the future be, subject to litigation and governmental investigations related to cyber-attacks, privacy incidents and security breaches. Any such future litigation or governmental investigation could divert the attention of management from the operation of our business, result in reputational damage and have a material adverse impact on our business, cash flows, financial condition, and results of operations. Moreover, our programs to detect, contain, and respond to data security incidents as well as contingency plans and insurance coverage for potential liabilities of this nature may not be sufficient to cover all claims and liabilities.

Current wording

We have been, and may in the future be, subject to litigation and governmental investigations related to cyber-attacks, privacy incidents and security breaches. Any such future litigation or governmental investigation could divert the attention of management from the operation of our business, result in reputational damage and have an adverse impact on our business, cash flows, financial condition, and results of operations. Moreover, our programs to detect, contain, and respond to data security incidents as well as contingency plans and insurance coverage for potential liabilities of this nature may not be sufficient to cover all claims and liabilities.

Previous wording

Noncompliance with any privacy, security or data protection laws and regulations, or any security breach, cyber-attack or cybersecurity breach, and any incident involving the misappropriation, exfiltration, theft, loss or other unauthorized disclosure or use of, or access to, sensitive or confidential information, whether by us or by one of our third-party service providers or their vendors, previously have and could in the future require us to expend significant resources to continue to modify or enhance our protective measures and to remediate any damage. In addition, this could negatively affect our operations, cause system disruptions, damage our reputation, cause membership losses and contract breaches, expose us or our members to the risk of financial or medical

Current wording

Noncompliance with any privacy, security or data protection laws and regulations, or any security breach, cyber-attack or cybersecurity breach, and any incident involving the misappropriation, compromise, exfiltration, theft, loss or other unauthorized disclosure or use of, or access to, sensitive or confidential information, whether by us or by one of our third-party service providers or their vendors, previously have and could in the future require us to expend significant resources to continue to modify or enhance our protective measures and to remediate any damage. In addition, this could negatively affect our operations, cause system disruptions, damage our reputation, cause membership losses and contract breaches, expose us or our members to the risk of financial or medical identity theft, and result in regulatory enforcement actions, material fines and penalties, litigation or other actions that could have an adverse effect on our business, cash flows, financial condition and results of operations.

Previous wording

We use de-identified and aggregated data to create analytic models designed to predict, and potentially improve, outcomes and patient care. The collection, maintenance, protection, use, transmission, disclosure and disposal of sensitive personal information is regulated at the federal, state, international and industry levels and requirements are also imposed on us and vendors through contracts with clients. We are also subject to various other consumer protection laws that regulate our communications with customers. Certain of our businesses are also subject to the Payment Card Industry Data Security Standard, which is designed to protect credit card account data as mandated by payment card industry entities. In addition, more jurisdictions are regulating the collection, use and transfer of data across borders. These laws, rules, regulations and contractual requirements are subject to change, and the regulatory environment surrounding data protection and privacy is becoming more onerous. Compliance with existing or new privacy, security, technology or data protection laws, regulations and requirements may result in increased enforcement and costs, and may constrain or require us to alter our business model or operations.

Current wording

The collection, maintenance, protection, use, transmission, disclosure and disposal of sensitive personal information is regulated at the federal, state, international and industry levels and requirements are also imposed on us and vendors through contracts with clients. We are also subject to various other consumer protection laws that regulate our communications with customers. Certain of our businesses are also subject to the Payment Card Industry Data Security Standard, which is designed to protect credit card account data as mandated by payment card industry entities. In addition, more jurisdictions are regulating the collection, use and transfer of data across borders. We use de-identified and aggregated data, and sell such data to third-parties, to create analytic models designed to predict, and potentially improve, outcomes and patient care. These laws, rules, regulations and contractual requirements are subject to change, and the regulatory environment surrounding data protection and privacy is becoming more onerous. Compliance with existing or new privacy, security, technology or data protection laws, regulations and requirements may result in increased enforcement and costs, and may constrain or require us to alter our business model or operations.

Previous wording

We contract with various federal and state agencies, including CMS, to provide managed health benefits services, such as Medicare Advantage, Medicare Part D, Medicare Supplement, Medicaid, TANF, SPD, LTSS, CHIP, Medicaid expansion programs and various specialty programs, products and services. We also provide various administrative services for other entities offering medical and/or prescription drug plans to their Medicaid or Medicare eligible members, and we offer employer group waiver plans which provide medical and/or prescription drug coverage to retirees. We also participate in programs in several states for the care of dual-eligible members. Changes in existing laws or regulations applicable to these programs, or their interpretations, are difficult to predict and could have a material adverse effect on our business, cash flows, financial condition and results of operations.

Current wording

We contract with various federal and state agencies, including CMS, to provide managed health benefits services, such as Medicare Advantage, Medicare Part D, Medicare Supplement, Medicaid, TANF, SPD, LTSS, CHIP, Medicaid expansion programs and various specialty programs, products and services. We also provide various administrative services for other entities offering medical and/or prescription drug plans to their Medicaid or Medicare eligible members, and we offer employer group waiver plans which provide medical and/or prescription drug coverage to retirees. We also participate in programs in several states for the care of dual-eligible members. Changes in existing laws or regulations applicable to these programs, or their interpretations, are difficult to predict and could have an adverse effect on our business, cash flows, financial condition and results of operations.

