Cigna Group

The laws and regulations governing our business continue to increase each year and are subject to frequent change. We are regulated by federal, state and international legislative bodies and agencies, which generally have discretion to issue regulations and interpret and enforce laws and rules. These regulations can vary significantly from jurisdiction to jurisdiction, and the interpretation of existing laws and rules also may change periodically. Domestic and international governments continue to enact and consider various legislative and regulatory proposals, which could materially impact the health care system. We expect continued legislative and regulatory debate of issues related to our businesses. As has become increasingly common with public policy reforms in the health services industry, executive, judicial or legislative intervention could alter, slow or eliminate the impact of any proposal following the related regulation's promulgation.

Many aspects of our business are directly regulated by federal and state laws and administrative agencies, such as HHS, CMS, the Internal Revenue Service ("IRS"), the U.S. Departments of Labor ("DOL") and Treasury, the Office of Personnel Management ("OPM"), the Federal Trade Commission ("FTC"), the SEC, the Office of the National Coordinator for Health Information Technology ("ONC"), state departments of insurance and state boards of pharmacy. Our business practices may also be shaped by enforcement actions of federal agencies, such as the Department of Justice ("DOJ"), state agencies, as well as judicial decisions.

In addition, aspects of our business are subject to indirect regulation. The self-funded benefit plans sponsored by our U.S. employer clients are regulated under federal law. These self-funded clients expect us to ensure that our administration of their plans complies with the regulatory requirements applicable to them.

Our business operations and the books and records of our regulated businesses are routinely subject to examination and audit at regular intervals by state insurance and HMO regulatory agencies, state boards of pharmacy, CMS, DOL, IRS, OPM and comparable international regulators to assess compliance with applicable laws and regulations. Our operations are also subject to non-routine examinations, audits and investigations by various state and federal regulatory agencies, generally as the result of a complaint. In addition, we may be implicated in investigations of our clients whose group benefit plans we administer on their behalf. As a result, we routinely receive subpoenas and other demands or requests for information from various state insurance and HMO regulatory agencies, state attorneys general, the HHS Office of Inspector General ("HHS-OIG"), the DOJ, the DOL and other state, federal and international authorities. We may also be called upon by members of the U.S. Congress to provide information, including testifying before Congressional committees and subcommittees, regarding certain of our business practices. If The Cigna Group is determined to have failed to comply with applicable laws or regulations, these examinations, audits, investigations, reviews, subpoenas and demands may:

•result in fines, penalties, injunctions, consent orders or other settlement agreements such as corporate integrity agreements or loss of licensure;

•suspend or exclude us from participation in government programs or limit our ability to sell or market our products;

•require changes in business practices;

•damage relationships with the agencies that regulate us and affect our ability to secure regulatory approvals necessary for the operation of our business; or

•damage our brand and reputation.

Our international subsidiaries are subject to regulations in international jurisdictions, including in certain cases many regulations similar to the federal and state regulations described below, which are complex and where foreign insurers may face more rigorous regulations than their domestic competitors and may also be affected by geopolitical developments or tensions.

The laws and regulations governing our business, as well as the related interpretations, are subject to frequent change and can be inconsistent or in conflict with each other. Changes in our business environment are likely to continue as elected and appointed officials at the national and state levels continue to propose and enact significant modifications to existing laws and regulations. Even where we believe that we are in compliance with the various laws and regulations, any enforcement actions by federal, state or international government officials alleging non-compliance with these rules and regulations could subject us to penalties or restructuring or reorganization of our business. For a discussion of the risks related to our compliance with these laws and regulations see the Risk Factors section located in Part I, Item 1A of this Form 10-K. Management continues to be actively engaged with regulators and policymakers with respect to legislation and rulemaking.

COVID-19-related Regulatory Actions

On May 11, 2023, the COVID-19 Public Health Emergency ("PHE") declared by the Secretary of HHS ended. Some of the legislative and regulatory flexibilities that the U.S. federal and state governments enacted in response to COVID-19 and its variants which were not affected by the end of the PHE were made permanent or were extended. Other legislative and regulatory flexibilities, such as required coverage of COVID-19 tests without cost sharing and certain Medicare and Medicaid waivers for health care providers, ended on May 11 or were set to expire within a certain period of time after the end of the PHE. The Consolidated Appropriations Act, 2023, also provided that states could restart Medicaid eligibility renewals and terminations for ineligible individuals. As a result, states resumed Medicaid redeterminations for the first time since the PHE began; these redeterminations are anticipated to continue through early spring 2024. While state approaches to redeterminations vary, under the redeterminations, many beneficiaries are no longer eligible for Medicaid. As a result, some of the beneficiaries determined to be ineligible for Medicaid sought or will seek alternate coverage in the individual marketplace.

The Patient Protection and Affordable Care Act

The Patient Protection and Affordable Care Act ("ACA") mandated broad changes to the U.S. health care system that affect insured and self-insured health benefit plans and pharmacy benefit managers. Our business model is impacted by the ACA, including our relationships with current and future producers and health care providers, products, service providers and technologies. The provisions of the ACA imposed, among other things, certain assessments on health insurers, created health insurance exchanges for individuals and small group employers to purchase insurance coverage and implemented minimum MLRs for our Cigna Healthcare business. Certain states have adopted MLR requirements applicable to our employer businesses that are more stringent than those established by the ACA. Other provisions of the ACA in effect include reduced Medicare Advantage payment rates, the requirement to cover preventive services with no enrollee cost-sharing, banning the use of lifetime and annual limits on the dollar amount of essential health benefits, increasing restrictions on rescinding coverage, extending coverage of dependents up to age 26, restrictions on differential pricing, enforcement mechanisms and rules related to health care fraud and abuse enforcement activities and certain pharmacy benefit transparency requirements. The employer mandate requires employers with 50 or more full-time employees to offer affordable health insurance that provides minimum value (each as defined under the ACA) to full-time employees and their dependents, including children up to age 26, or be subject to penalties based on employer size. The ACA also changed certain tax laws to effectively limit tax deductions for certain employee compensation paid by health insurers. In December 2019, the federal government repealed the non-deductible health insurance industry fee effective for 2021, as well as the enacted but never implemented 40% excise tax on certain employer-sponsored coverage (known as the "Cadillac Tax") and the medical device tax. In 2021, in response to the COVID-19 pandemic, the federal government temporarily expanded eligibility for ACA subsidies to higher-income people who did not otherwise qualify, increased ACA subsidies for lower-income people who already qualify for 2021 and 2022, provided subsidies for individuals who receive unemployment benefits in 2021 and prevented taxpayers who misestimated their income in 2020 from having to repay excess premium tax credits. The Inflation Reduction Act, which was signed into law in August 2022, extended the expanded and increased premium tax credits for individuals enrolled in ACA qualified health plans, through December 31, 2025.

