MOLINA HEALTHCARE, INC.

Previous wording

Our premium revenues consist of fixed monthly payments per member, and supplemental payments for other services such as maternity deliveries. These premiums are fixed by contract, and we are obligated during the contract periods to provide healthcare services as established by the state governments in which our health plans operate. We use a large portion of our revenues to pay the costs of healthcare services delivered to our members. If premiums do not increase when expenses related to healthcare services rise, our medical margins will be compressed, and our earnings will be negatively affected. If the actuarial assumptions made by a state in implementing a rate or benefit change or update are incorrect or are at variance with the prevailing medical cost trend or particular utilization patterns of the members of one or more of our health plans, our medical margins could be reduced. In addition, a state could increase hospital or other provider rates without making a commensurate increase in the rates paid to us, could lower our rates without making a commensurate reduction in the rates paid to hospitals or other providers, or could delay the processing of rate changes. Any of these rate adjustments in one or more of the states in which we operate could have a material adverse effect on our business, financial condition, cash flows, or results of operations.

Current wording

Our premium revenues consist of fixed monthly payments per member, and supplemental payments for other services such as maternity deliveries. These premiums are fixed by contract, and we are obligated during the contract periods to provide healthcare services as established by the state governments in which our health plans operate. Rate increases are most typically implemented by states on only an annual basis. We use most of our premium revenues to pay the medical costs of healthcare services delivered to our members. If the premiums paid to us are not increased at a rate that is commensurate with the rate at which medical expenses related to healthcare services rise, or the rate at which health care utilization rates increase, our medical margins will be compressed or eliminated, and our earnings will be negatively affected. We have seen in prior quarters that medical expenses have risen higher than anticipated, and that our capitation rates have not kept pace with the sharp rate of that medical care cost increase. Our inability to predict future medical expenses and future rates of utilization may continue in future quarters due to the inherently unpredictable and continually evolving market conditions. Further, if the actuarial assumptions made by a state in implementing a rate or benefit change are incorrect or quickly become outdated, or if they are at variance with or do not keep pace with the prevailing medical cost trend or particular utilization patterns of the members of one or more of our health plans, our medical margins could be reduced or eliminated. In addition, a state could increase hospital or other provider reimbursement without making a commensurate increase in the reimbursement paid to us, could lower our rates without making a commensurate reduction in the rates paid to hospitals or other providers, could delay the processing of rate changes, or could even make a retroactive rate adjustment or recoupment with regard to a period where we thought the payment amount was final. Insufficient rate increases, a continuing spike in medical care costs or utilization that outpace our rate increases, or retroactive rate reductions or recoupments in one or more of the states in which we operate, could have a material adverse effect on our business, financial condition, cash flows, or results of operations.

Previous wording

Our Marketplace business has been volatile and unpredictable in the past.

Current wording

Our Marketplace business has been volatile and unpredictable, and has been subject to annual programmatic changes that are difficult to price for actuarially.

Previous wording

We offer Marketplace plans in many of the states where we offer Medicaid health plans. In 2025, we are participating in the Marketplace in all our markets except Arizona, Iowa, Massachusetts, Nebraska, New York, and Virginia. Our Marketplace plans allow our Medicaid members to stay with their providers as they transition between Medicaid and the Marketplace. Additionally, our plans remove financial barriers to quality care and seek to minimize members' out-of-pocket expenses. We develop each state’s Marketplace premium rates during the spring of each year for policies effective in the following calendar year. Premium rates are based on our estimates of utilization of services and unit costs, anticipated member risk acuity and related federal risk adjustment transfer amounts, and non-benefit expenses such as administrative costs, taxes, and fees. In the year ended December 31, 2024, Marketplace program PMPM premium rates ranged from $400 to $1,980. Marketplace plan selection by members is highly price sensitive, and the Marketplace markets in general are highly volatile and unpredictable from year to year. Most of our Marketplace members are eligible to receive government-subsidized premium subsidies. These subsidies are currently scheduled to expire at the end of 2025. Any variation from our cost expectations regarding acuity, enrollment levels, adverse selection, or other assumptions utilized in setting premium rates, could have a material adverse effect on our results of operations, financial position, and cash flows. In addition, the non-renewal of Marketplace premium subsidies starting in 2026 could negatively impact our Marketplace enrollment.

Current wording

We offer Marketplace plans in many of the states where we offer Medicaid health plans. In 2026, we are participating in the Marketplace in all our markets except Arizona, Iowa, Massachusetts, Michigan, Nebraska, New York, and Wisconsin. Our Marketplace plans allow our Medicaid members to stay with their providers as they transition between Medicaid and the Marketplace. Additionally, our plans remove financial barriers to quality care and seek to minimize members' out-of-pocket expenses. We develop each state’s Marketplace premium rates during the spring of each year for policies effective in the following calendar year. Premium rates are based on our estimates of utilization of services and unit costs, anticipated member risk acuity and related federal risk adjustment transfer amounts, and non-benefit expenses such as administrative costs, taxes, and fees. Marketplace plan selection by members is highly price sensitive, and the Marketplace markets in general are highly volatile and unpredictable from year to year. In recent years, most of our Marketplace members were eligible to receive government-subsidized premium subsidies. Even though certain advanced premium tax credits (“APTCs”) expired at the end of 2025, it is possible that they could be renewed, but the timing of such a decision, and the manner in which they could be renewed, is uncertain. This expiration, as well as any future elimination or reduction of other APTCs or subsidies, could make such coverage unaffordable to some individuals and thereby reduce overall participation in the Marketplace and our membership. These fluctuations could have a significant adverse effect on our business and future operations, and our results of operations and financial condition. Any variation from our cost expectations regarding acuity, enrollment levels, adverse selection, or other assumptions utilized in setting premium rates, could have a material adverse effect on our results of operations, financial position, and cash flows. In addition, the non-renewal of Marketplace premium subsidies starting in 2026 could negatively impact our

Previous wording

Although most of our health plans over the last several years have generally operated with profit margins higher than those of our direct competitors, nevertheless the profit margins in our industry are low (in the single digits) compared to the profit margins in most other industries. Given these low profit margins, small changes in operating performance or slight changes to our accounting estimates could have a disproportionate impact on our reported net income and adversely affect our business.

Current wording

Although most of our health plans over the last several years have generally operated with profit margins higher than those of our direct competitors, nevertheless the profit margins of our health plans are low (in the single digits) compared to the profit margins in most other industries or business sectors. Given these low profit margins, small changes in operating performance or slight changes to our accounting estimates have a disproportionate impact on our reported net income and adversely affect our business.