Previous wording

Revenues from the Medicare and Medicaid programs are determined, in whole or in part, by the federal government and/or applicable state governments, and base premium rates paid by each state or federal agency differ depending upon a combination of factors such as defined upper payment limits, a member’s health status, age, gender, county or region, benefit mix, member eligibility category and risk scores. Rates may be affected by federal and state budgetary constraints. Certain state contracts are subject to cancellation in the event of the unavailability of state funds. Additionally, ongoing CMS changes to the calculation of risk in the Medicare Advantage program may impact our revenue. For example, CMS made significant changes to the structure of the hierarchical condition category model in version 28, which may impact risk adjustment factor (“RAF”) scores for a larger percentage of Medicare Advantage beneficiaries and could result in changes to beneficiary RAF scores with or without a change in the patient’s health status. The federal government or any state in which we operate could decrease rates paid to us, pay us less than the amount necessary to keep pace with our cost trends, cancel our contracts retroactively or seek an adjustment to previously negotiated rates. In addition, various states’ Medicare-Medicaid dual-eligible plans are still subject to uncertainty surrounding payment rates and other requirements, which could affect where we seek to participate in these programs. For example, CMS will require in future years that health plans offering certain dual-eligible products must also align with integrated Medicaid products in the same service area. Some states are also requiring companies to offer Medicaid within a state and are conducting competitive bid processes to qualify to offer dual-eligible products. An unexpected reduction in payments, inadequate government funding or significantly delayed payments for these programs may adversely affect our business, cash flows, financial condition and results of operations.

Current wording

-26- eligibility category and risk scores. Rates may be affected by federal and state budgetary constraints. Certain state contracts are subject to cancellation in the event of the unavailability of state funds. Additionally, ongoing CMS changes to the calculation of risk in the Medicare Advantage program may impact our revenue. For example, CMS made significant changes to the structure of the hierarchical condition category model in version 28, which impacted risk adjustment factor (“RAF”) scores for a larger percentage of Medicare Advantage beneficiaries and resulted in changes to beneficiary RAF scores regardless of a change in the patient’s health status. The federal government or any state in which we operate could decrease rates paid to us, pay us less than the amount necessary to keep pace with our cost trends, cancel our contracts retroactively or seek an adjustment to previously negotiated rates. In addition, various states’ Medicare-Medicaid dual-eligible plans are still subject to uncertainty surrounding payment rates and other requirements, which could affect where we seek to participate in these programs. For example, CMS will require in future years that health plans offering certain dual-eligible products must also align with integrated Medicaid products in the same service area. Some states are also requiring companies to offer Medicaid within a state and are conducting competitive bid processes to qualify to offer dual-eligible products. An unexpected reduction in payments, inadequate government funding or significantly delayed payments for these programs may adversely affect our business, cash flows, financial condition and results of operations.

Previous wording

Other potential risks associated with Medicare Advantage and Medicare Part D plans include increased medical or pharmaceutical costs, data corrections identified as a result of ongoing auditing and monitoring activities, potential uncollectability of receivables resulting from processing and/or verifying enrollment, inadequacy of underwriting assumptions, inability to receive and process correct information (including inability due to systems issues by the federal government, the applicable state government or us), uncollectability of premiums from members and limited enrollment periods. Actual results may be materially

Current wording

Other potential risks associated with Medicare Advantage and Medicare Part D plans include increased medical or pharmaceutical costs, data corrections identified as a result of ongoing auditing and monitoring activities, potential uncollectability of receivables resulting from processing and/or verifying enrollment, inadequacy of underwriting assumptions, inability to receive and process correct information (including inability due to systems issues by the federal government, the applicable state government or us), uncollectability of premiums from members and limited enrollment periods. Actual results may be materially different than our assumptions and estimates and could have an adverse effect on our business, financial condition and results of operations.

Previous wording

Our contracts with CMS and state governmental agencies contain certain provisions regarding data submission, risk adjustment, provider network and directory maintenance, quality measures, claims payment, timely and accurate processing of appeals and grievances, oversight of service providers, encounter data, continuity of care, call center performance and other requirements specific to federal and state program regulations. We have been subject in the past, and may again be in the future, to administrative actions, fines, penalties, liquidated damages or retrospective adjustments in payments made to our health plans as a result of a failure to comply with these requirements, which has impacted, and in the future could impact, our profitability. We have experienced retroactive rate adjustments by certain state Medicaid agencies in the past, and such rate adjustments may occur in the future. Further, our state Medicaid contracts have not always been renewed, we have not always been awarded new contracts as a result of the competitive procurement process, and in some cases, we have lost members under existing contracts as a result of a post-award challenge by unsuccessful bidders, each of which could take place in the future and have a material adverse effect on our business, cash flows, financial condition and results of operations.

Current wording

Our contracts with CMS and state governmental agencies contain certain provisions regarding data submission, risk adjustment, provider network and directory maintenance, quality measures, claims payment, timely and accurate processing of appeals and grievances, oversight of service providers, encounter data, continuity of care, call center performance and other requirements specific to federal and state program regulations. We have been subject in the past, and may again be in the future, to administrative actions, fines, penalties, liquidated damages or retrospective adjustments in payments made to our health plans as a result of a failure to comply with these requirements, which has impacted, and in the future could impact, our profitability. We have experienced retroactive rate adjustments by certain state Medicaid agencies in the past, and such rate adjustments may occur in the future. Further, our state Medicaid contracts have not always been renewed, we have not always been awarded new contracts as a result of the competitive procurement process, and in some cases, we have lost members under existing contracts as a result of a post-award challenge by unsuccessful bidders, each of which could take place in the future and have an adverse effect on our business, cash flows, financial condition and results of operations.

Previous wording

The Star Rating System utilized by CMS to evaluate Medicare Advantage Plans may have a significant effect on our revenue, as higher-rated plans tend to experience increased enrollment, plans with a Star Rating of 4.0 or higher are eligible for quality-based bonus payments and plans with a Star Rating of 5.0 can market to and enroll members year-round. CMS continues to change its rating system to make achieving and maintaining a 4.0 or higher Star Rating more difficult. CMS released our 2025 Star Ratings in October 2024, which will be used to determine our Medicare Advantage plans' quality bonus payments in 2026. Based on our membership at September 1, 2024, 38% of our Medicare Advantage members were in plans with 2025 Star Ratings of at least 4.0 Stars, compared to 53% of our Medicare Advantage members being in plans with 2024 Star Ratings of at least 4.0 Stars (based on our 2024 Star Ratings, as recalculated by CMS). This change in our 2025 Star Ratings is expected to negatively impact our Medicare quality bonus payments, plan level rebates and operating revenue beginning in 2026, and our enrollment may be negatively impacted as consumers seek higher rated plans. Further, if we do not improve our Star Ratings, or if quality-based bonus payments are reduced or eliminated, we will experience further negative impact on our revenues and the benefits that our plans can offer, which could materially and adversely affect the marketability of our plans, our ability to expand our business, our membership levels, results of operations, financial condition and cash flows. Similarly, if we fail to meet or exceed any performance standards imposed by state Medicaid programs in which we participate, we may not receive performance-based bonus payments or may incur penalties.