Medicare and Medicaid Regulations

Through our subsidiaries, we offer individual and group Medicare Advantage, Medicare Prescription Drug and Medicare Supplement products. We also provide Medicare Part D-related products and services to other Medicare Part D sponsors, Medicare Advantage Prescription Drug Plans and employers and clients offering Medicare Part D benefits to Medicare Part D eligible beneficiaries, including those dually eligible for Medicare and Medicaid benefits ("dual-eligible"). As part of our Medicare Advantage and Medicare Part D business, we contract with CMS to provide services to Medicare beneficiaries. We offer dual-eligible products and participate in state Medicaid programs directly or indirectly through our clients who are Medicaid managed care contractors. We also perform certain Medicaid subrogation services and certain delegated services for clients, including utilization management, which are regulated by federal and state laws. Our dual-eligible products are regulated by CMS and state Medicaid agencies audit our performance to determine compliance with contracts and regulations. Our ability to obtain payment (and the determination of the amount of such payments), market to, enroll and retain customers and expand into new service areas is subject to compliance with CMS' numerous and complex regulations and requirements that are frequently modified and subject to administrative discretion, review and enforcement.

CMS evaluates Medicare Advantage plans and Part D plans under its "Star Rating" system. The Star Rating system considers various measures adopted by CMS, including, for example, quality of care, preventive services, chronic illness management, coverage determinations and appeals and customer satisfaction. A plan's Star Rating affects its image in the market and plans that perform very well are able to offer enhanced benefits and market more effectively and for longer periods of time than other plans. Medicare Advantage plans' quality-bonus payments are determined by the Star Rating, with plans receiving a rating of four or more stars eligible for such payments. The Star Rating system is subject to change annually by CMS, which may make it more difficult to achieve and maintain four stars or greater. For example, beginning with Star Ratings for payment year 2024, CMS will place more emphasis on patient experience survey-based measures which could reduce Star Ratings predictability year over year. Additionally, as a result of the COVID-19 pandemic's impact on 2020 care patterns and utilization, CMS finalized rules applying relief to Medicare Advantage and Part D Plan Star Ratings for payment year 2023 by utilizing the higher of the payment year 2023 or 2022 measure level Star Ratings.

CMS provides risk-adjusted premium payments for Medicare Advantage plans based on our customer demographics and medical diagnoses, which may change from period to period based on the underlying health of our customers. Under this model, rates paid to Medicare Advantage plans are based on actuarially determined bids, which include a process whereby our prospective payments are based on our estimated cost of providing standard Medicare-covered benefits to an enrollee with a "national average risk profile." That baseline payment amount is adjusted to reflect the health status of our enrolled membership. Under the risk-adjustment methodology, Medicare Advantage plans must collect and submit the necessary diagnosis code information from hospital inpatient, hospital outpatient and physician providers to CMS within prescribed deadlines. We generally rely on providers to appropriately document their claims and other submissions with appropriate diagnoses from which we extract hierarchical condition codes to submit to CMS as the basis for our payments received under the actuarial risk-adjustment model. The CMS risk-adjustment model uses the diagnosis data to calculate the risk-adjusted premium payment to the plans. These adjustments are generally settled semi-annually with CMS. The final adjustment is generally settled with CMS in the year following the contract year. CMS may conduct audits to validate risk-adjustment data submitted by health plans.

On January 30, 2023, CMS issued the Final Rule titled "Medicare and Medicaid Programs; Policy and Technical Changes to the Medicare Advantage, Medicare Prescription Drug Benefit, Program for All-inclusive Care for the Elderly ("PACE"), Medicaid Fee-For-Service, and Medicaid Managed Care Programs for Years 2020 and 2021," effective April 3, 2023. The Final Rule addresses CMS's audit methodology and related policies for the Risk Adjustment Data Validation ("RADV"). Although CMS did not specify their sampling or extrapolation methodology the rule did codify that CMS will use a statistically valid method for sampling and extrapolation of error rates and the decision not to apply a fee for service adjuster when determining RADV audit findings. CMS will not apply extrapolation to RADV audits until the 2018 payment year with payment recoveries for those RADV audits expected in 2025. Audits for payment years prior to 2018 are not subject to extrapolation. RADV audits for our contract years 2011 through 2015 are currently awaiting CMS finalization. The Company is not currently subject to RADV audits for the 2018 and subsequent payment years. The Final Rule is currently being challenged in federal district court.

Coverage of prescription drugs under Medicare Part D is also regulated by CMS and our contracts with CMS contain provisions for risk sharing and certain payments for prescription drug costs for which we are not at risk. These provisions affect our ultimate payments from CMS. For example, premiums from CMS are subject to risk corridor payments that compare costs targeted in our annual bids with actual prescription costs, limited to actual costs that would have been incurred under the standard coverage as defined by CMS. Variances exceeding certain thresholds may result in CMS making additional payments to us or require us to refund to CMS a portion of the payments we received.

We expect CMS, HHS-OIG, DOJ and other federal agencies to continue to closely scrutinize each component of the Medicare Advantage program and modify the terms and requirements of the program through rulemaking or enforcement activities. The Company continues to believe that further regulation or changes to existing regulations could result in disruption in the marketplace including the potential for some combination of degraded plan benefits and higher monthly premiums. Noncompliance with these laws and regulations may result in significant consequences, including fines and penalties, enrollment sanctions, exclusion from the Medicare and Medicaid programs, limitations on expansion and criminal penalties.

In January 2024, we entered into a definitive agreement to sell the Medicare Advantage, Medicare Stand-Alone Prescription Drug Plans, Medicare and Other Supplemental Benefits and CareAllies businesses to HCSC for $3.3 billion cash, subject to applicable regulatory approvals and other customary closing conditions.