Previous wording

Our profitability depends to a significant degree on our ability to accurately predict and effectively manage our medical care costs. Historically, our medical care ratio, meaning our medical care costs as a percentage of our premium revenue, has fluctuated substantially, and has varied across our health plans. Because the premium payments we receive are generally fixed in advance and we operate with a narrow profit margin, relatively small changes in our medical care ratio can create significant changes in our overall financial results. For example, if our overall medical care ratio of 89.1% for the year ended December 31, 2024, had been one percentage point higher, or 90.1%, our net income per diluted share for the year ended December 31, 2024 would have been approximately $15.18 rather than our actual net income per diluted share of $20.42, a difference of $5.24.

Current wording

Our profitability depends to a significant degree on our ability to accurately predict and effectively manage our medical care costs. Historically, our medical care ratio, meaning our medical care costs as a percentage of our premium revenue, has fluctuated substantially, and has varied across our health plans. Because the premium payments we receive are generally fixed in advance and we operate with a narrow profit margin, relatively small changes in our medical care ratio can create significant changes in our overall financial results. For example, if our overall medical care ratio of 91.7% for the year ended December 31, 2025, had been one percentage point higher, or 92.7%, our net income per diluted share for the year ended December 31, 2025 would have been approximately $2.72 rather than our actual net income per diluted share of $8.92, a difference of $6.20.

Previous wording

•increased incidences or acuity of high dollar claims related to catastrophic illnesses or medical conditions for which we do not have adequate reinsurance coverage;

Current wording

•increased incidence or acuity of high dollar claims related to catastrophic illnesses or medical conditions for which we do not have adequate reinsurance coverage;

Previous wording

Our Medicaid premium revenues could be adversely impacted by retroactive adjustments or states’ delays in implementing rate changes.

Current wording

Our Medicaid premium revenues could be adversely impacted by retroactive adjustments or recoupments, or states’ delays in implementing rate changes.

Previous wording

The complexity of some of our Medicaid contract provisions, imprecise language in those contracts, the desire of state Medicaid agencies in some circumstances to retroactively adjust for the acuity of the medical needs of our members, and state delays in processing rate changes, can create uncertainty around the amount of revenue we should recognize. Any circumstance such as those described above could have a material adverse effect on our business, financial condition, cash flows, or results of operations.

Current wording

The complexity of some of our Medicaid contract provisions, imprecise language in those contracts, the desire of state Medicaid agencies in some circumstances to retroactively adjust the rates that they have paid to us or otherwise recoup premium amounts that we reasonably believed to be final, or state delays in processing rate changes, can create uncertainty around the amount of revenue we should recognize. Any circumstance such as those described above could have a material adverse effect on our business, financial condition, cash flows, or results of operations.

Previous wording

If the responsive bids of our health plans for new or renewed Medicaid contracts are not successful, or if our government contracts are terminated or are not renewed on favorable terms, our premium revenues could be materially reduced and our operating results could be negatively impacted.

Current wording

If the responsive bids of our health plans for new or renewed Medicaid contracts are not successful, or if our government contracts are terminated or are not renewed on favorable terms, our premium revenues could be materially reduced, our operating results could be negatively impacted, and we may not realize the full projected amount of our embedded earnings.

Previous wording

We currently derive our premium revenues from health plans that operate in 21 states. Our Medicaid premium revenue constituted 79% of our consolidated premium revenue in the year ended December 31, 2024. Measured by Medicaid premium revenue by health plan, our top four health plans were in California, New York, Texas, and Washington, with aggregate Medicaid premium revenue of $15.6 billion, or approximately 51% of total Medicaid premium revenue, in the year ended December 31, 2024. If we are unable to continue to operate in any of our existing jurisdictions, or if our current operations in those jurisdictions or any portions of those jurisdictions are significantly curtailed or terminated entirely, our revenues could decrease materially.

Current wording

We currently derive our premium revenues from health plans that operate in 21 states. Our Medicaid premium revenue constituted 75% of our consolidated premium revenue in the year ended December 31, 2025. Measured by Medicaid premium revenue by health plan, our top four health plans were in California, New York, Texas, and Washington, with aggregate Medicaid premium revenue of $17.3 billion, or approximately 54% of total Medicaid premium revenue, in the year ended December 31, 2025. If we are unable to continue to operate in any of our existing jurisdictions, or if our current operations in those jurisdictions or any portions of those jurisdictions are significantly curtailed or terminated entirely, our revenues could decrease materially.

Previous wording

Even if our responsive bids are successful, the bids may be based upon assumptions regarding enrollment, utilization, medical costs, or other factors which could result in the contract being less profitable than we had expected or could result in a net loss. Furthermore, our contracts contain certain provisions regarding, among other things, eligibility, enrollment and dis-enrollment processes for covered services, eligible providers, periodic financial and information reporting, quality assurance and timeliness of claims payment, and are subject to cancellation if we fail to perform in accordance with the standards set by regulatory agencies.

Current wording

Even if our responsive bids are successful, the bids may be based upon assumptions regarding enrollment, utilization, medical costs, or other factors which could result in the contract being less profitable than we had expected or could result in a net loss. Furthermore, our contracts contain certain provisions regarding, among other things, eligibility, enrollment and dis-enrollment processes for covered services, eligible providers, periodic financial and information reporting, quality assurance and timeliness of claims payment, and are subject to cancellation if we fail to perform in accordance with the standards set by regulatory agencies. The occurrence of any of the foregoing may result in our failing to achieve the full realization of our embedded earnings.

Previous wording

If we or one of our vendors sustain a cyber-attack or suffer a data privacy or security breach, we could suffer operational impact, increased costs, exposure to significant liability, reputational harm, loss of business, and other serious negative consequences.

Current wording

We and our third-party service providers are exposed to cybersecurity risks, which may result in operational impact, increased costs, exposure to significant legal liability, reputational harm, loss of business, and other serious negative consequences.