Current wording

The Star Rating System utilized by CMS to evaluate Medicare Advantage Plans may have a significant effect on our revenue, as higher-rated plans tend to experience increased enrollment, plans with a Star Rating of 4.0 or higher are eligible for quality-based bonus payments and plans with a Star Rating of 5.0 can market to and enroll members year-round. CMS has made, and continues to make, changes to its Star Rating program that have impacted, and continue to impact, the ability of plans to achieve Star Ratings of 4.0 or higher. CMS released our 2026 Star Ratings in October 2025, which will be used to determine our Medicare Advantage plans' quality bonus payments in 2027. Our 2026 Star Ratings reflect that approximately 59% of our Medicare Advantage members are enrolled in plans rated at least 4.0 stars or higher, or the equivalent, compared to approximately 40% of our Medicare Advantage members being in plans with 2025 Star Ratings of at least 4.0 stars. Uncertainties with respect to future changes to the Star Rating System, which are not determined until after the relevant measurement period, continue to make accurate predictions of each Medicare Advantage plan’s Star Ratings more challenging. If we do not maintain our Star Ratings in future years, or if quality-based bonus payments are reduced or eliminated, we would likely experience a negative impact on our revenues and the benefits that our plans can offer, which could adversely affect the marketability of our plans, our ability to expand our business, our membership levels, and our results of operations, financial condition and cash flows. Similarly, if we fail to meet or exceed any performance standards imposed by state Medicaid programs in which we participate, we may not receive performance-based bonus payments or may incur penalties.

Previous wording

We are periodically subject to government audits, including CMS RADV audits of our Medicare Advantage Plans to validate diagnostic data, patient claims and financial reporting, and audits of our Medicare Part D plans by the Medicare Part D Recovery Audit Contractor (“RAC”), as well as state Medicaid RAC programs. Certain of our contracts currently have pending RADV audits by CMS and the HHS Office of Inspector General that are awaiting CMS finalization. In addition, we routinely perform ordinary course reviews of, among other things, our Medicare Advantage data submitted to CMS. These governmental audits, or changes in how these audits are conducted, including changes that may result from the final RADV Audit rule that was issued in 2023, and our internal reviews, have, and could in the future, result in reports or disclosures for prior, current or future filing years to federal or state regulatory agencies, submission of data corrections, and/or significant adjustments in payments made to our health plans and future Medicare Advantage bids, which could adversely affect our financial condition and results of operations. Governmental regulators and agencies continue to heighten their scrutiny of business and reporting practices within the health services industry with respect to risk adjustment and claims payment. Additionally, state regulators are increasingly conducting audits to assess the quality of services we provide to our Medicare members. If we fail to report and correct errors discovered through our own auditing procedures, during a RADV or RAC audit or during state regulatory audits, or otherwise fail to comply with applicable laws and regulations, we could be subject to fines, civil penalties or other sanctions, which could have a material adverse effect on our ability to participate in these programs, and on our financial condition, cash flows and results of operations. In addition, price transparency initiatives, such as the Health Plan Transparency Rule, may impact our ability to obtain or maintain favorable contract terms. For example, hospitals are required to publish online payer-specific negotiated charges for each item or service the hospital provides.

Current wording

-27- by CMS and the HHS Office of Inspector General that are awaiting CMS finalization. In addition, we routinely perform ordinary course reviews of, among other things, our Medicare Advantage data submitted to CMS. These governmental audits, or changes in how these audits are conducted, including changes that may result from the final RADV Audit rule that was issued in 2023, and our internal reviews, have resulted, and could in the future result, in reports or disclosures for prior, current or future filing years to federal or state regulatory agencies, submission of data corrections, and/or significant adjustments in payments made to our health plans and future Medicare Advantage bids, which could adversely affect our financial condition and results of operations. Governmental regulators and agencies continue to heighten their scrutiny of business and reporting practices within the health services industry with respect to risk adjustment and claims payment. Additionally, state regulators are increasingly conducting audits to assess the quality of services we provide to our Medicare members. If we fail to report and correct errors discovered through our own auditing procedures, during a RADV or RAC audit or during state regulatory audits, or otherwise fail to comply with applicable laws and regulations, we could be subject to fines, civil penalties or other sanctions, which could have an adverse effect on our ability to participate in these programs, and on our financial condition, cash flows and results of operations. In addition, price transparency initiatives, such as the Health Plan Transparency in Coverage Rule, may impact our ability to obtain or maintain favorable contract terms. For example, hospitals are required to publish online payer-specific negotiated charges for each item or service the hospital provides.

Previous wording

Our Medicare and Medicaid contracts are also subject to various MLR rules, including minimum MLR thresholds, rebate requirements and audits, which could adversely affect our membership and revenues if any of our state Medicare or Medicaid plans do not meet an applicable minimum MLR threshold. If a Medicare Advantage, MMP or Medicare Part D contract pays minimum

Current wording

Our Medicare and Medicaid contracts are also subject to various MLR rules, including minimum MLR thresholds, rebate requirements and audits, which could adversely affect our membership and revenues if any of our state Medicare or Medicaid plans do not meet an applicable minimum MLR threshold. If a Medicare Advantage, MMP or Medicare Part D contract pays minimum MLR rebates for three consecutive years, it will become ineligible to enroll new members. If a Medicare Advantage or Medicare Part D contract pays such rebates for five consecutive years, it will be terminated by CMS.