False Claims Act and Anti-Kickback Laws

Our products and services are also subject to the federal False Claims Act (the "False Claims Act"), state false claims acts and federal and state anti-kickback laws. Additionally, the federal government has made investigating and prosecuting health care fraud, waste and abuse a priority. Fraud, waste and abuse prohibitions encompass a wide range of activities, including kickbacks in return for customer referrals, billing for unnecessary medical services, upcoding and improper marketing. The regulations and contractual requirements in this area are complex, frequently modified and subject to administrative discretion and judicial interpretation.

False Claims Act and Related Criminal Provisions. The False Claims Act imposes civil penalties on any person who knowingly, as defined by the statute, makes, conspires to make, or causes to be made false claims, records, or statements, or fails to return known overpayments, in connection with reimbursement by federal government programs such as Medicare and Medicaid. Private individuals have brought and may bringqui tam or "whistleblower" suits under the False Claims Act, which authorizes the payment of a portion of any recovery to the individual bringing suit. The ACA amended the federal anti-kickback laws to state any claim submitted to a federal or state health care program that violates the anti-kickback laws is also a false claim under the False Claims Act. The False Claims Act generally provides for the imposition of civil penalties and for treble damages, creating the possibility of substantial financial liabilities. Criminal statutes similar to the False Claims Act provide that if a corporation is convicted of presenting a claim or making a statement it knows to be false, fictitious or fraudulent to any federal agency, the corporation may be fined. Conviction under these statutes may also result in exclusion from participation in federal and state health care programs. Many states have also enacted laws similar to the False Claims Act, some of which may include criminal penalties, substantial fines and treble damages.

Anti-Kickback and Referral Laws. Subject to certain exceptions and "safe harbors," the federal anti-kickback statute generally prohibits, among other things, knowingly and willfully paying, receiving or offering any payment or other remuneration to induce a person to purchase, lease, order or arrange for items (including prescription drugs) or services reimbursable in whole or in part under Medicare, Medicaid or another federal health care program. Many states have similar laws, some of which are not limited to items or services paid for with government funds. Sanctions for violating these federal and state anti-kickback laws may include criminal and civil fines and exclusion from participation in federal and state health care programs.

Anti-kickback laws have been cited as a partial basis, along with state consumer protection laws described below, for investigations and multi-state settlements relating to financial incentives provided by drug manufacturers to pharmacies or payors in connection with "product conversion" or promotion programs. Other anti-kickback and referral laws may also be applicable including criminal and civil laws restricting illegal kickbacks and conflicts of interest in connection with plans governed by the Employee Retirement Income Security Act of 1974, as amended ("ERISA"), the federal "Stark Law," and various state anti-kickback restrictions.

In November 2020, HHS and HHS-OIG released a final rule that eliminates an anti-kickback regulatory safe harbor protection for price concessions, including rebates, that are offered by pharmaceutical manufacturers to plan sponsors or pharmacy benefit managers under the Medicare Part D program. The final rule creates two new safe harbors: (i) for price reductions by manufacturers to plan sponsors under Medicare Part D and Medicaid managed care organizations that are reflected at the time of dispense and (ii) for fixed-fee service arrangements between manufacturers and pharmacy benefit managers. The effective date of the final rule has been postponed to 2032.

Federal Civil Monetary Penalties Law. The federal civil monetary penalty statute provides for civil monetary penalties against any person who gives something of value to a Medicare or Medicaid program beneficiary that the person knows or should know is likely to influence the beneficiary's selection of a particular provider for Medicare or Medicaid items or services. Under this law, our wholly-owned home delivery pharmacies, specialty pharmacies and home health providers are restricted from offering certain items of value to influence a Medicare or Medicaid patient's use of services. The ACA also includes several civil monetary provisions, such as penalties for the failure to report and return a known overpayment and failure to grant timely access to the HHS-OIG under certain circumstances.

Federal and State Oversight of Government-Sponsored Health Care Programs

Participation in government-sponsored health care programs subjects us to a variety of federal and state laws and regulations and risks associated with audits conducted under these programs. These audits may occur years after the provision of services. Risks include potential fines and penalties, restrictions on our ability to participate or expand our presence in certain programs and restrictions on marketing our plans. For example, with respect to our Medicare Advantage business, CMS and the HHS-OIG perform audits to determine a health plan's compliance with federal regulations and contractual obligations, including program audits and RADV audits, which focus on compliance with proper coding practices. Certain of our contracts are currently subject to audits by CMS and the HHS-OIG, including RADV audits. CMS has announced that its goal is to subject all Medicare Advantage contracts to either a comprehensive or a targeted RADV audit for each contract year. The DOJ is also currently conducting industry-wide investigations of the risk adjustment data submission practices and business processes of a number of Medicare Advantage organizations. The Cigna Group was a party to such an investigation, which was settled during the third quarter of 2023. Please see “—Medicare and Medicaid Regulations” for further information related to the settlement and the related CIA.

For our Medicare Part D business, compliance with certain contractual provisions and regulatory requirements is subject to review by Recovery Audit Contractor audits in which third-party contractors conduct post-payment reviews on a contingency fee basis to detect and correct improper payments.

Government Procurement Regulations

We have a contract with the U.S. DoD, which subjects us to applicable Federal Acquisition Regulations ("FAR") and the DoD FAR Supplement, which govern federal government contracts. Further, there are other federal and state laws applicable to our DoD arrangement and our arrangements with other clients that may be subject to government procurement regulations. In addition, certain of our clients participate as contracting carriers in the Federal Employees Health Benefits Program administered by the OPM, which includes various pharmacy benefit management standards.