Previous wording

As part of our normal operations, we routinely collect, process, store (both onsite and in the cloud), and transmit large amounts of data, including sensitive personal information as well as proprietary or confidential information relating to our business or third parties. Our information technology systems and safety control systems that we rely upon are subject to a growing number of threats, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), malfeasance by insiders, human or technological error, and as a result of malicious code embedded in open-source software, or misconfigurations, bugs or other vulnerabilities in commercial software that is integrated into our (or our suppliers’ or service providers’) IT systems, products or services. Such threats may result in the penetration of our network or that of our vendors or suppliers, and the misappropriation of our confidential information, system disruptions, damage to our information systems, or shutdowns of our information technology environment. They also may be able to develop and deploy viruses, worms, and other malicious software programs that attack our systems or otherwise exploit security vulnerabilities. We may also face increased cybersecurity risks due to our reliance on internet technology and our remote working environment, which may create additional opportunities for cybercriminals to exploit vulnerabilities. These same risks are also faced by our significant vendors who are also in possession of sensitive confidential information. Because the techniques used to circumvent, gain access to, or sabotage security systems can be highly sophisticated, may use advanced technologies (such as artificial intelligence) and change frequently, they often are not recognized until launched against a target, and may originate from less regulated and remote areas around the world. We may be unable to anticipate these techniques or implement adequate preventive measures, resulting in potential inappropriate access, breach, or data loss and damage to our systems. Our systems are also subject to compromise from internal threats such as improper action by employees, including malicious insiders, or by vendors, counterparties, and other third parties with otherwise legitimate access to our systems. Our policies, employee training (including phishing prevention training), procedures, and technical safeguards may not prevent all improper access to our network or proprietary or confidential information by employees, vendors, counterparties, or other third parties. Our facilities and IT systems, or those of our service providers, may also be vulnerable to security incidents or security attacks, acts of vandalism or theft, misplaced or lost data, human errors, or other similar events that could negatively affect our systems and our and our members’ data. For example, i…

Excerpt shortened here; the source contains the full paragraph.

Current wording

As part of our normal operations, we and certain of our third-party service providers routinely collect, process, store (both onsite and in the cloud), and transmit large amounts of data, including sensitive Personal Information as well as proprietary or confidential information relating to our members, employees, business, or other third parties (collectively, “Confidential Information”). Additionally, we rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business (collectively, “IT Systems”). We own and manage some of these IT Systems but also rely on third parties for a range of IT Systems and related products and services, including but not limited to cloud computing services. We and our third-party suppliers and service providers face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of IT Systems and Confidential Information, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), malfeasance by insiders, human or technological error, and as a result of malicious code embedded in open-source software, or misconfigurations, bugs or other vulnerabilities in commercial software that is integrated into our (or our suppliers’ or service providers’) IT Systems, products or services. Such threats may result in the penetration of our network or that of our vendors or suppliers, and the misappropriation of our Confidential Information, system disruptions, damage to our information systems, or shutdowns of our information technology environment. They also may be able to develop and deploy viruses, worms, and other malicious software programs that attack our systems or otherwise exploit security vulnerabilities. We may also face increased cybersecurity risks due to our reliance on internet technology and our remote working environment, which may create additional opportunities for cybercriminals to exploit vulnerabilities. These same risks are also faced by our significant vendors who are also in possession of sensitive Confidential Information. Because the techniques used to circumvent, gain access to, or sabotage security systems can be highly sophisticated, may use advanced technologies (such as artificial intelligence) and change frequently, they often are not recognized until launched against a target, and may originate from less regulated and remote areas around the world. We may be unable to anticipate these techniques, which can circumvent security controls, evade detection and remove forensic evidence, or implement adequate preventive measures, resulting in potential inappropriate access, breach, or data loss and damage to our IT Systems, Confidential Information, or business. Additionally, any integratio…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Moreover, we face the ongoing challenge of managing access controls in a complex environment. The process of enhancing our protective measures can itself create a risk of systems disruptions and security issues. Given the breadth of our operations and the increasing sophistication of cyberattacks, a particular incident could occur and persist for an extended period of time before being detected. The extent of a particular cyberattack and the steps that we may need to take to investigate the attack may take a significant amount of time before such an investigation could be completed and full and reliable information about the incident is known. During such time, the extent of any harm or how best to remediate it might not be known, which could further increase the risks, costs, and consequences of a data security incident. In addition, our systems must be routinely updated, patched, and upgraded to protect against known vulnerabilities. The volume of new software vulnerabilities has increased substantially, as has the importance of patches and other remedial measures. In addition to remediating newly identified vulnerabilities, previously identified vulnerabilities must also be updated. We are at risk that cyber attackers exploit these known vulnerabilities before they have been addressed. The complexity of our systems and platforms, the increased frequency at which vendors are issuing security patches to their products, our need to test patches and, in some instances, coordinate with third parties before they can be deployed, all could further increase our risks.

Current wording

Moreover, we face the ongoing challenge of managing access controls in a complex environment. The process of enhancing our protective measures can itself create a risk of systems disruptions and security issues. Given the breadth of our operations and the increasing sophistication of cyberattacks, a particular incident could occur and persist for an extended period of time before being detected. The extent of a particular cyberattack and the steps that we may need to take to investigate the attack may take a significant amount of time before such an investigation could be completed and full and reliable information about the incident is known. During such time, the extent of any harm or how best to remediate it might not be known, which could further increase the risks, costs, and consequences of a data security incident. In addition, our IT Systems must be routinely updated, patched, and upgraded to protect against identified vulnerabilities. The volume of new software vulnerabilities has increased substantially, as has the importance of patches and other remedial measures. In addition to remediating newly identified vulnerabilities, previously identified vulnerabilities must also be updated. We are at risk that cyber attackers exploit these known vulnerabilities before they have been comprehensively addressed, leading to significant compromises that could impact our and our customers’ IT Systems and data. In other situations, vulnerabilities persist even after we have issued security patches because our customers or third-party service providers may fail to apply patches or update their systems to newer software versions. The complexity of our systems and platforms, the increased frequency at which vendors are issuing security patches to their products, our need to test patches and, in some instances, coordinate with third parties before they can be deployed, all could further increase our risks.

Previous wording

Where doing so is necessary in order to conduct our business, we also provide sensitive personal member information, as well as proprietary or confidential information relating to our business, to our third-party service providers. Those third-party service providers may also be subject to data intrusions or data breaches. For example, in February 2024, Change Healthcare (“CHC”), a major claims processing vendor to Molina, experienced a significant cybersecurity incident and has since notified Molina that certain members’ data has been breached. Though the CHC incident was not material to us, any compromise of the confidential data of our members, employees, or business, or the failure to prevent or mitigate the loss of or damage to this data through breach, could result in operational, reputational, competitive, or other business harm, as well as financial costs and regulatory action. The Company maintains cybersecurity insurance in the event of an information security or cyber incident. However, the coverage may not be sufficient to cover all financial losses.