Previous wording

Our healthcare products that involve greater potential risk generally tend to be more profitable than administrative services products and those healthcare products where the employer groups assume the underwriting risks. Individuals and small employer groups are more likely to purchase our higher-risk healthcare products because such purchasers are generally unable or unwilling to bear greater liability for healthcare expenditures. Typically, government-sponsored programs also involve our higher-risk healthcare products. A shift of enrollees from more profitable products to less profitable products could have a material adverse effect on our cash flows, financial condition and results of operations.

Current wording

Our healthcare products that involve greater potential risk generally tend to be more profitable than administrative services products and those healthcare products where the employer groups assume the underwriting risks. Individuals and small employer groups are more likely to purchase our higher-risk healthcare products because such purchasers are generally unable or unwilling to bear greater liability for healthcare expenditures. Typically, government-sponsored programs also involve our higher-risk healthcare products. A shift of enrollees from more profitable products to less profitable products could have an adverse effect on our cash flows, financial condition and results of operations.

Previous wording

Our inability to contract with providers, providers attempting to use their market position to negotiate more favorable contracts or place us at a competitive disadvantage, the departure of prominent network providers or provider groups to competitors, or the inability of providers to provide adequate care could adversely affect our business. In addition, we do not have contracts with all providers that render services to our members and, as a result, may not have a pre-established agreement about the amount of compensation those out-of-network providers will accept for the services they render. State and federal laws, such as the No Surprises Act, define the compensation that must be paid to out-of-network providers in certain scenarios, and related litigation has lessened the weight of the Qualifying Payment Amount during independent dispute resolution processes, which may result in an increase in rates we must pay to out-of-network providers. Both our lack of contracts with certain providers and the development of new federal and state laws could result in significant litigation or arbitration proceedings, to the extent a provider attempts to obtain payment from our members for the difference between the amount we have paid and the amount they have charged, or other increases in rates paid to out-of-network providers.

Current wording

Our inability to contract with providers, providers attempting to use their market position to negotiate more favorable contracts or place us at a competitive disadvantage, the departure of prominent network providers or provider groups to competitors, or the inability of providers to provide adequate care could adversely affect our business. In addition, we do not have contracts with all providers that render services to our members and, as a result, may not have a pre-established agreement about the amount of compensation those out-of-network providers will accept for the services they render. State and federal laws, such as the No Surprises Act, define the compensation that must be paid to out-of-network providers in certain scenarios, and related litigation has lessened the weight of the Qualifying Payment Amount during independent dispute resolution processes, which may result in an increase in rates we must pay to out-of-network providers. Further ongoing regulatory developments or judicial interpretations may continue to shift payment responsibilities or calculation methodologies in ways that increase our costs. Both our lack of contracts with certain providers and the development of new federal and state laws could result in significant litigation or arbitration proceedings, including instances in which a provider attempts to obtain payment from our members for the difference between the amount we have paid and the amount they have charged, or other increases in rates paid to out-of-network providers.

Previous wording

Our pharmacy services business would be adversely affected if we are unable to contract on favorable terms with third-party vendors, including pharmaceutical manufacturers. We delegate certain pharmacy benefit manager services, including, but not limited to, claims adjudication, pharmacy network administration, rebate administration, advanced home delivery back-end dispensing, and customer service, to CVS pursuant to the CVS Agreement. If CVS fails to provide pharmacy benefit manager services as contractually required, we may not be able to meet the full demands of our customers, which could have a material adverse effect on our business, reputation and results of operations. Additionally, we may not maintain favorable terms and conditions, including financial terms, to compete in the market. For additional information on the CVS Agreement, see “Business - Product and Service Descriptions,” in Part I, Item 1 of this Annual Report on Form 10-K.

Current wording

Our pharmacy services business would be adversely affected if we are unable to contract on favorable terms with third-party vendors, including pharmaceutical manufacturers. We delegate certain pharmacy benefit manager services, including, but not limited to, claims adjudication, pharmacy network administration, rebate administration, and advanced home delivery back-end dispensing to CVS pursuant to the CVS Agreement. If CVS fails to provide pharmacy benefit manager services as contractually required, we may not be able to meet the full demands of our customers, which could have an adverse effect on our business, reputation and results of operations. Additionally, we may not maintain favorable terms and conditions, including financial terms, to compete in the market. For additional information on the CVS Agreement, see “Business - Product and Service Descriptions,” in Part I, Item 1 of this Annual Report on Form 10-K.

Previous wording

Our business depends significantly on effective information systems, and we have many different information systems for our various businesses, including those that we have acquired as a result of our merger and acquisition activities. Our information systems require an ongoing investment, commitment of significant resources to maintain, integrate, upgrade, enhance and expand existing systems, and development of new systems to keep pace with continuing changes in information processing technology, emerging cybersecurity risks, changing customer preferences, evolving industry and regulatory standards and legal requirements, including as a result of the ACA, the Health Plan Transparency Rule, the 2021 Appropriations Act and federal data interoperability regulations. In addition, we may obtain significant portions of our systems-related or other services from independent third parties (and their vendors), which may make our operations vulnerable if such third parties fail to perform and oversee adequately. Further, unauthorized third parties present additional risk, including by propagating misinformation related to products, business and the health industry.

Current wording

Our business depends significantly on effective information systems, and we have many different information systems for our various businesses, including those that we have acquired as a result of our merger and acquisition activities. Our information systems require an ongoing investment, commitment of significant resources to maintain, integrate, upgrade, enhance and expand existing systems, and development of new systems, including systems powered by or incorporating AI and machine learning (including generative AI), to keep pace with continuing changes in information processing technology, emerging cybersecurity risks, changing customer preferences, evolving industry and regulatory standards and legal requirements, including as a result of the ACA, the Health Plan Transparency Rule, the 2021 Appropriations Act and federal data interoperability regulations. In addition, we may obtain significant portions of our systems-related or other services from independent third parties (and their vendors), which may make our operations vulnerable if such third parties fail to perform and oversee adequately. Further, unauthorized third parties present additional risk, including by propagating misinformation related to products, business and the health industry.