Employee Retirement Income Security Act

Our domestic subsidiaries sell most of their products and services to sponsors of employee benefit plans that are governed by ERISA. ERISA is a complex set of federal laws and regulations enforced by the IRS and the DOL, as well as the courts. ERISA regulates certain aspects of the relationship between us, the employers that maintain employee welfare benefit plans subject to ERISA and the participants in such plans. Certain of our domestic subsidiaries are also subject to requirements imposed by ERISA affecting claim payment and appeals procedures for individual health insurance and insured and self-insured group health plans and for the insured plans we administer. Certain of our domestic subsidiaries also may contractually agree to comply with these requirements on behalf of the self-insured plans they administer. We believe the conduct of our pharmacy benefit management business is not generally subject to the fiduciary obligations of ERISA. However, there can be no assurances that the DOL may not assert that pharmacy benefit managers are fiduciaries. From time to time, states have considered and, in limited cases, enacted legislation to declare a pharmacy benefit manager or health benefit manager a fiduciary with respect to its clients.

Plans subject to ERISA may also be subject to state laws and the legal question of whether and to what extent ERISA preempts a state law is likely to continue to be a subject for interpretation by the courts for years to come.

Privacy, Security and Data Standards Regulations

Numerous federal, state and foreign laws and regulations govern the creation, collection, dissemination, receipt, maintenance, protection, use, transmission, disclosure, privacy, confidentiality, security, availability, integrity, processing, and disposal (collectively "Processing") of protected health information ("PHI") and other personally identifiable information ("PII"). Many of our activities involve Processing of PHI and PII. In addition, we use aggregated and/or anonymized data for our own research and analysis purposes and, in some cases, when permitted, provide access to such anonymized data, or analytics created from such data, to third parties. We may also use such information to create analytic models designed to predict, and potentially improve, outcomes and patient care. We are also subject to the Payment Card Industry Data Security Standard, a set of requirements designed to help ensure that entities that Process credit card information maintain a secure environment.

On the federal level we are subject to a number of sector specific regulations. The federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH") and the 21st Century Cures Act, Public Law 116-321, and as implemented by the regulation (collectively "HIPAA") impose requirements on covered entities and business associates that address the privacy and security of PHI. In the conduct of the majority of our business we may be either a covered entity or business associate, and we may also be held liable under HIPAA for violations by our vendors, including downstream services providers, that are business associates. HIPAA imposes contracting requirements and requires breach notifications. HIPAA also regulates permissible uses and disclosures of PHI; for example, HHS has issued guidance regarding tracking technologies that are used to collect and analyze information about how users interact with covered entities’ and business associates’ websites and mobile applications. Violations of HIPAA may result in enforcement actions, civil and criminal penalties and settlement, resolution, and monitoring agreements. Further, state attorneys general may bring civil actions seeking either injunctions or damages in response to violations of HIPAA that threaten the privacy of state residents and may negotiate settlements for related cases on behalf of their respective residents. There can be no assurance that we will not be the subject of an investigation, audit or compliance review regarding our compliance with HIPAA. HIPAA does not preempt more stringent state health privacy laws and regulations, which may protect the health information of certain individuals, such as minors, and certain types of sensitive health information, such as transgender care, HIV/AIDS status, reproductive health information, genetic information, and mental and behavioral health.

Other federal and state laws that restrict the use and protect the privacy and security of PII exempt data and/or entities subject to HIPAA, but several states, such as, Nevada, and Connecticut, have recently enacted privacy laws to protect consumer data and require consent for the collection, use, and sharing of consumer health data. These laws may impact our businesses and practices where data collected is outside the reach of HIPAA.

The federal government has also enacted final regulations on interoperability and information blocking to support the seamless and secure access, exchange and use of electronic health information by and between patients, enrollees and entities such as payors and health care providers. These regulations apply to a variety of entities and generally require significant enhancements to information technology and data governance practices. The regulations impact how industry participants, including us, comply with disclosure requirements and share information with individuals and other health care organizations.

The federal Gramm-Leach-Bliley Act ("GLBA") and its implementing regulations generally place restrictions on the disclosure of nonpublic information to nonaffiliated third parties, and requires financial institutions, including insurers, to provide customers with notice regarding how their nonpublic personal information is used, including an opportunity to "opt out" of certain disclosures. State departments of insurance and certain federal agencies adopted implementing regulations as required by federal law. In 2023, significant changes to GLBA's "Safeguards Rule" went into effect, substantially raising the GLBA standards for security, which are anticipated to be adopted by some state DOIs (as defined herein).

Additionally, under Section 5 of the Federal Trade Commission Act ("FTC Act"), the FTC has jurisdiction over certain privacy and security practices deemed unfair and deceptive acts and practices in or affecting commerce. The FTC has charged companies with violating this act based on failures to appropriately and transparently safeguard personal information, respect consumers' privacy rights, based on disclosures of health and personal information to third parties, the failure to limit third-party use of health information, the failure to implement policies and procedures to prevent the improper or unauthorized disclosure of health information, and the failure to provide notice and obtain consent before the use and disclosure of health information for advertising. In addition to the FTC Act, the FTC also enforces other federal laws relating to consumers' privacy and security. The FTC has also been active with respect to companies' use of big data and AI, specifically ensuring fair and equitable use of these tools, and the FTC has named AI as an area of enforcement focus. State legislatures and regulators are similarly interested in the use of AI, particularly as it is used in modeling, and a handful of states have either passed legislation or issued regulatory guidance concerning AI. Additionally, the National Association of Insurance Commissioners ("NAIC"), an organization of state insurance regulators, recently established the Innovation, Cybersecurity and Technology Committee to provide a forum for regulators to learn, monitor and confer on emerging technology issues, including, among others, cybersecurity and AI. State Departments of Insurance ("DOI") and other state government agencies and legislatures are increasingly aware and active in providing guidance in the AI space.

In July 2023, the SEC approved final rules relating to cybersecurity disclosure obligations on reporting companies and such new disclosures can be found beginning on page 45.

The Cybersecurity Information Sharing Act of 2015 ("CISA") encouraged organizations to share cyber threat indicators with the federal government and, among other things, directed HHS to develop a set of voluntary cybersecurity best practices for organizations in the health care industry. States have also begun to issue regulations specifically related to cybersecurity, which may differ or conflict from state to state. In October 2017, the NAIC adopted the Insurance Data Security Model Law that creates rules for insurers and other covered entities addressing data security, investigation and notification of breaches. This includes maintaining an information security program based on ongoing risk assessment, overseeing third-party service providers, investigating data breaches and notifying regulators of a cybersecurity event. As the model law is intended to serve as model legislation only, states will need to enact legislation for the model law to become mandatory and enforceable. To date, twenty-one states have enacted some form of the model law.