Current wording

Where doing so is necessary in order to conduct our business, we also provide sensitive member Personal Information, as well as Confidential Information relating to our business, to our third-party service providers. Those third-party service providers may also be subject to data intrusions or data breaches. Any compromise of the Confidential Information of our members, employees, or business, or the failure to prevent or mitigate the loss of or damage to this data through breach, could result in operational, reputational, competitive, or other business harm, as well as financial costs and regulatory action. The Company maintains cybersecurity insurance in the event of an information security or cyber incident. However, we cannot guarantee that the coverage will be sufficient to cover all financial losses and liabilities.

Previous wording

In the future, we may be subject to litigation and governmental investigations related to cyber-attacks and security breaches. Any such future litigation or governmental investigation could divert the attention of management from the operation of our business, result in reputational damage, and have a material adverse impact on our business, cash flows, financial condition, and results of operations. Moreover, our programs to detect, contain, and respond to data security incidents as well as contingency plans and insurance coverage for potential liabilities of this nature may not be sufficient to cover all claims and liabilities.

Current wording

We and certain of our third-party service providers may experience cyberattacks and other incidents, and we expect such attacks and incidents to continue in varying degrees. In addition, we may also be subject to cyberattacks and other incidents. While to date no incidents have had a material impact on our operations or financial results, we cannot guarantee that material incidents will not occur in the future. Any adverse impact to the availability, integrity or confidentiality of our IT Systems or Confidential Information, or related litigation, and governmental investigations could divert the attention of management from the operation of our business, result in reputational damage, and have a material adverse impact on our business, cash flows, financial condition, and results of operations. Moreover, our programs to detect, contain, and respond to data security incidents as well as contingency plans may not be effective in preventing or mitigating all incidents and insurance coverage for potential liabilities of this nature may not be sufficient to cover all claims and liabilities.

Previous wording

Noncompliance with any privacy, security or data protection laws and regulations, or any security breach, cyber-attack, or cyber-security breach, and any incident involving the misappropriation, theft, loss, or other unauthorized disclosure or use of, or access to, sensitive or confidential information, whether by us or by one of our third-party service providers, could require us to expend significant resources to continue to modify or enhance our protective measures and to remediate any damage. In addition, this could negatively affect our operations, cause system disruptions, damage our reputation, cause membership losses and contract breaches, and could also result in regulatory enforcement actions, material fines and penalties, litigation, or other actions that could have a material adverse effect on our business, cash flows, financial condition, or results of operations.

Current wording

Noncompliance with any privacy, security, or data protection laws and regulations, or any security breach, cyber-attack, or cyber-security breach, and any incident involving the misappropriation, theft, loss, or other unauthorized disclosure or use of, or access to, IT Systems or sensitive or Confidential Information, whether by us or by one of our third-party service providers, could require us to expend significant resources to continue to modify or enhance our protective measures and to remediate any damage. In addition, this could negatively affect our operations, cause system disruptions, damage our reputation, cause membership losses and contract breaches, and could also result in regulatory investigations or enforcement actions, material fines and penalties, contractual liquidated damages, litigation or proceedings (such as class actions), or other actions that could have a material adverse effect on our business, cash flows, financial condition, or results of operations.

Previous wording

We may be unable to successfully integrate our acquisitions or realize the anticipated benefits of such acquisitions.

Current wording

We may be unable to successfully integrate our acquisitions or realize the anticipated benefits of such acquisitions, including the full realization of our embedded earnings.

Previous wording

Our growth strategy includes the pursuit of targeted inorganic growth opportunities that we believe will provide a strategic fit, leverage operational synergies, and lead to incremental earnings accretion. For example, in January 2024 we closed on the acquisition of Bright Health Medicare and in February 2025 we closed on the acquisition of ConnectiCare. The integration of acquired businesses with our existing business is a complex, costly, and time-consuming process. The success of acquisitions we make will depend, in part, on our ability to successfully combine our existing business with such acquired businesses and realize the anticipated benefits, including synergies, cost savings, growth in earnings, innovation, and operational efficiencies. If we are unable to achieve these objectives within the anticipated time frame, or at all, the anticipated benefits may not be fully realized, or may take longer to realize than expected.

Current wording

Our growth strategy includes the pursuit of targeted inorganic growth opportunities that we believe will provide a strategic fit, leverage operational synergies, and lead to incremental earnings accretion. The integration of acquired businesses with our existing business is a complex, costly, and time-consuming process. The success of acquisitions we make will depend, in part, on our ability to successfully combine our existing business with such acquired businesses and realize the anticipated benefits, including synergies, cost savings, growth in earnings, innovation, and operational efficiencies. If we are unable to achieve these objectives within the anticipated time frame, or at all, the anticipated benefits may not be fully realized, or may take longer to realize than expected.

Previous wording

•Unforeseen expenses or delays associated with the acquisition and/or integration;

Current wording

•Unforeseen expenses or delays associated with the acquisition and/or integration, including the unexpected emergence of liabilities of the acquired entity that had not previously been disclosed or foreseen;

Previous wording

Start-up costs associated with a new business can be substantial. For example, to obtain a certificate of authority to operate as a health maintenance organization in most jurisdictions, we must first establish a provider network, develop and establish infrastructure and required systems, and demonstrate our ability to process claims. In 2023, we incurred substantial one-time contract implementation costs related to our expansions in Los Angeles County, Iowa, and Nebraska. Often, we are also required to contribute significant capital to fund mandated net worth requirements, performance bonds or escrows, or contingency guaranties. If we are unsuccessful in obtaining a certificate of authority, winning the bid to provide services, building out our provider network, or attracting and retaining members in sufficient numbers to cover our start-up costs, the new business could fail, or the losses we incur could impact our results of operations.

Current wording

Start-up costs associated with a new business can be substantial. For example, to obtain a certificate of authority to operate as a health maintenance organization in most jurisdictions, we must first establish a provider network, develop and establish infrastructure and required systems, and demonstrate our ability to process claims. Often, we are also required to contribute significant capital to fund mandated net worth requirements, performance bonds or escrows, or contingency guaranties. If we are unsuccessful in obtaining a certificate of authority, winning the bid to provide services, building out our provider network, or attracting and retaining members in sufficient numbers to cover our start-up costs, the new business could fail, or the losses we incur could impact our results of operations.

Previous wording

We currently spread the cost of centralized services over a large revenue base. Many of our administrative costs are fixed in nature and will be incurred at the same level regardless of the size of our revenue base. If we lose contracts that constitute a significant amount of our revenue, we may not be able to reduce the expense of centralized services in a manner that is proportional to that loss of revenue. In such circumstances, not only will our total dollar margins decline, but our percentage margins, measured as a percentage of revenue, will also decline.