Previous wording

Failure to adequately implement, consolidate, integrate, streamline, maintain and upgrade effective and efficient information systems, including those powered by or incorporating AI, with sufficiently advanced technological capabilities could result in investigations, audits, fines and penalties, competitive and cost disadvantages to us compared to our competitors, contractual damages, and diversion of management’s time, and could have a material adverse effect on our business, financial condition and results of operations. Failure or disruption of our performance of, or our ability to perform, key business functions, including as a result of the unavailability or cyber-attack of our information technology systems or those of third parties (including cloud service providers), could decrease response times, lower levels of service satisfaction and harm our reputation and brand. Our systems interface with and depend on third-party systems, hardware, infrastructure and cloud technologies, and we could experience service denials if demand for such service exceeds capacity, or these systems fail or experience interruption. From time to time, we update, transition, acquire, or expand use of our and third-party information technology systems, which may result in heightened vulnerability. Some third-party systems that are necessary for the operation of our business processes are maintained outside of our control but would impact our business operations if compromised as a result of a cyber-attack. Despite our adoption and continued enhancement of business continuity and disaster recovery strategies, there is no guarantee that such efforts will be effective, which could interrupt the functionality of our information technology systems or those of third parties. Our failure to implement adequate business continuity and disaster recovery strategies could significantly reduce our ability to provide products and services to our customers and members, which could have a material adverse effect on our business and results of operations.

Current wording

Failure to adequately implement, consolidate, integrate, streamline, maintain and upgrade effective and efficient information systems, including those powered by or incorporating AI, with sufficiently advanced technological capabilities could result in investigations, audits, fines and penalties, competitive and cost disadvantages to us compared to our competitors, contractual damages, and diversion of management’s time, and could have an adverse effect on our business, financial condition and results of operations. Failure or disruption of our performance of, or our ability to perform, key business functions, including as a result of the unavailability of, or cyber-attack on, our information technology systems or those of third parties (including cloud service providers), could decrease response times, lower levels of service satisfaction and harm our reputation and brand. Our systems interface with and depend on third-party systems, hardware, infrastructure and cloud technologies, and we could experience service denials if demand for such service exceeds capacity, or these systems fail or experience interruption. From time to time, we update, transition, acquire, or expand use of our and third-party information technology systems, which may result in heightened vulnerability. Some third-party systems that are necessary for the operation of our business processes are maintained outside of our control but would impact our business operations if compromised as a result of a cyber-attack. Despite our adoption and continued enhancement of business continuity and disaster recovery strategies, there is no guarantee that such efforts will be effective, which could interrupt the functionality of our information technology systems or those of third parties. Our failure to implement adequate business continuity and disaster recovery strategies could significantly reduce our ability to provide products and services to our customers and members, which could have an adverse effect on our business and results of operations.

Previous wording

In addition, connectivity amongst technologies is becoming increasingly important, with recent trends bringing greater consumer engagement in healthcare; therefore, the pace at which our customers will need enhanced technologies with sophisticated applications for mobile interfaces, including tools and products that leverage AI to improve the customer experience, will quicken. We anticipate that fast-evolving AI technologies will play an increasingly significant role in our information systems and technology products. If the information systems we rely upon to run our business were found to be inaccurate or unreliable or if we fail to adequately maintain, upgrade, enhance, expand and protect our information systems, security controls and data integrity effectively, we could experience problems in determining medical cost estimates and establishing appropriate pricing and reserves, have disputes with customers and providers, lengthen the pace of integration activities or otherwise delay the launch of acquired products, face regulatory problems, including sanctions and penalties, incur increases in operating expenses or suffer other adverse consequences, including a decrease in membership.

Current wording

In addition, connectivity amongst technologies is becoming increasingly important, with recent trends bringing greater consumer engagement in healthcare; therefore, the pace at which our customers will need enhanced technologies with sophisticated applications for mobile interfaces, including tools and products that leverage AI to improve the customer experience, will quicken. We anticipate that fast-evolving AI technologies will play an increasingly significant role in our information systems and technology products. If the information systems we rely upon to run our business were found to be inaccurate or unreliable or if we fail to adequately maintain, upgrade, enhance, expand and protect our information systems, security controls and data integrity

Previous wording

As part of our operations, we are making investments in certain AI administrative tools and solutions to enhance our operations and positively impact the experience of our members, and we continue to explore further innovation using AI. The rapid advancement of these technologies presents opportunities for us, but there are risks associated with the development and deployment of AI, and there can be no assurance that our usage of AI will enhance our operations. We have developed and implemented policies and procedures intended to promote and sustain responsible design, development, and use of AI. Our AI-related efforts may give rise to risks related to accuracy, harmful bias, discrimination, intellectual property infringement, data privacy, and cybersecurity, among others. In addition, we may be subject to new or enhanced governmental or regulatory scrutiny, litigation or other liability and ethical concerns, and negative consumer perceptions as to the use of automation and AI, or other complications that could adversely affect our business, reputation, or financial results. Any inadequacy in or failure to comply with our responsible use of AI policies and procedures or emerging laws, regulations and standards governing AI use could cause our technology not to operate as intended or to produce outcomes that could have a material and adverse effect on our business, reputation, results of operations, financial position and cash flows.

Current wording

As part of our operations, we are making investments in certain AI tools and solutions to enhance our operations and positively impact the experience of our members, and we continue to explore further innovation using AI. The rapid advancement of these technologies presents opportunities for us, but there are risks associated with the development and deployment of AI. We have developed and implemented policies and procedures intended to promote and sustain responsible design, development and use of AI. Our AI-related efforts may give rise to risks related to accuracy, harmful bias, discrimination, intellectual property infringement, data privacy, and cybersecurity, among others. In addition, we may be subject to new or enhanced governmental or regulatory scrutiny, litigation or other liability and ethical concerns, and negative consumer perceptions as to the use of automation and AI, or other complications that could adversely affect our business, reputation, or financial results. Any inadequacy in or failure to comply with our responsible use of AI policies and procedures or emerging laws, regulations and standards governing AI use could cause our technology not to operate as intended or to produce outcomes that could have an adverse effect on our business, reputation, results of operations, financial position and cash flows.