Over the past several years, the federal government has increasingly focused on the cybersecurity requirements applicable to government contractors, including enhanced guidance and regulation. These include compliance with the Privacy Act of 1974, the Defense Federal Acquisition Regulation Supplement ("DFARS") cybersecurity requirements, the Cybersecurity Maturity Model Certification ("CMMC") (going into effect over the next four years and based on the National Institute of Standards and Technology ("NIST") standards), the Federal Information Security Modernization Act ("FISMA") and the White House's 2021 Executive Order on Improving the Nation's Cybersecurity.

Some local authorities are increasingly focused on protecting individuals from data or identity theft and every state has data security laws and regulations requiring, among other things, certain minimum data security standards and security breach notifications that may apply to us in certain circumstances, as well as certain limitations on access to and use of PII. These laws and regulations include state general data breach laws, which exist in all fifty states and protect PII generally, as well as DOI cybersecurity laws, applicable to various DOI licensees, such as insurers, PBMs and TPAs. Many states also have their own sector-specific laws regarding the Processing of PII which may apply to us as well. In the past few years, fourteen states have adopted their own comprehensive consumer privacy statutes and many more states are considering doing so. Generally, the statutes exempt data and/or entities regulated by GLBA and/or HIPAA but are, in varying respects, applicable to other data we collect, such as PII provided by website visitors, and in California, employees and business partners. Additionally, we anticipate federal and state legislators and regulators will continue to enact legislation related to privacy and cybersecurity.

In addition, international laws, rules and regulations governing the use and disclosure of PII can be more stringent than those in the United States, and they vary from jurisdiction to jurisdiction. The European Union's General Data Protection Regulation ("GDPR"), which became effective May 2018, enhanced or created obligations regarding the handling of PII relating to European residents (such as regarding notices, data protection impact assessments and individual rights) and provides for greater penalties for noncompliance than the previous European Directive or laws. In addition, many countries outside of Europe where we conduct business have implemented or may implement data protection laws and regulations, some of which include requirements modeled after those in the GDPR. Some non-U.S. jurisdictions are also instituting data residency regulations requiring that data be maintained within the respective jurisdiction or otherwise restricting transfer of personal data across borders unless specified regulatory requirements are met.

See Part I, Item 1A, "Risk Factors" for a discussion of the risks related to compliance with privacy and security regulations.

Consumer Protection Laws

We engage in direct-to-consumer activities and are increasingly offering mobile and web-based solutions to our customers. We are therefore subject to federal and state regulations applicable to electronic communications and other consumer protection laws and regulations, such as the Telephone Consumer Protection Act and the CAN-SPAM Act. With the ever increasing reliance and demand by consumers on using their mobile devices for convenient communications, we face increased risk under these laws. The FTC is also increasingly exercising its enforcement authority in the areas of consumer privacy and data security, with a focus on web-based, mobile data and "big data." Federal consumer protection laws may also apply in some instances to privacy and security practices related to PII.

State and federal policymakers have taken actions intended to increase transparency and predictability of health care costs for consumers. For example, the Transparency in Coverage rule issued in October 2020 by the HHS, the DOL and the Department of the Treasury now requires most group health plans and health insurance issuers in the individual and group markets to publicly disclose price and cost-sharing information for all items and services to participants and enrollees. Health plans and health insurers must publicly disclose (i) in-network provider negotiated rates, and (ii) historical out-of-network allowed amounts and billed charges. The rule also required public disclosure of in-network negotiated rates and historical net prices for all covered prescription drugs, but the departments announced in August 2021 guidance that they will indefinitely defer enforcement of the rule's requirement that plans and issuers publish machine-readable files relating to prescription drug pricing pending further rulemaking. In 2023, we were required to make available to members personalized cost-sharing information for 500 covered health care items and services. In 2024, this cost-sharing information requirement will expand to all items and services, including prescription drugs. Insurers offering group or individual health insurance coverage may receive credit in their MLR calculations for certain savings they share with enrollees that result from the enrollees shopping for, and receiving care from, lower-cost, higher-value providers.

Congress also passed the Consolidated Appropriations Act, 2021 ("CAA"), which included a number of transparency requirements on plans and issuers that are duplicative or overlap with the Transparency in Coverage rule issued by the departments. The indefinite enforcement deferral of the prescription drug pricing file under the Transparency in Coverage rule is, in part, due to the subsequent enactment of the CAA, which requires plans to report information regarding prescription drug spending to federal regulators beginning in 2022. The CAA also included the No Surprises Act, which prohibits health care providers, in certain situations, from balance billing the patient and requires that they work directly with insurers to agree on out-of-network reimbursement, including utilizing an independent dispute resolution ("IDR") process outlined in the act. CMS regulations and guidance implementing the IDR process have been subject to a significant amount of provider-initiated litigation, and CMS has had to temporarily suspend federal IDR functions, including dispute initiation. Many states already have addressed balance billing, or surprise medical bills. These laws and regulations vary in their approach, resulting in different impacts on the health care system as a whole. In 2021, HHS, DOL and the Department of the Treasury, announced interim final rules ("IFR") intended to implement provisions of the No Surprises Act, certain provisions of which were vacated by a Federal district court in February and July 2022. The departments then issued a final rule on August 26, 2022, finalizing disclosure requirements relating to information that group health plans and health insurance issuers offering group or individual health insurance coverage must share about the Qualifying Payment Amount ("QPA"), which the departments have stated is generally based on the median contracted rate for a qualified IDR item or service, and requirements related to the consideration of information when a certified IDR entity makes a payment determination under the federal IDR process. In September and October 2023, the Departments announced proposed rules that outlined fees established for the federal IDR process and that would set forth new requirements relating to the disclosure of information that group health plans and health insurance issuers offering group or individual health insurance coverage must include along with an initial payment or notice of denial for payment for certain items and services subject to the surprise billing protections. The October 2023 proposed rule would also amend requirements related to the open negotiation period before the federal IDR process, the initiation of the federal IDR process, federal IDR dispute eligibility review, and the payment and collection of administrative fees and certified IDR entity fees.