Current wording

We currently spread the cost of centralized services over a large revenue base. Many of our administrative costs are fixed in nature and will be incurred at the same level regardless of the size of our revenue base. If we lose contracts that constitute a significant amount of our revenue, we may not be able to reduce the expense of centralized services in a manner that is proportional to that loss of revenue. In such circumstances, not only will our total dollar margins decline, but our percentage margins, measured as a percentage of revenue, will also decline. This loss of cost efficiency or cost leverage, and the resulting stranded administrative costs, could have a material and adverse impact on our business, financial condition, cash flows, or results of operations.

Previous wording

We contract with physicians, hospitals, and other providers as a means to ensure access to healthcare services for our members, to manage medical care costs and utilization, and to better monitor the quality of care being delivered. We compete with other health plans to contract with these providers. We believe providers select plans in which they participate based on criteria including reimbursement rates, timeliness and accuracy of claims payment, potential to deliver new patient volume and/or retain existing patients, effectiveness of resolution of calls and complaints, and other factors. There can be no assurance that we will be able to successfully attract and retain providers to maintain a competitive network in the geographic areas we serve. In addition, in any particular market, providers could refuse to contract with us, demand higher payments, or take other actions which could result in higher medical care costs, disruption to provider access for current members, a decline in our growth rate, or difficulty in meeting regulatory or accreditation requirements.

Current wording

We contract with physicians, hospitals, and other providers as a means to ensure access to healthcare services for our members, to manage medical care costs and utilization, and to better monitor the quality of care being delivered. We compete with other health plans to contract with these providers. We believe providers select plans in which they participate based on criteria including reimbursement rates, timeliness and accuracy of claims payment, potential to deliver new patient volume and/or retain existing patients, effectiveness of resolution of calls and complaints, and other factors. There can be no assurance that we will be able to successfully attract and retain providers to maintain a competitive network in the geographic areas we serve. In addition, in any particular market, providers could refuse to contract with us, demand higher payments, or take other actions which could result in higher medical care costs, disruption to provider access for current members, a decline in our growth rate, or difficulty in meeting regulatory or accreditation requirements. Moreover, in the ordinary course there is natural turnover and change among physician practices, including office moves, practitioner retirements, cessation of practice, practice mergers or additions, and so on. Often we are not made aware of these changes on a timely basis or at all, which makes it highly difficult to maintain fully accurate provider directories at all times. The inaccuracy of our provider directors incidental to such change could subject us to fines, sanctions, lawsuits, or other liabilities.

Previous wording

Our business is dependent on effective and secure information systems that assist us in processing provider claims, monitoring utilization and other cost factors, supporting our medical management techniques, providing data to our regulators, and implementing our data security measures. Our members and providers also depend upon our information systems for enrollment, premium processing, primary care and specialist physician roster access, membership verifications, claims status, provider payments, and other information. If we experience a reduction in the performance, reliability, or availability of our information and medical management systems, our operations, ability to pay claims, ability to produce timely and accurate reports, and ability to maintain proper security measures could be adversely affected.

Current wording

Our business is dependent on effective and secure information systems, cloud providers and artificial intelligence (“AI”) capabilities that assist us in processing provider claims, monitoring utilization and other cost factors, supporting our medical management techniques, providing data to our regulators, and implementing our data security measures. Our members and providers also depend upon our information systems for enrollment, premium processing, primary care and specialist physician roster access, membership verifications, claims status, provider payments, and other information. If we experience a reduction in the performance, reliability, or availability of our information and medical management systems, our operations, ability to pay claims, ability to produce timely and accurate reports, and ability to maintain proper security measures, could be adversely affected.

Previous wording

We have partnered with third parties to support our information technology systems. This makes our operations vulnerable to adverse effects if such third parties fail to perform adequately. For example, in February 2019, we entered into a master services agreement with a third party vendor who manages certain of our information technology infrastructure services including, among other things, our information technology operations, end-user services, and data centers. If any licensor or vendor of any technology which is integral to our operations were to become insolvent or otherwise fail to support the technology sufficiently, our operations could be negatively affected. Additionally, our operations are vulnerable to adverse effects if such third parties are unable to perform due to forces outside of their control, such as a natural disaster or serious weather event.

Current wording

We have partnered with third parties to support our information technology systems. This makes our operations vulnerable to adverse effects if such third parties fail to perform adequately. We are party to a master services agreement with a third party vendor who manages certain of our information technology infrastructure services including, among other things, our information technology operations, end-user services, and data centers. If any licensor or vendor of any technology which is integral to our operations were to become insolvent or otherwise fail to support the technology sufficiently, our operations could be negatively affected. Additionally, our operations are vulnerable to adverse effects if such third parties are unable to perform due to forces outside of their control, such as a natural disaster or serious weather event.

Previous wording

We may not be successful in our artificial intelligence (“AI”) administrative and operational initiatives, which could adversely affect our business or reputation.

Current wording

We may not be successful in our AI administrative and operational initiatives, which could adversely affect our business or reputation.

Previous wording

As part of our operating efficiencies, we are making appreciable investments in certain AI administrative tools and initiatives to enhance our operations and to save costs. The development and use of AI technologies is still in its early stages. There are risks associated with the development and deployment of AI, and there can be no assurance that the usage of AI will enhance our operations or reduce our operational costs. Our AI-related efforts may give rise to risks related to accuracy, bias, discrimination, intellectual property rights and infringement, data privacy, and cybersecurity, among others. In addition, these risks include the possibility of new, changing, or enhanced governmental or regulatory scrutiny, litigation, other legal liability, ethical concerns, negative consumer perceptions as to automation and AI, or other complications that could adversely affect our business, reputation, or financial results. In the United States, there has been uncertainty regarding the applicable regulations that will apply to the development and use of AI technologies. For instance, in January 2025, the Trump administration rescinded an executive order relating to the safe and secure development of AI that was previously implemented by the Biden administration. The Trump administration then issued a new interim executive order that, among other things, requires certain agencies to specifically renew and, if possible, rescind rulemaking taken pursuant to the rescinded Biden executive order. Any such changes at the federal level could require us to expend significant resources to modify our products, services, or operations to ensure compliance or remain competitive. As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet completely determine the impact future laws, regulations, standards, or market perception of their requirements may have on our business and may not always be able to anticipate how to respond to these laws or regulations. Therefore, it is not possible to predict all of the risks and potentially unintended consequences related to the use of AI by vendors, third-party developers, or the Company.

