What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-02-23 compared with 2022-02-24 · 128 added, 135 removed, 327 unchanged (45% of the section changed)

As a large global health services company operating in a complex industry, we encounter a variety of risks and uncertainties, which could have a material adverse effect on our business, liquidity, results of operations, financial condition or the trading price of our securities.

As a large global health company operating in a complex industry, we encounter a variety of risks and uncertainties, which could have a material adverse effect on our business, liquidity, results of operations, financial condition or the trading price of our securities.

You should carefully consider each of the risks and uncertainties discussed below, together with other information contained in this Form 10-K, including MD&A.

45 unchanged sentences

Our failure to anticipate or appropriately adapt to changes in the industry could negatively impact our competitive position and adversely affect our business and results of operations.

The scale, scope and duration of the ongoing COVID-19 pandemic continues to be unknown and the overall impact on our business, operating results, cash flows or financial condition has been and may continue to be material.

The COVID-19 pandemic has adversely affected, and is continuing to affect, global economies, financial markets and the overall environment for our business, and the extent to which it may impact our future results of operations and overall financial performance remains uncertain.

While vaccination rates continue to rise, the COVID-19 pandemic, including vaccination efficacy, the implementation of and reaction to vaccination and testing mandates and the occurrence of new variants (including the delta and omicron variants), could continue to effect such economies and financial markets as well as the health and availability of our workforce.

As a result, we may experience new disruptions to our business operations and our business could be adversely affected further, directly or indirectly, by the ongoing pandemic.

National, state and local governments in affected regions have implemented and may continue to implement varying safety precautions, including quarantines, border closures, increased border controls, travel restrictions, shelter-in-place orders and shutdowns, business closures, cancellations of public gatherings and other measures.

The COVID-19 pandemic has in some instances, and may continue to, heighten the potential adverse effects on our business, operating results, cash flows or financial condition as described below or in other risk factors within this section of the Form 10-K including, but not limited to, the likelihood of and impact from:

• unfavorable economic conditions on our clients and customers (both employers and individuals), health care and pharmacy providers, pharmaceutical manufacturers and third-party vendors, as well as federal and state entities and programs;

• changes in medical claims submission and processing patterns or procedures;

changes in customer base and product mix;

changes in utilization of prescription drugs, medical or other covered items or services, including increased behavioral health services utilization;

changes in medical cost trends;

changes in our health management practices;

and the introduction of new benefits and products causing actual claims to exceed our estimates;

• changes in health care utilization patterns, provider billing practices and other external events that we cannot forecast or project and over which we have little or no control impacting our ability to accurately predict, price for and manage health care costs and ultimately our profitability, including impacts from care deferral on, among other things, risk adjustment revenue and acuity of future care;

• increased costs or reductions in revenue, including costs for COVID-19-related care, testing and treatment;

vaccine and other coverage mandates;

and support for employees, clients, customers and providers;

• significant disruptions in service within our operations or among our key suppliers or other third parties, including delivery delays and other supply chain impacts and decreased worker productivity, increased worker attrition and operational and sales disruptions, including as a result of remote working arrangements, increased medical, emergency or other leave, quarantines, government actions or restrictions, including as it relates to vaccination mandates;

• compliance with substantial government regulation, including privacy and security requirements associated with providing telehealth and remote care options and new laws or regulations or changes in existing laws or regulations, such as vaccine, testing and coverage mandates and premium deferrals, which laws or regulations may vary significantly by jurisdiction;

• prioritization of matters relating to COVID-19 resulting in delays in responsiveness by regulatory agencies and other third parties in matters arising in the ordinary course of business;

• cyberattacks or other privacy or data security incidents, including as a result of the transition to a remote work environment by substantially all of our workforce and the workforces of third parties with whom we contract;

• significant shifts in the structure of the industry which could alter dynamics and, if we fail to adapt, negatively impact our business;

• risks inherent in foreign operations, including political, legal, operational, regulatory, economic and other risks;

• economic and market conditions affecting the value of our financial instruments and the value of particular assets and liabilities;

• fluctuations in equity market prices, interest rates and credit spreads limiting our ability to raise or deploy capital and affecting our overall liquidity.

Additionally, if we do not respond appropriately to the pandemic, or if our clients or customers do not perceive our response to be adequate, we could suffer damage to our reputation, which could adversely affect our business.

We believe COVID-19 and its variants' adverse impact on our business, operating results, cash flows or financial condition will be driven primarily by the severity and duration of the pandemic, including the impact of the breadth and timing of implementation and the efficacy and costs of vaccination programs, the pandemic's continued impact on our employees, clients, customers, suppliers and partners, as well as the U.S.

and global economies and the continued actions taken by governmental authorities and other third parties in response to the pandemic.

Those primary drivers are largely beyond our knowledge and control, and may be more adverse than our current expectations.