Additionally, most states have consumer protection laws that have been the basis for investigations and multi-state settlements relating to financial incentives provided by drug manufacturers to retail pharmacies in connection with product conversion programs. Such statutes have also been cited as the basis for claims or investigations by state attorneys general relative to privacy and data security.

Office of Foreign Assets Control Sanctions and Anti-Money Laundering

We are also subject to regulation by the Office of Foreign Assets Control of the U.S. Department of the Treasury, which administers and enforces economic and trade sanctions against targeted foreign jurisdictions and regimes based on U.S. foreign policy and national security goals. Certain of our products are subject to the Department of the Treasury anti-money laundering regulations under the Bank Secrecy Act. In addition, we are subject to similar regulations in non-U.S. jurisdictions in which we operate.

Corporate Practice of Medicine and Other Laws

Many states in which our subsidiaries operate limit the practice of medicine to licensed individuals or professional organizations comprised of licensed individuals, and business corporations generally may not exercise control over the medical decisions of physicians. Statutes and regulations relating to the practice of medicine, fee-splitting between physicians and referral sources and similar issues vary widely from state to state. Under management agreements between certain of our subsidiaries and physician-owned professional groups, these groups retain sole responsibility for all medical decisions, as well as for hiring and managing physicians and other licensed health care providers, developing operating policies and procedures, implementing professional standards and controls and maintaining malpractice insurance. We believe that our health services operations comply with applicable state statutes regarding corporate practice of medicine, fee-splitting and similar issues. However, any enforcement actions by governmental officials alleging noncompliance with these statutes could subject us to penalties or restructuring or reorganization of our business.

Utilization Management Laws

State legislatures have begun to propose and enact laws exempting certain providers from pre-authorization requirements of insurers. These exemptions reduce the ability for insurers and medical management entities to review services for medical necessity if the provider meets the law's established thresholds for approval rates in the preceding six months. The inability to apply pre-authorization requirements could lead to increased costs to plan issuers by way of the provision of unnecessary services. States are also standardizing the process for, and restricting the use of, utilization management rules and shortening the time frames within which prescription drug prior authorization determinations must be made. Even where states do not regulate pharmacy benefit or utilization management companies directly, these laws will apply to many of our clients, including managed care organizations and health insurers.

Laws and Legislation Affecting Pharmacy Benefit Plan Design, Administration and Pharmacy Network Access

Some states have enacted laws that prohibit managed care plan sponsors from implementing certain restrictive benefit plan design features, and many states have laws or have introduced legislation to regulate various aspects of managed care plans, including provisions relating to the pharmacy benefit. For example, some states, under so-called "freedom of choice" legislation, provide that customers of the plan may not be required to use network providers, but must instead be provided with benefits even if they choose to use non-network providers. Some states have also enacted legislation that can negatively impact the use of cost-saving network configurations for plan sponsors, such as limiting the implementation of pharmacy benefit designs and reimbursement structures that leverage affiliate pharmacies to reduce costs. Other states have enacted legislation purporting to prohibit health plans from offering customers financial incentives for use of home delivery pharmacies. Medicare and some states have issued guidance and regulations that limit our ability to fill or refill prescriptions electronically submitted by a physician to our home delivery pharmacy without first obtaining consent from the patient. Such restrictions generate additional costs and limit our ability to maximize efficiencies, which could otherwise be gained through the electronic prescription and automatic refill processes. Legislation has been introduced in some states to prohibit or restrict therapeutic intervention, or to require coverage of all Food and Drug Administration approved drugs. Other states mandate coverage of certain benefits or conditions, and require health plan coverage of specific drugs if deemed medically necessary by the prescribing physician.

Additionally, Medicare Part D and a majority of states now have laws, regulations or some form of legislation affecting our ability, or our clients' ability, to limit access to a pharmacy provider network or remove a provider from a network. Such laws, regulations or legislation may require us or our clients to admit any retail pharmacy or provider willing to meet the plan's terms and conditions for network participation ("any willing provider") or may direct that a provider may not be removed from a network except in compliance with certain procedures ("due process").

Certain states have laws prohibiting certain pharmacy benefit management clients from imposing additional copayments, deductibles, limitations on benefits, or other conditions on covered individuals utilizing a retail pharmacy when the same conditions are not otherwise imposed on covered individuals utilizing home delivery pharmacies. However, the laws require the retail pharmacy to agree to the same reimbursement amounts and terms and conditions as are imposed on the home delivery pharmacies. An increase in the number of prescriptions filled at retail pharmacies may have a negative impact on the number of prescriptions filled through home delivery.

Pharmacy Benefit Manager and Drug Pricing Regulation

Our pharmacy benefit management services are subject to numerous laws and regulations. These laws and regulations govern, and proposed legislation and regulations may govern, critical practices, including: disclosure, receipt and retention of rebates and other payments received from pharmaceutical manufacturers; certain pharmacy contracting practices including disclosure of cost information to customers; the receipt and retention of transmission fees from contracted pharmacies; performance-based price concessions; pharmacy price concessions to drug prices at the point of sale; audits of contracted pharmacies; use of, administration of, or changes to drug formularies, the use and disclosure of maximum allowable cost ("MAC") pricing, or clinical programs; "most favored nation" pricing, which provides that a pharmacy participating in a specific government program must give the program the best price the pharmacy makes available to any third-party plan; disclosure of data to third parties; drug utilization management practices; the level of duty a pharmacy benefit manager owes its clients or customers; configuration of pharmacy networks; the operations of our subsidiary pharmacies; referrals to affiliated pharmacies; disclosure of negotiated provider reimbursement rates; disclosure of negotiated drug rebates, calculation of certain customer cost-share for prescription drug claims; pricing that includes differential or spread (i.e., a difference between the drug price charged to the plan sponsor by a pharmacy benefit manager and the price paid by the manager to the dispensing provider); disclosure of fees associated with administrative service agreements and patient care programs that are attributable to customers' drug utilization; utilization management; and registration or licensing of pharmacy benefit managers.