Previous wording

We are subject to risks associated with pandemics, like the COVID-19 pandemic, as well as other extreme events, large-scale medical emergencies and public health crises, which could have a material adverse effect on our business, results of operations, and financial condition and financial performance.

Current wording

We are subject to risks associated with pandemics, like the COVID-19 pandemic, as well as other extreme events, large-scale medical emergencies and public health crises, which could have an adverse effect on our business, results of operations, and financial condition and financial performance.

Previous wording

A pandemic or other large-scale medical emergency or public health crisis, such as the COVID-19 pandemic, referred to collectively as “public health crises,” may cause illness, death, quarantines, business and school shutdowns, reductions in business activity, travel and financial transactions, unemployment, inflation, labor shortages, supply chain interruptions, disruptions in public and private infrastructure and overall economic and financial market instability. The following are some risks that we could experience as a result of future public health crises, all of which could increase our costs, impair our ability to provide services, and have a material adverse effect on our business, cash flows, financial condition and results of operations:

Current wording

A pandemic or other large-scale medical emergency or public health crisis, such as the COVID-19 pandemic, referred to collectively as “public health crises,” may cause illness, death, quarantines, reduced operations or shutdowns of businesses and schools, unemployment, inflation, labor shortages, supply chain interruptions, disruptions in public and private infrastructure and overall economic and financial market instability. The following are some risks that we could experience as a result of future public health crises, all of which could increase our costs, impair our ability to provide services, and have an adverse effect on our business, cash flows, financial condition and results of operations:

Previous wording

If any future public health crisis occurs and continues for a prolonged period, these risks could be exacerbated and cause further impact to our business and operations. Additionally, other extreme events such as natural disasters, war, terrorism, increased crime, civil unrest and sanctions could create public health crises, operations disruptions or otherwise have a material adverse effect on our business, cash flows, financial condition and results of operations. In the event of a public health crisis, we may need to make temporary policy changes, such as waiving various medical requirements, assisting with replacement medications, transferring prescriptions and expanding our help line. Natural disasters or extreme weather events, such as wildfires, floods, hurricanes, tropical storms, and snow and ice storms, have impacted, and may in the future impact, our customers, associates, facilities and third-party vendors located in the affected area. Furthermore, climate change could result in certain types of natural disasters occurring more frequently or with more intense effects, which could have a long-term impact on general economic conditions and the health benefits and pharmacy services industries in particular.

Current wording

If any future public health crisis occurs and continues for a prolonged period, these risks could be exacerbated and cause further impact to our business and operations. Additionally, other extreme events such as natural disasters, war, terrorism, increased crime, civil unrest and sanctions could create public health crises, operations disruptions or otherwise have an adverse effect on our business, cash flows, financial condition and results of operations. In the event of a public health crisis, we may need to make temporary policy changes, such as waiving various medical requirements, assisting with replacement medications, transferring prescriptions and expanding our help line. Natural disasters or extreme weather events, such as wildfires, floods, hurricanes, tropical storms, and snow and ice storms, have impacted, and may in the future impact, our customers, associates, facilities and third-party vendors located in the affected area. Furthermore, climate change could result in certain types of natural disasters occurring more frequently or with more intense effects, which could have a long-term impact on general economic conditions and the health benefits and pharmacy services industries in particular.

Previous wording

We are subject to significant state and federal regulation associated with many aspects of our business, including, but not limited to, licensing, premiums, marketing activities, provider contracting, access and payment standards, and corporate governance and financial reporting matters, as described in greater detail in Part I, Item 1, “Business - Regulation” in this Annual Report on Form 10-K. Further, the integration into our business of entities that we acquire, or our expansion into new businesses or jurisdictions, may increase our regulatory risk and affect the way in which existing laws and rules apply to us.

Current wording

We are subject to significant state and federal regulation across many aspects of our business, including, but not limited to, licensing, premiums, marketing activities, provider contracting, access and payment standards, and corporate governance and financial reporting matters, as described in greater detail in Part I, Item 1, “Business - Regulation” in this Annual Report on Form 10-K. Further, the integration into our business of entities that we acquire, or our expansion into new businesses or jurisdictions, may increase our regulatory risk and affect how existing laws and rules apply to us.

Previous wording

Frequent and sometimes unpredictable changes to existing laws, rules and regulations or judicial interpretation, application or enforcement thereof, or development of new laws, rules, regulatory interpretations or judgments could force us to change how we conduct our business, affect the products and services we offer (and where we offer them), restrict revenue and enrollment growth, increase our costs, including operating, healthcare technology and administrative costs, restrict our ability to obtain new product approvals and implement changes in premium rates, and require enhancements to our compliance infrastructure and internal controls environment, which could adversely impact our business and results of operations. In addition, legislative and/or regulatory policies or proposals that seek to manage the healthcare industry or otherwise impact our business may cause the market price of our securities to decrease, even if such policies or proposals never become effective. In particular, further regulations and modifications to the ACA and laws and regulations stemming from the ACA could impact the market for our products, funding for ACA programs, the regulations applicable to us and the fees and taxes payable by us and otherwise affect our business and future operations, some of which may adversely affect our financial condition and results of operations.