Given these uncertainties, we cannot estimate the full impact COVID-19 will have on our business, operating results, cash flows or financial condition, but the adverse impact could be material.

Our failure to compete effectively, to differentiate our products and services from those of our competitors and maintain or increase market share could materially adversely affect our results of operations, financial position and cash flows.

Our failure to compete effectively, to differentiate our products and services from those of our competitors and maintain or increase market share, including maintaining or increasing enrollments in businesses providing health benefits, could materially adversely affect our results of operations, financial position and cash flows.

We operate in a highly competitive environment and an industry subject to significant market pressures brought about by customer and client needs, legislative and regulatory developments and other market factors.

2 unchanged sentences

Our Express Scripts client contracts generally have three-year terms and may be subject to periodic renegotiation of pricing terms based on market factors.

As described in greater detail in the description of our business in Item 1 of this Form 10-K, one of our key clients in the Evernorth segment is the Department of Defense.

As described in greater detail in the description of our business in Item 1 of this Form 10-K, one of our key clients in the Evernorth Health Services segment is the United States Department of Defense.

If one or more of our large clients terminates or does not renew a contract for any reason, including as a result of being acquired, or if the provisions of a contract with a large client are modified, renewed or otherwise changed with terms less favorable to us, our results of operations could be adversely affected and we could experience a negative reaction in the investment community resulting in decreases in the trading price of our securities or other adverse effects.

5 unchanged sentences

We face price competition and other pressures that could compress our margins or result in premiums that are insufficient to cover the cost of services delivered to our customers.

While we compete on the basis of many service and quality-related factors, we expect that price will continue to be a significant basis of competition.

While we compete on the basis of many service and quality-related factors, we expect that price will continue to be a significant basis of competition and we may face pressure to contain premium rates.

Our client contracts are subject to negotiation as clients seek to contain their costs, including by reducing benefits offered.

1 unchanged sentence

Clients can easily move between our competitors and us.

Our clients are well informed and typically have knowledgeable consultants that seek competing bids from our competitors before contract renewal.

Our clients are well informed and typically have knowledgeable consultants that seek competing bids from our competitors before

contract renewal.

In addition, as brokers and benefit consultants seek to enhance their revenue streams, they look to take on services that we typically provide.

6 unchanged sentences

Although we base the premiums we charge and our Medicare Advantage, IFP and Medicare Part D rates and bids on our estimate of future health care costs over the contract period, actual costs may exceed what we estimate in setting premiums.

Our health care costs also are affected by external events that we cannot forecast or project and over which we have little or no control, including changes in regulations, as well as provider billing practices and changes in customers' health care utilization patterns, which may, among other things, impact our ability to appropriately document their health conditions.

Our participation in health insurance exchanges through our IFP offerings involves uncertainties associated with mix and volume of business and could adversely affect our results of operations, financial position and cash flows.

Our health care costs also are affected by external events that we cannot forecast or project and over which we have little or no control, including changes in laws and regulations, as well as pandemics, costly new treatments, new treatment guidelines, provider billing practices, inflation and changes in customers' health care utilization patterns, which may, among other things, impact our ability to appropriately document their health conditions.

Our profitability depends, in part, on our ability to accurately predict, price for and effectively manage future health care costs.

3 unchanged sentences

Our inability to maintain positive trends, or failure to identify and implement new ways to mitigate pricing pressures, could negatively impact our ability to attract or retain clients or sell additional services, which could negatively impact our margins and have a material adverse effect on our business and results of operations.

In addition, legislative reforms related to rebates, reporting, and other activities may adversely affect our competitive position, cash flows, financial condition and results of operations.

The reserves we hold for expected medical claims are based on estimates that involve an extensive degree of judgment and are inherently variable.

If actual claims exceed our estimates, our operating results could be materially adversely affected, and our ability to take timely corrective actions to contain future costs may be limited.

We maintain and record medical claims reserves on our balance sheet for estimated future payments.

We maintain and record medical claims reserves in our Consolidated Balance Sheets for estimated future payments.

Our estimates of health care costs payable are based on a number of factors, including historical claim experience, but this estimation process requires extensive judgment.

3 unchanged sentences

Because establishing reserves is an inherently uncertain process involving estimates of future losses, there can be no certainty that ultimate losses will not exceed existing reserves which may adversely affect our results of operations, financial position and cash flows.

If we fail to develop and maintain satisfactory relationships with physicians, hospitals and other health service providers and with producers and consultants, our business and results of operations may be adversely affected.

We contract with or employ physicians, hospitals and other health service providers and facilities to provide health services to our customers.

If we fail to develop and maintain satisfactory relationships with health care payers, physicians, hospitals and other health service providers and with producers and consultants, our business and results of operations may be adversely affected.

We contract with or employ physicians, hospitals and other health service providers and facilities to provide health services to our customers, as well as health care payers (as a service provider to those payers).

Our results of operations are substantially dependent on our ability to contract for these services at competitive prices.