We expect federal and state governments to continue to prioritize means of addressing out-of-pocket costs for consumers, particularly related to prescription drug costs. Recently enacted legislation, such as the Inflation Reduction Act, which changed Medicare Part B beneficiary coinsurance for certain drugs and imposed caps on out-of-pocket prescription drug costs in Medicare Part D, and other policy proposals and regulations, such as proposed legislation aimed at providing transparency with respect to pharmacy benefit managers, vary broadly in their approaches to achieve that goal. Additionally, proposals at the federal and state levels consider increased regulation of pharmacy benefit managers and health plans as a means to limit consumer out-of-pocket costs, including: proposing to limit the use of various pharmacy benefit management tools; mandating the treatment of fees, discounts or financing mechanisms that otherwise are set in private contractual terms; increasing supply chain transparency; expanding regulatory requirements or definitions of fiduciaries; or 29 mandating plan benefit designs that cap consumer out-of-pocket expense. The NAIC has also proposed laws intended to protect consumer drug benefits and has examined regulatory approaches to pharmacy benefit manager business practices.

Some states have enacted statutes regulating the use of MAC pricing. These statutes, referred to as "MAC Transparency Laws," generally require pharmacy benefit managers to disclose specific information related to MAC pricing to pharmacies and provide certain appeal rights for pharmacies. MAC Transparency Laws also restrict the application of MAC and may require operational changes to maintain compliance with the law. Some states have also enacted laws regulating pharmacy pricing and protecting the profitability of pharmacies for dispensing certain MAC-priced drugs. Some states have enacted laws requiring that the customer cost-share for a prescription drug claim not exceed certain price points, such as the pharmacy's usual and customary charge or its contracted reimbursement for the drug. In a recent Supreme Court decision, the Court found that certain MAC Transparency Laws may be applied by states to ERISA plans in addition to health plans regulated by the applicable state. Following this decision, state legislatures and regulators have sought to extend their oversight authority of self-funded ERISA plans to pharmacy benefit management functions and pharmacy benefit plan designs beyond MAC pricing.

The Medicaid Drug Rebate Program requires participating drug manufacturers to report certain information and pay rebates on drugs reimbursed through state Medicaid programs, in accordance with applicable law and regulation. We negotiate rebates with drug manufacturers and, in certain circumstances, sell services to drug manufacturers. Investigations are being and have been conducted by certain government entities involving manufacturer calculation and reporting with respect to rebates paid by the manufacturers to the Medicaid programs. Our PBM is not responsible for such calculations, reports or payments. There can be no assurance that our ability to negotiate rebates with, or sell services to, drug manufacturers will not be unfavorably affected by investigations or regulations in the future.

Pharmacy Regulation

Our home delivery and specialty pharmacies also subject us to extensive federal, state and local regulation. The practice of pharmacy is generally regulated at the state level by state boards of pharmacy, though our pharmacies are subject to laws described above under the headings "Privacy, Security and Data Standards Regulations" and "Consumer Protection Laws." We are licensed to do business as a pharmacy in the states in which our pharmacies are located and the health care professionals that we employ are also licensed by, and subject to, the laws and regulations of state boards of pharmacy and other governmental authorities. Most of the states into which we deliver pharmaceuticals have laws that require out-of-state home delivery pharmacies to register with, or be licensed by, the board of pharmacy or a similar regulatory body in the state. These states generally permit the pharmacy to follow the laws of the state where the pharmacy is located, although some states require compliance with certain laws in that state as it impacts or relates to drugs distributed or dispensed into that state.

Our various pharmacy facilities also provide services under certain Medicare and state Medicaid programs. Participation in these programs requires our pharmacies to comply with the applicable Medicare and Medicaid provider rules and regulations, and exposes the pharmacies to various changes the federal and state governments may impose regarding reimbursement methodologies, the submission of claims and amounts to be paid to participating providers under these programs. In addition, several of our pharmacy facilities are participating providers under Medicare Part D and are required to adhere to certain requirements applicable to Medicare Part D. Additionally, we are subject to CMS rules regarding the administration of our Medicare plans and pricing between our plans and related parties, including our pharmacy business.

Other statutes and regulations affect our home delivery and specialty pharmacy operations, including the federal and state anti-kickback laws, federal and state false claims acts and the federal civil monetary penalty law described above. Federal and state statutes and regulations govern the labeling, packaging, repackaging, compounding, storing, holding, disposal, distribution, advertising, misbranding, adulteration, transfer, handling and security of prescription drugs and the dispensing of prescription, over-the-counter, hazardous and controlled substances and certain of our pharmacies must register with the U.S. Drug Enforcement Administration, the U.S. Food and Drug Administration and individual state controlled substance authorities. The FTC requires mail order sellers of goods generally to engage in truthful advertising, to stock a reasonable supply of the product to be sold, to fill mail orders within thirty days and to provide clients with refunds when appropriate. The United States Postal Service also has significant statutory authority to restrict the delivery of drugs and medicines through the mail. Violations of pharmacy laws and regulations may result in warning letters, civil and criminal penalties, seizures, suspension, termination or revocation of licenses and registrations, restrictions on facilities or operations, and other enforcement actions.

Financial Reporting, Internal Control and Corporate Governance

Regulators closely monitor the financial condition of licensed insurance companies and HMOs. States regulate the form and content of statutory financial statements, the type and concentration of permitted investments and corporate governance over financial reporting. Our insurance and HMO subsidiaries are required to file periodic financial reports and schedules with regulators in most of the jurisdictions in which they do business as well as annual financial statements audited by independent registered public accounting firms. Certain insurance and HMO subsidiaries are required to file an annual report of internal control over financial reporting with most jurisdictions in which they do business. Insurance and HMO subsidiaries' operations and financial statements are subject to examination by regulators. Many states have expanded regulations relating to corporate governance and internal control activities of insurance and HMO subsidiaries as a result of model regulations adopted by the NAIC with elements similar to corporate governance and risk oversight disclosure requirements under federal securities laws.

Guaranty Associations, Indemnity Funds, Risk Pools and Administrative Funds

Most states and certain non-U.S. jurisdictions require insurance companies to support guaranty associations or indemnity funds that are established to pay claims on behalf of insolvent insurance companies. Some states have similar laws relating to HMOs and other payors, such as consumer operated and oriented plans (co-ops) established under the ACA. In the United States, these associations levy assessments on member insurers licensed in a particular state to pay such claims. Certain states require HMOs to participate in guaranty funds, special risk pools and administrative funds. For additional information about guaranty funds and other assessments, see Note 24 to the Consolidated Financial Statements.