Current wording

As part of our operating efficiencies, we are making appreciable investments in certain AI administrative tools and initiatives to enhance our operations and to save costs. The development and use of AI technologies is still in its early stages. There are risks associated with the development and deployment of AI, and there can be no assurance that the usage of AI will enhance our operations or reduce our operational costs. Our AI-related efforts may give rise to risks related to accuracy, bias, discrimination, intellectual property rights and infringement, data privacy, and cybersecurity, among others. In addition, these risks include the possibility of new, changing, or enhanced governmental or regulatory scrutiny, litigation, other legal liability, ethical concerns, negative consumer perceptions as to automation and AI, or other complications that could adversely affect our business, reputation, or financial results. For instance, the California Privacy Protection Agency’s new regulations under the CCPA regarding the use of automated decision-making went into effect on January 1, 2026. California also enacted seventeen new laws in 2024 that further regulate use of AI technologies and provide consumers with additional protections around companies’ use of AI technologies, such as requiring companies to disclose certain uses of generative AI. Other states are also considering AI-focused legislation, which would require developers and deployers of “high-risk” AI systems to implement certain safeguards against algorithmic discrimination. However, there also continues to be uncertainty regarding the enforceability of such regulations and how they will apply to the development and use of AI technologies. For instance, the federal government may seek to preempt state laws when they seek to govern certain topics, as evidenced by the Trump administration’s “Ensuring a National Policy Framework for Artificial Intelligence” Executive Order signed on December 11, 2025. This order calls for federal standards and legislation that would preempt conflicting state AI regulations and create a federal litigation task force focused on challenging state AI laws in court. The Trump administration may continue to implement new or rescind existing federal orders and/or administrative policies relating to AI technologies. Any such changes at the federal level could require us to expend significant resources to modify our products, services, or operations to ensure compliance or remain competitive. As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet completely determine the impact future laws, regulations, standards, or market perception of their requirements may have on our business and may not always be able to anticipate how to respond to these laws or regulations. Therefore, it is not possible to predict all of the risks and potentially unintended consequences related to the use…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

As of December 31, 2024, the carrying amount of goodwill was $1,671 million, and intangible assets, net, were $267 million.

Current wording

As of December 31, 2025, the carrying amount of goodwill was $1,958 million, and intangible assets, net, were $237 million.

Previous wording

Goodwill represents the excess of the purchase consideration over the fair value of net assets acquired in business combinations. Goodwill is not amortized but is tested for impairment on an annual basis and more frequently if impairment indicators are present. Impairment indicators may include experienced or expected operating cash-flow deterioration or losses, significant losses of membership, loss of state funding, loss of state contracts, and other factors. Goodwill is impaired if the carrying amount of a reporting unit exceeds its estimated fair value. This excess is recorded as an impairment loss and adjusted if necessary for the impact of tax-deductible goodwill. The loss recognized may not exceed the total goodwill allocated to the reporting unit.

Current wording

Goodwill represents the excess of the purchase consideration over the fair value of net assets acquired in business combinations. Goodwill is not amortized but is tested for impairment at the reporting unit level on an annual basis, and more frequently if impairment indicators are present. Impairment indicators may include declines, or expected declines, in operating performance or cash-flows, significant losses of membership, state funding, or state contracts, adverse regulatory changes, or other declines in market conditions, such as a decline in the company’s market capitalization. Goodwill is impaired if the carrying amount of a reporting unit exceeds its estimated fair value. This excess is recorded as an impairment loss and adjusted if necessary for the impact of tax-deductible goodwill. The loss recognized may not exceed the total goodwill allocated to the reporting unit.

Previous wording

During the COVID-19 pandemic, Medicaid enrollment across the country, as well as our enrollment, grew substantially compared to before the pandemic. Beginning April 1, 2023, broad-based Medicaid eligibility redeterminations commenced, and are now almost entirely completed. We lost approximately 675,000 members due to redeterminations. Periodic redeterminations on a state by state basis will now resume as before the pandemic. Actuarial assumptions related to the health acuity of remaining members may continue to be difficult to predict or may be inaccurate, resulting in inaccurate rates to be paid to health plans. Errors in our estimates related to redeterminations, and actuarial errors related to the acuity of Medicaid members, may impact our business, financial condition, cash flows, or results of operations.

Current wording

Following the end of the COVID-19 public health emergency, we lost approximately 675,000 members due to eligibility redeterminations. Periodic redeterminations on a state by state basis have now resumed as before the pandemic. Actuarial assumptions related to the health acuity of remaining members may continue to be difficult to predict or may be inaccurate, resulting in inaccurate rates to be paid to health plans. Errors in our estimates related to redeterminations, and actuarial errors related to the acuity of Medicaid members, may impact our business, financial condition, cash flows, or results of operations.

Previous wording

To coordinate care for those who qualify to receive both Medicare and Medicaid services (the “dual eligibles”), under the direction of CMS some states implemented demonstration pilot programs to integrate Medicare and Medicaid services for the dual eligibles. The health plans participating in such demonstrations are referred to as MMPs. Pursuant to the 2023 CMS Medicare Final Rule, which requires MMP plans to end no later than December 2025, the five states in which we operate MMPs – Illinois, Michigan, Ohio, South Carolina, and Texas – have filed transition plans with CMS to move to D-SNPs by January 1, 2026. Illinois and Ohio have included plans to transition to Fully Integrated D-SNPs. Michigan and South Carolina are electing to transition to Highly Integrated D-SNPs. Texas is allowing optionality between a Fully Integrated D-SNP and a Highly Integrated D-SNP. The RFP award for Illinois is still pending. The economic impact of such transitions to D-SNP on our premium revenue is uncertain.

Current wording

To coordinate care for those who qualify to receive both Medicare and Medicaid services (the “dual eligibles”), under the direction of CMS some states implemented demonstration pilot programs to integrate Medicare and Medicaid services for the dual eligibles. The health plans participating in such demonstrations are referred to as MMPs. Pursuant to the 2023 CMS Medicare Final Rule, which requires MMP plans to end no later than December 2025, the five states in which we operate MMPs – Illinois, Michigan, Ohio, South Carolina, and Texas – transitioned their current MMP contracts to integrated D-SNP contracts on January 1, 2026. The economic impact of such transitions to D-SNP on our premium revenues is uncertain.