1 unchanged sentence

In some markets, certain providers, particularly hospitals, physician/hospital organizations and multispecialty physician groups, may have significant or controlling market positions that could result in a diminished bargaining position for us.

If providers refuse to contract with us, use their market position to negotiate more favorable contracts or place us at a competitive disadvantage, our ability to market products or to be profitable in those areas could be materially adversely affected.

If providers refuse to contract with us, use

their market position to negotiate more favorable contracts or place us at a competitive disadvantage, our ability to market products or to be profitable in those areas could be materially adversely affected.

Additionally, certain regulations may impact our ability to obtain competitive prices.

27 unchanged sentences

The entry of one or more additional large pharmacy chains into the pharmacy benefit management business, the consolidation of existing pharmacy chains or increased leverage or market share by the largest pharmacy providers could increase the likelihood of negative changes in our relationship with such pharmacies.

Changes in the overall composition of our pharmacy networks, or reduced pharmacy access under our networks, could have a negative impact on our claims volume or our competitiveness in the marketplace, which could cause us to fall short of certain guarantees in our contracts with clients or otherwise impair our business or results of operations.

Changes in the overall composition of our pharmacy networks, or reduced pharmacy access under our networks, could have a negative

impact on our claims volume or our competitiveness in the marketplace, which could cause us to fall short of certain guarantees in our contracts with clients or otherwise impair our business or results of operations.

Changes in drug pricing or industry pricing benchmarks could materially impact our financial performance.

1 unchanged sentence

If these benchmarks are no longer published by third parties, we, or our contractual partners, adopt other pricing benchmarks for establishing prices within the industry, legislation or regulation requires the use of other pricing benchmarks, or future changes in drug prices substantially deviate from our expectations, the short- or long-term impacts may have a material adverse effect on our business and results of operations.

Our business depends on our ability to effectively invest in, implement improvements to and properly maintain the uninterrupted operation, availability and data integrity of our information technology and other business systems.

Our business is highly dependent on maintaining effective information systems as well as the integrity and timeliness of the data we use to serve our customers and health care providers and to operate our business.

If our data were found to be inaccurate or unreliable due to fraud or other error, or if we, or any of the third-party providers we engage, were to fail to maintain information systems and data integrity effectively, we could experience operational disruptions that may impact our clients, customers and health care providers and hinder our ability to provide or establish appropriate pricing for products and services, retain and attract clients and customers, establish reserves and report financial results timely and accurately and maintain regulatory compliance, among other things.

Our information technology strategy and execution are critical to our continued success.

We must continue to invest in and maintain long-term solutions that will enable us to anticipate customer needs and expectations, enhance the customer experience, act as a differentiator in the market and protect against cybersecurity risks and threats or other events that could disrupt our information technology systems such as man-made or natural disasters (including those as a result of climate change).

Our success is dependent, in large part, on maintaining the effectiveness of existing technology systems and continuing to deliver and enhance technology systems that support our business processes in a cost-efficient and resource-efficient manner.

Increasing regulatory and legislative changes will place additional demands on our infrastructure that could have a direct impact on resources available for other projects tied to our strategic initiatives.

In addition, recent trends toward greater consumer engagement in health care require new and enhanced technologies, including more sophisticated applications for mobile devices.

Connectivity among technologies is becoming increasingly important.

We must also develop new systems to meet current market standards and keep pace with continuing changes in information processing technology, evolving industry and regulatory standards and customer needs.

Failure to do so may present compliance challenges and impede our ability to deliver services in a competitive manner.

Further, because system development projects are long-term in nature, they may be more costly than expected to complete and may not deliver the expected benefits upon completion.

Our failure to effectively invest in, implement improvements to and properly maintain the uninterrupted operation, availability and data integrity of our systems could adversely affect our results of operations, financial position and cash flow.

As a large global health company, we and our vendors are subject to cyberattacks or other privacy or data security incidents.

If we are unable to prevent or contain the effects of any such attacks, or fail to ensure vendors do the same, we may suffer exposure to substantial liability, reputational harm, loss of revenue or other damages.

Our business depends on our clients' and customers' willingness to entrust us with their health-related and other sensitive personal information, including information that is subject to privacy, security or data breach notification laws.

Computer systems may be vulnerable to physical break-ins, computer viruses or malware, programming errors, attacks by third parties or similar disruptive problems.

We have been, and will likely continue to be, the target of computer viruses or other malicious codes, unauthorized access, cyberattacks or other computer-related penetrations.

There have been, and will likely continue to be, large scale cyberattacks within the health service industry.

Additionally, hardware, software or applications we develop or procure from third parties may contain defects in design, manufacturer defects or other problems that could unexpectedly compromise information technology.