Current wording

Frequent and sometimes unpredictable changes to existing laws, rules and regulations or judicial interpretation, application or enforcement thereof, or development of new laws, rules, regulatory interpretations or judgments could force us to change how we conduct our business, affect the products and services we offer (and where we offer them), restrict revenue and enrollment growth, increase our costs, including operating, healthcare technology and administrative costs, restrict our ability to obtain new product approvals, modify existing products, and implement changes in premium rates, and require enhancements to our compliance infrastructure and internal controls environment. Any of these developments could adversely impact our business and results of operations. In addition, legislative and/or regulatory policies or proposals that seek to manage the healthcare industry or otherwise impact our business may cause the market price of our securities to decrease, even if such policies or proposals never become effective. In particular, further regulations and modifications to the ACA and laws and regulations stemming from the ACA could impact the market for our products, funding for ACA programs, the regulations applicable to us, the methodologies used to determine our reimbursement, and the fees and taxes payable by us and otherwise affect our business and future operations, any of which may adversely affect our financial condition and results of operations.

Previous wording

We expect state legislatures will continue to focus on healthcare delivery and financing issues, including actions to reduce or limit increases to premium payments, provider billing protections, access to care and other reforms of state health insurance markets. State ballot initiatives could also be put to voters that could materially impact our operating environment. If enacted into law, these state proposals and actions could have a material adverse impact on our business, cash flows, operations or financial condition. Additionally, state legislative actions and litigation could impact ERISA pre-emption. Further, in the past, Congress has considered, and may consider in the future, various forms of managed care reform legislation which, if adopted, could fundamentally alter the treatment of coverage decisions under ERISA, including limiting ERISA’s preemptive effect on state laws, and other laws and could increase our costs, expose us to expanded liability, permit greater state regulation on our operations, or require us to revise the ways in which we conduct business.

Current wording

We expect state legislatures will continue to focus on healthcare delivery and financing issues, including actions to reduce or limit increases to premium payments, provider billing protections, access to care and other reforms of state health insurance markets. State ballot initiatives could also be put to voters that could adversely impact our operating environment. If enacted into law, these state proposals and actions could have an adverse impact on our business, cash flows, operations or financial condition. Additionally, state legislative actions and litigation could impact ERISA pre-emption. Further, Congress has considered, and may consider in the future, various forms of managed care reform legislation which, if adopted, could fundamentally alter the treatment of coverage decisions under ERISA, including limiting ERISA’s preemptive effect on state laws, and could increase our costs, expose us to expanded liability, permit greater state regulation of our operations, or require us to revise the ways in which we conduct business.

Previous wording

Delays in obtaining or failure to obtain or maintain these approvals, as well as future regulatory action by state or federal authorities, could have a material adverse effect on the profitability or marketability of our health benefits, pharmacy services, healthcare and other products and services or on our business, financial condition, and results of operations. In addition, changes in government regulations, policies or funding that apply to government-sponsored programs such as Medicare and Medicaid including, among other things, reimbursement levels, quality-based bonus payment determinations, eligibility and redetermination requirements, benefit coverage requirements and additional governmental participation, have adversely affected, and could in the future adversely affect, our business, cash flows, financial condition, and results of operations. Although Medicaid eligibility redeterminations following COVID-19 suspensions slowed throughout 2024, CMS has provided that states have until December 31, 2025, to complete these eligibility redeterminations.

Current wording

We are required to obtain and maintain insurance licenses and other regulatory approvals to market certain of our products and services, to increase prices for certain regulated products and services and to consummate some of our acquisitions and dispositions. Delays in obtaining or failure to obtain or maintain these approvals, as well as future regulatory action by state or federal authorities, could have an adverse effect on the profitability or marketability of our health benefits, pharmacy services, healthcare and other products and services or on our business, financial condition, and results of operations. In addition, changes in government regulations, policies or funding that apply to government-sponsored programs such as Medicare and Medicaid including, among other things, reimbursement levels, quality-based bonus payment determinations, eligibility and redetermination requirements, taxes or assessments for our programs, such as premium taxes on health insurance, benefit coverage requirements, rate-setting methodologies, audit and oversight practices, and additional governmental participation, have adversely affected, and could in the future adversely affect, our business, cash flows, financial condition, and results of operations.

Previous wording

We have experienced past assessments under state or federal insolvency or guaranty association laws applicable to insurance companies, HMOs and other payers, and may experience assessments in the future if, for example, premiums established by other companies for their health insurance products, including certain long-term care products, are inadequate to cover their costs. Any such assessment could expose us to the risk of paying a portion of an impaired or insolvent insurance company’s claims through state guaranty associations. We are not currently able to estimate our potential financial obligations, losses or the availability of offsets associated with potential guaranty association assessments; however, any significant increase in guaranty association assessments could have a material adverse effect on our business, cash flows, financial condition, and results of operations.

Current wording

We have experienced past assessments under state or federal insolvency or guaranty association laws applicable to insurance companies, HMOs and other payers, and may experience assessments in the future if, for example, premiums established by other companies for their health insurance products, including certain long-term care products, are inadequate to cover their costs. Any such assessment could expose us to the risk of paying a portion of an impaired or insolvent insurance company’s claims through state guaranty associations. We are not currently able to estimate our potential financial obligations, losses or the availability of offsets associated with future guaranty association assessments; however, any significant increase in guaranty association assessments could have an adverse effect on our business, cash flows, financial condition, and results of operations.

Previous wording

As we expand and operate our business outside of the U.S., we are presented with different challenges, including challenges in adapting to new markets, languages, business, labor and cultural practices, regulatory environments and local civil unrest or political controversy. Adapting to these challenges could require us to devote significant senior management attention and other resources. If we are unable to successfully manage our international operations, our business, cash flows, financial condition and results of operations could be adversely affected. In the future, we may acquire or operate new businesses outside of the U.S., increasing our exposure to these risks.

Current wording

As we expand and operate our business outside of the U.S., we are presented with different challenges, including challenges in adapting to new markets, languages, business, labor and cultural practices, regulatory environments and local civil unrest or political controversy. Adapting to these challenges could require us to devote significant senior management attention and other resources. If we are unable to successfully manage our international operations, our business, cash flows, financial condition and results of

Previous wording

Certain of our subsidiaries operate internationally and are subject to regulation in the jurisdictions in which they are organized or conduct business related to, among other things, local and cross border taxation, intellectual property, investment, currency rate differentials, management control, labor, anti-fraud, anti-corruption and privacy and data protection, which vary by jurisdiction. In addition, we are subject to U.S. laws that regulate the conduct and activities of U.S.-based businesses operating abroad, such as the Foreign Corrupt Practices Act. Violations of these laws and regulations could result in fines, criminal sanctions against us, our officers or associates, restrictions or outright prohibitions on the conduct of our business and significant reputational harm and could adversely affect our ability to market our products and services, which may have a material adverse effect on our business, financial condition and results of operations.