Previous wording

Further, the Star Rating System utilized by CMS to evaluate Medicare plans may have a significant effect on our revenue, as higher-rated plans tend to experience increased enrollment and plans with a Star rating of 4.0 or higher are eligible for quality-based bonus payments. Those Medicare plans that achieve less than a 3.0 Star rating for either part C or D for three consecutive years are issued a notice of non-renewal of their contract for the following year. If we do not maintain our Star ratings above 3.0 or continue to improve our Star ratings, fail to meet or exceed our competitors’ Star ratings, or if quality-based bonus payments are reduced or eliminated, we may experience a negative impact on our revenues and the benefits that our plans can offer, which could materially and adversely affect the marketability of our plans, our membership levels, results of operations, financial condition, and cash flows. Similarly, if we fail to meet or exceed any performance standards imposed by state Medicaid programs in which we participate, we may not receive performance-based bonus payments, we may incur penalties, or we may lose our Medicaid contract which may also result in a loss to our Medicare contract if it is a HIDE or FIDE D-SNP.

Current wording

Further, the Star Rating System utilized by CMS to evaluate Medicare plans may have a significant effect on our revenue, as higher-rated plans tend to experience increased enrollment and plans with a Star rating of 4.0 or higher are eligible for quality-based bonus payments. Those Medicare plans that achieve less than a 3.0 Star rating for either part C or D for three consecutive years are issued a notice of non-renewal of their contract for the following year. If we do not maintain our Star ratings above 3.0 or continue to improve our Star ratings, fail to meet or exceed our competitors’ Star ratings, or if quality-based bonus payments are reduced or eliminated, we may experience a negative impact on our revenues and the benefits that our plans can offer, which could materially and adversely affect the marketability of our plans, our membership levels, results of operations, financial condition, or cash flows. Similarly, if we fail to meet or exceed any performance standards imposed by state Medicaid programs in which we participate, we may not receive performance-based bonus payments, we may incur penalties, or we may lose our Medicaid contract which may also result in a loss to our Medicare contract if it is a HIDE or FIDE D-SNP.

Previous wording

We are periodically subject to government audits, including CMS RADV audits of our Medicare D-SNP plans to validate diagnostic data, patient claims, and financial reporting. These audits could result in significant adjustments in payments made to our health plans, particularly if it is an audit which involves extrapolation, which could adversely affect our financial condition and results of operations. If errors are identified during a RADV audit, or it is otherwise determined that we fail to comply with applicable laws and regulations, we could be subject to fines, civil penalties or other sanctions, which could have a material adverse effect on our ability to participate in these programs, and on our financial condition, cash flows and results of operations. In addition, if a D-SNP or MMP plan pays minimum medical loss ratio (“MLR”) rebates for three consecutive years, such plan will become ineligible to enroll new members.

Current wording

We are periodically subject to government audits, including CMS RADV audits of our Medicare D-SNP plans to validate diagnostic data, patient claims, and financial reporting. These audits could result in significant adjustments in payments made to our health plans, particularly if it is an audit which involves extrapolation, which could adversely affect our financial condition and results of operations. If errors are identified during a RADV audit, or it is otherwise determined that we fail to comply with applicable laws and regulations, we could be subject to fines, civil penalties, or other sanctions, which could have a material adverse effect on our ability to participate in these programs, and on our financial condition, cash flows, or results of operations. In addition, if a D-SNP or MMP plan pays minimum medical loss ratio (“MLR”) rebates for three consecutive years, such plan will become ineligible to enroll new members.

Previous wording

We are a corporate parent holding company and hold most of our assets in, and conduct most of our operations through, our direct subsidiaries. As a holding company, our results of operations depend on the results of operations of our subsidiaries. Moreover, we are dependent on dividends or other intercompany transfers of funds from our subsidiaries to meet our debt service and other obligations. The ability of our subsidiaries to pay dividends or make other payments or advances to us depends on their operating results and is subject to applicable laws and restrictions contained in agreements governing the debt of such subsidiaries. In addition, our health plan subsidiaries are subject to laws and regulations that limit the amount of ordinary dividends and distributions that they can pay to us without prior approval of, or notification to, state regulators. In general, our health plans must give thirty days’ advance notice and the opportunity to disapprove “extraordinary” dividends to the respective state departments of insurance for amounts that exceed either (a) ten percent of surplus or net worth at the prior year end or (b) the net income for the prior year, depending on the respective state statute. The discretion of the state regulators, if any, in approving or disapproving a dividend is not clearly defined. Our health plans generally must provide notice to the applicable state regulator prior to paying a dividend or other distribution to us. Our parent company received $997 million and $705 million in dividends from our regulated health plan subsidiaries during 2024 and 2023, respectively. If the regulators were to deny or significantly restrict our subsidiaries’ requests to pay dividends to us, the funds available to our Company as a whole would be limited, which could have a material adverse effect on our business, financial condition, cash flows, or results of operations.

Current wording

We are a corporate parent holding company and hold most of our assets in, and conduct most of our operations through, our direct subsidiaries. As a holding company, our results of operations depend on the results of operations of our subsidiaries. Moreover, we are dependent on dividends or other intercompany transfers of funds from our subsidiaries to meet our debt service and other obligations. The ability of our subsidiaries to pay dividends or make other payments or advances to us depends on their operating results and is subject to applicable laws and restrictions contained in agreements governing the debt of such subsidiaries. In addition, our health plan subsidiaries are subject to laws and regulations that limit the amount of ordinary dividends and distributions that they can pay to us without prior approval of, or notification to, state regulators. In general, our health plans must give thirty days’ advance notice and the opportunity to disapprove “extraordinary” dividends to the respective state departments of insurance for amounts that exceed either (a) ten percent of surplus or net worth at the prior year end or (b) the net income for the prior year, depending on the respective state statute. The discretion of the state regulators in approving or disapproving a dividend is not clearly defined. Our health plans generally must provide notice to the applicable state regulator prior to paying a dividend or other distribution to us. Our parent company received $985 million and $997 million in dividends from our regulated health plan subsidiaries during 2025 and 2024, respectively. If the regulators were to deny or significantly restrict our subsidiaries’ requests to pay dividends to us, the funds available to our Company as a whole would be limited, which could have a material adverse effect on our business, financial condition, cash flows, or results of operations.

Previous wording

Because we receive payments from federal and state governmental agencies, we are subject to various laws commonly referred to as “fraud and abuse” laws, including federal and state anti-kickback statutes, prohibited referrals, and the federal False Claims Act, which permit agencies and enforcement authorities to institute a suit against us for violations and, in some cases, to seek treble damages, criminal and civil fines, penalties, and assessments. Violations of these laws can also result in exclusion, debarment, temporary or permanent suspension from participation in government healthcare programs, or the institution of corporate integrity agreements. Liability under such federal and state statutes and regulations may arise if we know, or it is determined that we should have known, that information we provide to form the basis for a claim for government payment is false or fraudulent.