Human or technological error has and could in the future result in, for example, unauthorized access to, acquisition, disclosure, modification, misuse, loss, or destruction of company, customer, or other third-party data or systems;

theft of sensitive, regulated, or confidential data including personal information and intellectual property;

the loss of access to critical data or systems through ransomware, destructive attacks or other means;

and business delays, service or system disruptions or denials of service.

As we increase the amount of personal information that we store and share digitally, our exposure to unauthorized disclosures, data privacy and related cybersecurity risks increases, including the risk of undetected attacks, damage, loss or unauthorized access or acquisition or misappropriation of proprietary or personal information, and the cost of attempting to protect against these risks also increases.

The health care data ecosystem is complex and requires data exchange with vendors, business partners, the government and others.

If disruptions, disclosures, security incidents or breaches are not detected quickly, their effect could be compounded.

We have dedicated significant resources to implement security technologies, processes and procedures to protect consumer identity and provide

employee awareness training around phishing, malware and other cyber risks;

however, there are no assurances that such measures will be effective against all types of security incidents or breaches.

Further, we depend on many vendors to support and assist our business, which requires such vendors to generate, store and use sensitive personal information.

Cybersecurity threats are rapidly evolving and those threats and the means for obtaining access to our proprietary systems are becoming increasingly sophisticated.

Cyberattacks can originate from a wide variety of sources including terrorists, nation states, internal actors, or third parties, such as external service providers, and the techniques used change frequently or are often not recognized until after they have been launched.

For example, there has been an increase in new financial fraud schemes akin to ransomware attacks on large companies whereby a cybercriminal installs a type of malicious software, or malware, that prevents a user or enterprise from accessing computer files, systems or networks and demands payment of a ransom for their return.

Those parties may also attempt to fraudulently induce employees, customers or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers.

In addition, while we have certain standards for all vendors that provide us services, our vendors, and in turn, their own service providers, may become subject to the same types of security breaches.

Finally, our offices may be vulnerable to security incidents or security attacks, acts of vandalism or theft, misplaced or lost data, human error or similar events that could negatively affect our systems and our customers' and clients' data.

The costs to eliminate or address security threats and vulnerabilities before or after a cyber-incident could be significant.

Our remediation efforts may not be successful and could result in interruptions, delays, or cessation of service and loss of existing or potential customers.

In addition, the unauthorized access, acquisition, use, disclosure or dissemination of sensitive personal information, proprietary information or confidential information about us, our customers or other third parties could expose our customers' and their private information to the risk of financial or medical identity theft.

Unauthorized access, acquisition, use, disclosure or dissemination of confidential and proprietary information about our business and strategy could also negatively affect the achievement of our strategic initiatives.

Such events could cause us to breach our contractual obligations and violate applicable laws.

These events would negatively affect our ability to compete, our reputation, customer base and revenues and expose us to mandatory disclosure requirements, government investigations, litigation and other enforcement proceedings, material fines, penalties or remediation costs and compensatory, special, punitive and statutory damages, consent orders and other adverse actions, any of which could adversely affect our business, results of operations, financial condition or liquidity.

While vaccination rates continue to rise, the COVID-19 pandemic, including vaccination efficacy, the implementation of and reaction to vaccination and testing mandates and the occurrence of new variants, could continue to effect such economies and financial markets as well as the health and availability of our workforce.

As a result, we may experience new disruptions to our business operations and our business could be adversely affected further, directly or indirectly, by the ongoing pandemic.

• changes in medical claims submission and processing patterns or procedures;

changes in customer base and product mix;

changes in utilization of prescription drugs, medical or other covered items or services, including increased behavioral health services utilization;

changes in medical cost trends;

changes in our health management practices;

and the introduction of new benefits and products causing actual claims to exceed our estimates;

• increased costs or reductions in revenue, including costs for COVID-19-related care, testing and treatment;

vaccine and other coverage mandates;

and support for employees, clients, customers and providers;

• cyberattacks or other privacy or data security incidents, including as a result of the transition to a hybrid work environment by substantially all of our workforce and the workforces of third parties with whom we contract;

• significant shifts in the structure of the industry which could alter dynamics and, if we fail to adapt, negatively impact our business;

• risks inherent in foreign operations, including political, legal, operational, regulatory, economic and other risks;

• economic and market conditions affecting the value of our financial instruments and the value of particular assets and liabilities;

• fluctuations in equity market prices, interest rates and credit spreads limiting our ability to raise or deploy capital and affecting our overall liquidity.

and global economies and the continued actions taken by governmental authorities and other third parties in response to the pandemic.

Those primary drivers are largely beyond our knowledge and control, and may be more adverse than our current expectations.

Given these uncertainties, we cannot estimate the full impact COVID-19 will have on our business, operating results, cash flows or financial condition, but the adverse impact could be material.

As a global company, we face political, legal, operational, regulatory, economic and other risks that present challenges and could negatively affect our multinational operations or our long-term growth.

18 unchanged sentences

Any one of these challenges could negatively affect our operations or long-term growth.