Certain states continue to require health insurers and HMOs to participate in assigned risk plans, joint underwriting authorities, pools or other residual market mechanisms to cover risks not acceptable under normal underwriting standards, although some states have eliminated these requirements as a result of the ACA.

Solvency and Capital Requirements

Many states have adopted some form of the NAIC model solvency-related laws and risk-based capital ("RBC") rules for life and health insurance companies and HMOs. The RBC rules recommend a minimum level of capital depending on the types and quality of investments held, the types of business written and the types of liabilities incurred. If the ratio of the insurer's adjusted surplus to its RBC falls below statutorily required minimums, the insurer could be subject to regulatory actions ranging from increased scrutiny to conservatorship.

In addition, various non-U.S. jurisdictions prescribe minimum surplus requirements that are based upon solvency, liquidity and reserve coverage measures. Our HMOs and life and health insurance subsidiaries, as well as non-U.S. insurance subsidiaries, are compliant with applicable RBC and non-U.S. surplus rules.

The Risk Management and Own Risk and Solvency Assessment Model Act ("ORSA"), adopted by the NAIC, provides requirements and principles for maintaining a group solvency assessment and a risk management framework and reflects a broader approach to U.S. insurance regulation. ORSA includes a requirement to file an annual ORSA Summary Report in the lead state of domicile. To date, an overwhelming majority of the states have adopted the same or similar versions of ORSA. We file our ORSA report annually as required.

Holding Company Laws

Our domestic insurance companies and certain of our HMOs are subject to state laws regulating subsidiaries of insurance holding companies. Under such laws, certain dividends, distributions and other transactions between an insurance company or an HMO subsidiary and its affiliates may require notification to, or approval by, one or more state insurance commissioners. In addition, the holding company acts of states in which our subsidiaries are domiciled restrict the ability of any person to obtain control of an insurance company or HMO subsidiary without prior regulatory approval. State holding company laws and regulations also subject our insurance companies and certain HMO subsidiaries to additional regulatory scrutiny related to their oversight of affiliates performing regulated services on behalf of the insurance company or HMO and require the Company to file an annual Enterprise Risk Report, which summarizes material risks that could pose enterprise risk to the insurance company subsidiaries.

Marketing, Advertising and Products

In most states, our insurance companies and HMO subsidiaries are required to certify compliance with applicable advertising regulations on an annual basis. Our insurance companies and HMO subsidiaries are also required by most states to file and secure regulatory approval of products prior to the marketing, advertising and sale of such products. Additionally, our Medicare Advantage and Medicare Part D plans must follow certain federal marketing and communications regulations. In April 2023, CMS issued a final rule revising regulations governing marketing by Medicare Advantage and Medicare Part D plans. Among other things, the final rule requires enrollees to be notified of their ability to opt out of phone calls regarding Medicare Advantage and Part D marketing, requires agents to explain the effect of an enrollee’s enrollment choice on their current coverage, simplifies plan comparisons by requiring medical benefits to be listed in a specific order at the top of a plan’s Summary of Benefits, requires Medicare Advantage organizations and Part D sponsors to have an oversight plan that monitors activities of agents and brokers and to report noncompliance to CMS, and limits the time a potential enrollee may be contacted about Medicare plan options to 12 months after the enrollee first asked for information.

Licensing and Registration Requirements

Our insurance companies and HMO subsidiaries must be licensed by the jurisdictions in which they conduct business. Additionally, certain subsidiaries contract to provide claim administration, utilization management and other related services for the administration of self-insured benefit plans. These subsidiaries may be subject to state third-party administration and other licensing requirements and regulation, as well as third-party accreditation requirements.

We have received full accreditation for URAC Pharmacy Benefit Management Standards version 3.1, which includes quality standards for drug utilization management, and select subsidiaries have received full accreditation for URAC Health Utilization Management version 7.4, which includes quality standards for medical utilization management.

Certain states have adopted pharmacy benefit management registration, licensure or disclosure laws. In addition to registration laws, some states have adopted legislation mandating disclosure of various aspects of our financial practices, including those concerning pharmaceutical company revenue, as well as prescribing processes for prescription switching programs and client and provider audit terms.

Our international subsidiaries are often required to be licensed when entering new markets or starting new operations in certain jurisdictions. The licensure requirements for these subsidiaries vary by country and are subject to change.

International Regulations

Our operations outside of the United States expose us to laws of multiple jurisdictions and the rules and regulations of various governing bodies and regulators, including those related to the provision of insurance, financial and other disclosures, the provision of health care-related services, corporate governance, privacy, data protection, data mining, data transfer, intellectual property, labor and employment, consumer protection, direct-to-consumer communications activities, tax, anti-corruption and anti-money laundering. Foreign laws and rules may include requirements that are different from, or more stringent than, similar requirements in the United States.

Our operations in countries outside of the United States:

•are subject to local regulations of the jurisdictions where we operate;

•in some cases, are subject to regulations in the jurisdictions where customers reside; and

•in all cases, are subject to the Foreign Corrupt Practices Act ("FCPA").

Anti-money laundering requirements in countries where we do business also may impose obligations to collect certain information about each customer at time of sale or to risk rank each customer to determine possible future money laundering risk.

The FCPA prohibits offering, promising, providing or authorizing others to give anything of value to a foreign government official or employee to obtain or retain business or otherwise secure a business advantage. Outside of the United States, we may interact with government officials in several different capacities: as regulators of our insurance business; as clients or partners who are state-owned or partially state-owned; as health care providers who are employed by the government; as hospitals that are state-owned; and as officials issuing permits in connection with real estate transactions. Violations of the FCPA and other anti-corruption laws may result in severe criminal and civil sanctions as well as other penalties, and the SEC and DOJ have increased their enforcement activities with respect to FCPA. The UK Bribery Act of 2010 applies to all companies with a nexus to the United Kingdom. Other countries in which we do business also have anti-corruption laws to which we are subject. As international regulators often share information, any voluntary disclosures of violations may be shared with authorities in other countries, thus potentially exposing companies to liability and potential penalties in multiple jurisdictions.