Current wording

Because we receive payments from federal and state governmental agencies, we are subject to various laws commonly referred to as “fraud and abuse” laws, including federal and state anti-kickback statutes, prohibited referrals, and the federal False Claims Act, which permit agencies and enforcement authorities to institute a suit against us for purported violations and, in some cases, to seek treble damages, criminal and civil fines, penalties, and assessments. Violations of these laws can also result in exclusion, debarment, temporary or permanent suspension from participation in government healthcare programs, or the institution of corporate integrity agreements. Liability under such federal and state statutes and regulations may arise if we know, or it is determined that we should have known, that information we provide to form the basis for a claim for government payment is false or fraudulent, and some courts have permitted False Claims Act suits to proceed if the claimant was out of compliance with program requirements.

Previous wording

Fraud, waste and abuse prohibitions encompass a wide range of operating activities, including kickbacks or other inducements for referral of members or for the coverage of products (such as prescription drugs) by a plan, billing for unnecessary medical services by a provider, upcoding, payments made to excluded providers, improper marketing, and the violation of patient privacy rights. In particular, there has recently been increased scrutiny by the Department of Justice on health plans’ risk adjustment practices, particularly in the Medicare program. Companies involved in government healthcare programs such as Medicaid and Medicare are required to maintain compliance programs to detect and deter fraud, waste and abuse, and are often the subject of fraud, waste and abuse investigations and audits.

Current wording

Fraud, waste and abuse prohibitions encompass a wide range of operating activities, including kickbacks or other inducements for referral of members or for the coverage of products (such as prescription drugs) by a plan, billing for unnecessary medical services by a provider, up-coding, payments made to excluded providers, improper marketing, and the violation of patient privacy rights. Companies involved in public health care programs such as Medicaid and Medicare are required to maintain compliance programs to detect and deter fraud, waste, and abuse, and are often the subject of fraud, waste and abuse investigations and audits. The regulations and contractual requirements applicable to participants in these public-sector programs are complex and subject to change.

Previous wording

The federal government has taken the position that claims presented in violation of the federal anti-kickback statute may be considered a violation of the federal False Claims Act. In addition, under the federal civil monetary penalty statute, the U.S. Department of Health and Human Services’ Office of Inspector General has the authority to impose civil penalties against any person who, among other things, knowingly presents, or causes to be presented, certain false or otherwise improper claims. Qui tamactions under federal and state law are brought by a private individual, known as a relator, on behalf of the government. A relator who brings a successfulqui tam lawsuit can receive 15 to 30 percent of the damages the government recovers from the defendants, which damages are trebled under the False Claims Act. Because of these financial inducements offered to plaintiffs, qui tam actions have increased significantly in recent years, causing greater numbers of healthcare companies to incur the costs of having to defend false claims actions, many of which are spurious and without merit. In addition, meritorious false claims actions could result in fines, or debarment from the Medicare, Medicaid, or other state or federal healthcare programs. If we are subject to liability under aqui tam or other actions, our business, financial condition, cash flows, or results of operations could be adversely affected. Even if we are successful in defendingqui tam actions against us, the fact that these actions were filed against us, even if ultimately determined to be without merit, could result in expensive defense costs, and also could have an adverse impact on our reputation and our ability to obtain regulatory approval for acquisitions that we may pursue.

Current wording

The federal government has taken the position that claims presented in violation of the federal anti-kickback statute may be considered a violation of the federal False Claims Act. In addition, under the federal civil monetary penalty statute, the U.S. Department of Health and Human Services’ Office of Inspector General has the authority to impose civil penalties against any person who, among other things, knowingly presents, or causes to be presented, certain false or otherwise improper claims. Qui tamactions under federal and state law are brought by a private individual, known as a relator, on behalf of the government. A relator who brings a successfulqui tam lawsuit can receive 15 to 30 percent of the damages the government recovers from the defendants, which damages are trebled under the False Claims Act. Because of these financial inducements offered to plaintiffs, qui tam actions have increased significantly in recent years, causing greater numbers of healthcare companies to incur the costs of having to defend against false claims actions, including the costs associated with responding to exploratory Civil Investigative Demands brought by the government, many of which are spurious and without merit. In addition, false claims actions could result in fines or debarment from the Medicaid, Medicare, or other state or federal healthcare programs. If we are subject to liability under aqui tam or other actions, our business, financial condition, cash flows, or results of operations could be adversely affected. Even if we are successful in defendingqui tam actions against us, the fact that these actions were filed against us, even if ultimately determined to be without merit, could result in expensive defense costs, and also could have an adverse impact on our reputation and our ability to obtain regulatory approval for acquisitions that we may pursue.

Previous wording

Our use and disclosure of personally identifiable information and other non-public information, including protected health information, is subject to federal and state privacy and security regulations, and our failure or the failure of our vendors to comply with those regulations or to adequately secure the information we hold could adversely affect our business, results of operations, or financial condition.

Current wording

Our use and disclosure of personal information and other non-public information, including protected health information, is subject to federal and state laws, regulations, and requirements relating to the privacy, security, and processing of personal information, and any actual or perceived failure by us or our third-party service providers to comply with those ever-evolving regulations or to adequately secure the information we hold may result in significant liability, negative publicity, and/or an erosion of trust, which could materially adversely affect our business, results of operations, or financial condition.

Previous wording

HIPAA violations may result in significant civil or criminal penalties. HIPAA authorizes state attorneys general to file suit under HIPAA on behalf of state residents. Courts can award damages, costs, and attorneys’ fees related to violations of HIPAA in such cases. We have experienced HIPAA breaches in the past, including breaches affecting over 500 individuals.

Current wording

Entities that experience HIPAA violations as the result of a breach of unsecured PHI, a complaint about privacy practices or an audit by the HHS may be subject to civil monetary penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. In certain circumstances, entities or individuals may be subject to criminal penalties for HIPAA violations. HIPAA authorizes state Attorneys General to file suit under HIPAA on behalf of state residents. Courts can award damages, costs, and attorneys’ fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI.

Previous wording

Even when HIPAA and the GLBA do not apply, we are still subject to requirements imposed by U.S. states and the federal government. For example, the FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards.

Current wording

Even when HIPAA and the GLBA do not apply, we are still subject to requirements imposed by U.S. states and the federal government. For example, the FTC and state regulators enforce a variety of data privacy and security issues, such as promises made in privacy policies or a company’s data security measures failing to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities, which may be deemed as unfair or deceptive acts or practices in or affecting commerce in violation of the FTC Act or similar state laws. Individually identifiable health information is considered sensitive data that merits stronger safeguards.