For example, if we're unable to divest our South Korean business, we will continue to be exposed to potential losses resulting from economic and regulatory changes in that country and the geopolitical climate in the Korean Peninsula, as well as foreign currency movements affecting the South Korean currency, that, due to the current concentration of our international business, could have a significant impact on our consolidated financial results.

International operations also require us to devote significant resources to implement controls and systems in new markets to comply

with, and to ensure that our vendors and partners comply with, U.S.

International operations also require us to devote significant resources to implement controls and systems in new markets to comply with, and to ensure that our vendors and partners comply with, U.S.

and foreign laws prohibiting bribery, corruption and money laundering, in addition to other regulations regarding, among other things, our products, direct-to-consumer communications, customer privacy, data protection and data residency.

1 unchanged sentence

Our success depends, in part, on our ability to anticipate these risks and manage these challenges.

Our failure to comply with laws and regulations governing our conduct outside the United States or to establish constructive relations with non-U.S.

regulators could have a material adverse effect on our business, results of operations, financial condition, liquidity and long-term growth.

Our failure to comply with laws and regulations governing our conduct outside of the United States or to establish constructive relations with non-U.S.

could have a material adverse effect on our business, results of operations, financial condition, liquidity and long-term growth.

Strategic transactions involve risks and we may not realize the expected benefits because of integration difficulties, underperformance relative to our expectations and other challenges.

31 unchanged sentences

We also rely on the internal controls and financial reporting controls of joint venture entities and other entities in which we invest and their failure to maintain effectiveness or comply with applicable standards may materially and adversely affect us.

Ineffective internal controls could also cause investors to lose confidence in our reported financial information that could

negatively impact the trading price of our securities and our access to capital.

Ineffective internal controls could also cause investors to lose confidence in our reported financial information that could negatively impact the trading price of our securities and our access to capital.

We are dependent on the success of our relationships with third parties for various services and functions.

2 unchanged sentences

Even though contracts are intended to provide certain protections, we have limited control over the actions of third parties.

For example, noncompliance with any privacy or security laws and regulations, any security breach involving one of our third-party vendors or a dispute between us and a third-party vendor related to our arrangement could have a material adverse effect on our business, results of operations, financial condition, liquidity and reputation.

For example, noncompliance with any privacy or security laws and regulations,

any security breach involving one of our third-party vendors or a dispute between us and a third-party vendor related to our arrangement could have a material adverse effect on our business, results of operations, financial condition, liquidity and reputation.

Outsourcing also may require us to change our existing operations, adopt new processes for managing these service providers or redistribute responsibilities to realize the potential productivity and operational efficiencies.

7 unchanged sentences

In some instances, our ability to provide services or products (including processing and dispensing prescriptions) depends on the availability of services and products provided by suppliers, providers, pharmaceutical manufacturers, vendors or shipping carriers.

A disruption, or threat of disruption, in our supply chain, including as a result of the COVID-19 pandemic, or inability to access or deliver products that meet requisite quality safety standards in a timely and efficient manner could adversely impact our business.

A disruption, or threat of disruption, in our supply chain, including as a result of the COVID-19 pandemic, or inability to access or deliver products that meet requisite quality safety standards and patient needs in a timely and efficient manner could adversely impact our business.

Increasing natural disasters in connection with climate change could also be a direct threat to us and our third-party vendors, service providers or other stakeholders.

7 unchanged sentences

Our failure to implement adequate business continuity and disaster recovery strategies could significantly reduce our ability to provide products and services to our customers and clients, which could have material adverse effects on our business and results of operations.

If our data were found to be inaccurate or unreliable

due to fraud or other error, or if we, or any of the third-party providers we engage, were to fail to maintain information systems and data integrity effectively, we could experience operational disruptions that may impact our clients, customers and health care providers and hinder our ability to provide or establish appropriate pricing for products and services, retain and attract clients and customers, establish reserves and report financial results timely and accurately and maintain regulatory compliance, among other things.

Our information technology strategy and execution are critical to our continued success.

In addition, recent trends toward greater consumer engagement in health care require new and enhanced technologies, including more sophisticated applications for mobile devices.

Connectivity among technologies is becoming increasingly important.

Failure to do so may present compliance challenges and impede our ability to deliver services in a competitive manner.

Further, because system development projects are long-term in nature, they may be more costly than expected to complete and may not deliver the expected benefits upon completion.

As a large health services company, we and our vendors are subject to cyberattacks or other privacy or data security incidents.

Computer systems may be vulnerable to physical break-ins, computer viruses or malware, programming errors, attacks by third parties or similar disruptive problems.

We have been, and will likely continue to be, the target of computer viruses or other malicious codes, unauthorized access, cyberattacks or other computer-related penetrations.

There have been, and will likely continue to be, large scale cyberattacks within the health service industry.