Current wording

Certain of our subsidiaries operate internationally and are subject to regulation in the jurisdictions in which they are organized or conduct business related to, among other things, local and cross border taxation, intellectual property, investment, currency rate differentials, management control, labor, anti-fraud, anti-corruption and privacy and data protection, which vary by jurisdiction. In addition, we are subject to U.S. laws that regulate the conduct and activities of U.S.-based businesses operating abroad, such as the Foreign Corrupt Practices Act. Violations of these laws and regulations could result in fines, criminal sanctions against us, our officers or associates, restrictions or outright prohibitions on the conduct of our business and significant reputational harm and could adversely affect our ability to market our products and services, which may have an adverse effect on our business, financial condition and results of operations.

Previous wording

We are, and may in the future be, a party to a variety of private party and governmental legal actions and investigations that may affect our business, such as administrative charges before government agencies, employment and employment discrimination-related suits, employee benefit claims, breach of contract actions, tort claims, intellectual property-related litigation and settlements. In addition, because of the nature of our business, we are subject to a variety of legal actions relating to our business operations, including the design, administration and offering of our products and services. These could include claims relating to the denial or limitation of health benefits; federal and state false claims act laws; dispensing of drugs associated with our pharmacy services business; professional liability claims arising out of the delivery of healthcare and related services to the public; development or application of medical policies and coverage and clinical guidelines; medical malpractice actions; allegations of anti-competitive and unfair business activities; provider disputes over reimbursement and contracts; provider tiering programs; narrow networks; termination of provider contracts; the recovery of overpayments from providers; fee-based business; disputes over co-payment calculations; reimbursement of out-of-network claims; the failure to disclose certain business practices; the failure to comply with various state or federal laws, including but not limited to: ERISA and the Mental Health Parity Act; the calculation of minimum

Current wording

We are, and may in the future be, a party to a variety of private party and governmental legal actions and investigations that may affect our business, such as administrative charges before government agencies, employment and employment discrimination-related suits, employee benefit claims, breach of contract actions, tort claims, intellectual property-related litigation and settlements. In addition, because of the nature of our business, we are subject to a variety of legal actions relating to our business operations, including the design, administration and offering of our products and services. These could include claims relating to the denial or limitation of health benefits; federal and state false claims act laws; dispensing of drugs associated with our pharmacy services business; professional liability claims arising out of the delivery of healthcare and related services to the public; development or application of medical policies and coverage and clinical guidelines; medical malpractice actions; allegations of anti-competitive and unfair business activities; provider disputes over reimbursement and contracts; provider tiering programs; narrow networks; termination of provider contracts; the recovery of overpayments from providers; fee-based business; disputes over co-payment calculations; reimbursement of out-of-network claims; the failure to disclose certain business practices; the failure to comply with various state or federal laws, including but not limited to ERISA and the Mental Health Parity Act; the calculation of minimum MLR and rebates related thereto; claims related to privacy, intellectual property and vendor disputes; claims related to our use of personal information and other proprietary data; and customer audits and contract performance, including government contracts. These actions or proceedings could result in substantial costs to us, require management to spend substantial time focused on litigation, result in negative media attention, and may adversely affect our business, reputation, financial condition, results of operations and cash flows.

Previous wording

We are also involved in, or may in the future be party to, pending or threatened litigation incidental to the business we transact or arising out of our operations, including, but not limited to, breaches of security and violations of privacy requirements, shareholder actions, compliance with federal and state laws and regulations (including qui tam or “whistleblower” actions), or sales and acquisitions of businesses or assets. From time to time, we are involved as a party in various governmental inquiries, investigations, audits, reviews and administrative proceedings, including challenges relating to the award of government contracts. These investigations, audits and reviews include routine and special investigations by state insurance departments, various federal regulators including CMS and the HHS Office of Inspector General, state attorneys general, the Department of Justice, and various offices of the U.S. Attorney General. Following an investigation, we may be subject to civil or criminal fines, penalties, and other sanctions if we are determined to be in violation of applicable laws or regulations. Liabilities that may result from these actions could have a material adverse effect on our cash flows, results of operations and financial condition.

Current wording

We are also involved in, or may in the future be party to, pending or threatened litigation incidental to the business we transact or arising out of our operations, including, but not limited to, breaches of security and violations of privacy requirements, shareholder actions, compliance with federal and state laws and regulations (including qui tam or “whistleblower” actions), or sales and acquisitions of businesses or assets. From time to time, we are involved as a party in various governmental inquiries, investigations, audits, reviews and administrative proceedings, including challenges relating to the award of government contracts. These investigations, audits and reviews include routine and special investigations by state insurance departments, various federal regulators including CMS and the HHS Office of Inspector General, state attorneys general, the Department of Justice, and various offices of the U.S. Attorney General. Following an investigation, we may be subject to civil or criminal fines, penalties, and other sanctions if we are determined to be in violation of applicable laws or regulations. Liabilities that may result from these actions could have an adverse effect on our cash flows, results of operations and financial condition.

Previous wording

We continue to evolve our business to offer products and services beyond traditional health insurance, including digital health technology, pharmacy services, home health, and behavioral and clinical care services, which subjects us to litigation and regulatory risks that are different from our traditional product and services offerings and may materially affect our exposure to other risks.

Current wording

We continue to evolve our business to offer products and services beyond traditional health insurance, including digital health technology, pharmacy services, home health, and behavioral and clinical care services, which subjects us to litigation and regulatory risks that are different from our traditional product and services offerings and may adversely affect our exposure to other risks.