Human or technological error has and could in the future result in, for example, unauthorized access to, disclosure, modification, misuse, loss, or destruction of company, customer, or other third-party data or systems;

theft of sensitive, regulated, or confidential data including personal information and intellectual property;

the loss of access to critical data or systems through ransomware, destructive attacks or other means;

and business delays, service or system disruptions or denials of service.

As we increase the amount of personal information that we store and share digitally, our exposure to unintended disclosures, data security and related cybersecurity risks increases, including the risk of undetected attacks, damage, loss or unauthorized access or misappropriation of proprietary or personal information, and the cost of attempting to protect against these risks also increases.

The healthcare data ecosystem is complex and requires data exchange with vendors, business partners, the government and others.

If disruptions, disclosures or breaches are not detected quickly, their effect could be compounded.

We have dedicated significant resources to implement security technologies, processes and procedures to protect consumer identity and provide employee awareness training around phishing, malware and other cyber risks;

however, there are no assurances that such measures will be effective against all types of breaches.

Further, we depend on many vendors to support and assist our business, which requires such vendors to generate, store and use sensitive personal information.

Cybersecurity threats are rapidly evolving and those threats and the means for obtaining access to our proprietary systems are becoming increasingly sophisticated.

The costs to eliminate or address security threats and vulnerabilities before or after a cyber-incident could be significant.

Our remediation efforts may not be successful and could result in interruptions, delays, or cessation of service and loss of existing or potential customers.

In addition, the unauthorized dissemination of sensitive personal information, proprietary information or confidential information about us, our customers or other third parties could expose our customers' and their private information to the risk of financial or medical identity theft.

Unauthorized dissemination of confidential and proprietary information about our business and strategy could also negatively affect the achievement of our strategic initiatives.

Such events could cause us to breach our contractual obligations and violate applicable laws.

These events would negatively affect our ability to compete, others' trust in us, our reputation, customer base and revenues and expose us to mandatory disclosure requirements, government investigations, litigation and other enforcement proceedings, material fines, penalties or remediation costs and compensatory, special, punitive and statutory damages, consent orders and other adverse actions, any of which could adversely affect our business, results of operations, financial condition or liquidity.

In managing medical practices and operating pharmacies, onsite clinics and other types of medical facilities, we may be subject to additional liability that could result in significant time and expense.

2 unchanged sentences

As such, we may be subject to liability for certain acts, omissions, or injuries caused by our employees or agents, or occurring at one of these practices, pharmacies or clinics.

The defense of any actions may require the diversion of personnel and other resources and the incurrence of significant costs that could have a material adverse effect on our business, results of operations, financial condition, liquidity and reputation.

The defense of any actions may require diverting personnel and other resources and incurring significant costs that could have a material adverse effect on our business, results of operations, financial condition, liquidity and reputation.

Legal and Compliance Risks

5 unchanged sentences

There are currently pending, and in the future there will likely be, legislative or regulatory proposals which seek to manage the health services industry, including managing prescription drug costs and health records, as well as regulating drug distribution.

We expect federal and state governments to continue to enact and seriously consider many broad-based legislative and regulatory proposals that will or could materially impact various aspects of the health care and related benefits system.

Federal and state governments have enacted and we expect federal and state governments to continue to enact and seriously consider many broad-based legislative and regulatory proposals that will or could materially impact various aspects of the health care and related benefits system.

In addition, changes to government policies not specifically targeted to the health services industry, such as a change in tax laws and the corporate tax rate or government spending cuts, could have significant impacts on our business, results of operations, financial condition and liquidity.

1 unchanged sentence

As disclosed in Part II, Item 5 of this Form 10-K, we have an active share repurchase program authorized by our board of directors.

In 2021, proposed legislation was introduced in the United States Senate, which would if passed assess an excise tax on the amount spent by a publicly traded company on buying back its own stock.

We are unable to predict whether any such proposals will be enacted, or the specific terms thereof, including their effect on our operations;

however, certain of these proposals could, if enacted, adversely impact our business and results of operations.

Existing or future laws, rules, regulatory interpretations or judgments could force us to change how we conduct our business, affect the products and services we offer and where we offer them, restrict revenue and enrollment growth, increase our costs, including medical, operating, health care technology and administrative costs, and require enhancements to our compliance infrastructure and internal controls environment.

For example, invalidation, modification, repeal or replacement of the ACA or portions thereof could result in material changes to the way we conduct our business, as well as the loss of subsidies related to our IFP offerings.

For example, health care reforms or the invalidation, modification, repeal or replacement of the ACA or portions thereof could result in material changes to the way we conduct our business, as well as the loss of subsidies related to our IFP offerings and could impact the market for our products.

We are required to obtain and maintain insurance and other regulatory approvals to, among other things, market many of our products, expand into additional geographic or product markets, increase prices for certain regulated products and consummate some of our acquisitions and dispositions.

Delays in obtaining or failure to obtain or maintain these approvals could reduce our revenue or increase our costs.

Additionally, we must maintain licenses and registrations in the jurisdictions in which we conduct business, and the suspension, material adverse modification or termination of such license and registrations could adversely affect our operations.

Such licensure subjects many of our businesses to state regulation of our operations and products, as well as risks associated with doing business in those jurisdictions.

Existing or future laws and rules could also require or lead us to take other actions such as changing our business practices, and could increase our liability.

Further, failure to effectively implement or adjust our strategic and operational initiatives, such as by reducing

operating costs, adjusting premium pricing or benefit design or transforming our business model in response to regulatory changes may have a material adverse effect on our results of operations, financial condition and cash flows.

Further, failure to effectively implement or adjust our strategic and operational initiatives, such as by reducing operating costs, adjusting premium pricing or benefit design or transforming our business model in response to regulatory changes may have a material adverse effect on our results of operations, financial condition and cash flows.

For more information on regulations affecting our business, see "Business – Regulation" in Part I, Item 1 of this Form 10-K.

2 unchanged sentences

Government business, we contract with CMS and various state governmental agencies to provide managed health care services including Medicare Advantage plans and Medicare Part D plans.

Additionally, our Evernorth business provides services to government entities and payers participating in government health care programs.

Additionally, our Evernorth Health Services business provides services to government entities and payors participating in government health care programs and our relationships with these government entities is subject to laws and regulations regarding government contracts.

Our revenues from government-funded programs, including our Medicare programs and our government clients, are dependent, in whole or in part, upon annual funding from the federal government or applicable state or local governments.

Funding for these programs is dependent on many factors outside our control, including general economic conditions, continuing government efforts to contain health care costs and budgetary constraints at the federal or applicable state or local level and general political issues and priorities.

These entities generally have the right to not renew or cancel their contracts with us on short notice without cause or if funds are not available.

Unanticipated changes in funding, such as the application of sequestration by the federal or state governments or the failure to provide for continued appropriations or regular ongoing scheduled payments to us, could substantially reduce our revenues and profitability.

Funding for these programs is dependent on many factors outside our control, including general economic conditions, continuing government efforts to contain health care costs, budgetary constraints at the federal or applicable state or local level and general political issues and priorities.

These entities generally have the right to not renew or to cancel their contracts with us on short notice without cause or if funds are not available.

Unanticipated changes in funding, such as the application of sequestration by the federal or state governments, retroactive rate adjustments, a delay by Congress in raising the federal debt ceiling, or the failure to provide for continued appropriations or regular ongoing scheduled payments to us, could substantially reduce our revenues or profitability or impact our liquidity.

The Medicare program has been the subject of regulatory reform initiatives.

2 unchanged sentences

Additionally, a portion of each Medicare Advantage plan's reimbursement is tied to the plan's Star Rating, with those plans receiving a rating of four or more stars eligible for quality-based bonus payments.

A plan's Star Rating affects its image in the market and plans that perform well are able to offer enhanced benefits, market more effectively and for longer periods of time than other plans.

A plan's Star Rating affects its image in the market and plans that perform well are able to offer enhanced benefits, market more effectively and for longer periods of time than other

The Star Rating system is subject to change annually by CMS, which may make it more difficult to achieve four stars or greater.

2 unchanged sentences

In addition, audits of our performance for past or future periods may result in downgrades to our Star Ratings.

If we do not maintain or improve our Star Ratings or if the quality-based bonus payments are reduced or eliminated, we may experience a negative impact on our revenue and the marketability of our plans may be adversely affected.

Accordingly, our plans may not be eligible for full level quality bonuses, which could adversely affect the benefits such plans can offer, reduce membership or impact our financial performance.

See the "Executive Overview - Key Transactions and Business Developments" section of MD&A in Part II, Item 7 of this Form 10-K for additional information on our Star Ratings.

Additionally, if we fail to comply with CMS' contractual requirements, including data submission, enrollment and marketing, provider network adequacy, provider directory accuracy, quality measures, claims payment, continuity of care, timely and accurate processing of appeals and grievances, oversight of first tier downstream and related entities and call center performance, we may be subject to administrative actions, including enrollment sanctions or contract termination, fines or other penalties that could impact our profitability.

As described under "Business – Regulation" in Part I, Item 1 of this Form 10-K, on November 1, 2018, CMS released a proposed rule that would revise its RADV methodology and, if adopted in its current form, could result in some combination of degraded plan benefits, higher monthly premiums or reduced choice for the population served by all Medicare Advantage insurers.

While it is uncertain whether CMS will finalize the rule as proposed, if adopted, it could have a material impact on the Company's future results of operations.

Additionally, if we fail to comply with CMS' contractual requirements, including data submission, enrollment and marketing, provider network adequacy, provider directory accuracy, quality measures, claims payment, continuity of care, timely and accurate processing of appeals and grievances, adverse findings under RADV audits, oversight of first tier downstream and related entities and call center performance, we may be subject to administrative actions, including enrollment sanctions or contract termination, fines or other penalties or enforcement actions that could materially impact our profitability.

Any failure, or alleged failure, to comply with various state and federal health care laws and regulations, including those directed at preventing fraud and abuse in government funded programs, has resulted in and could in the future result in investigations or litigation, such as actions under the federal False Claims Act and similar whistleblower statutes under state laws.

2 unchanged sentences

We are routinely involved in numerous claims, lawsuits, regulatory audits, investigations and other legal matters arising, for the most part, in the ordinary course of business.

These legal matters could include benefit claims, breach of contract actions, tort claims, claims

arising from consumer protection laws, false claims act laws, claims disputes under federal or state laws and disputes regarding reinsurance arrangements, employment and employment discrimination-related suits, antitrust claims, employee benefit claims, wage and hour claims, tax, privacy, intellectual property and whistleblower claims, shareholder suits and other securities law claims, real estate disputes, claims related to disclosure of certain business practices and claims arising from customer audits and contract performance, including government contracts.

These legal matters could include benefit claims, breach of contract actions, tort claims (including claims related to the delivery of health care services, such as medical malpractice by staff at our affiliates' facilities, or by health care practitioners who are employed by us, have contractual relationships with us, or serve as providers to our managed care networks, including as a result of a failure to adhere to applicable clinical, quality and/or patient safety standards), claims arising from consumer protection laws, false claims act laws, claims disputes under federal or state laws and disputes regarding reinsurance arrangements, employment and employment discrimination-related suits, antitrust claims (including as a result of changes in the enforcement of antitrust laws), employee benefit claims, wage and hour claims, tax, privacy, intellectual property and whistleblower claims, shareholder suits and other securities law claims, real estate disputes, claims related to disclosure of certain business practices and claims arising from customer audits and contract performance, including government contracts.

In addition, we have incurred and likely will continue to incur liability for practices and claims related to our health care business, such as marketing misconduct, failure to timely or appropriately pay for or provide health care, provider network structure, poor outcomes for care delivered or arranged, provider disputes including disputes over compensation or contractual provisions, ERISA claims, allegations related to calculations of cost sharing and claims related to our administration of self-funded business.

We are also routinely involved in legal matters arising from our health services business, including without limitation claims related to the dispensing of pharmaceutical products by our home delivery and specialty pharmacies, pharmacy benefit management services, such as formulary management services, health benefit management services and provider services.

Our pharmacy services operations are subject to the clinical quality, patient safety and other risks inherent in the dispensing, packaging and distribution of drugs, including claims related to purported dispensing and other operational errors.

There are currently, and may be in the future, attempts to bring class action lawsuits against the Company and other companies in our industry;

6 unchanged sentences

Additionally, it is possible that the resolution of current or future legal matters and claims could result in changes to our industry and business practices, losses material to our results of operations, financial condition and liquidity or damage to our reputation.

We are frequently the subject of regulatory market conduct and other reviews, audits and investigations by state insurance and health and welfare and pharmacy departments, attorneys general, DOJ, CMS, DOL and the OIG and comparable authorities in foreign jurisdictions.

Additionally, we are, and may in the future be, subject to qui tam actions in which the government may or may not intervene.

With respect to our Medicare Advantage and Medicare Part D businesses, CMS and OIG perform audits to determine a health plan's compliance with federal regulations and contractual obligations, including compliance with proper coding practices and fraud and abuse enforcement practices through audits designed to detect and correct improper payments.

Certain of our contracts are currently subject to RADV audits by CMS and the OIG.

The DOJ is conducting industry-wide investigations of the risk adjustment data submission practices and business processes of Cigna and a number of other Medicare Advantage organizations.

We are frequently the subject of regulatory market conduct and other reviews, audits and investigations by state insurance and health and welfare and pharmacy departments, attorneys general, DOJ, CMS, DOL and the HHS-OIG and comparable authorities in foreign jurisdictions.

Additionally, we are, and may in the future be, subject to qui tam actions in which the government may or may not

With respect to our Medicare Advantage and Medicare Part D businesses, CMS and HHS-OIG perform audits to determine a health plan's compliance with federal regulations and contractual obligations, including compliance with proper coding practices and fraud and abuse enforcement practices through audits designed to detect and correct improper payments.

Certain of our contracts are currently subject to RADV audits by CMS and the HHS-OIG.

These audits could result in significant adjustments in payments made to our health plans, which could adversely affect our results of operations.

There also continues to be heightened review by federal and state regulators of business and reporting practices within the health services industry, including with respect to claims payment and related escheat practices, and increased scrutiny by other federal and state governmental agencies (such as state attorneys general) empowered to bring criminal actions in circumstances that could have previously given rise only to civil or administrative proceedings.

3 unchanged sentences

However, we will likely continue to experience government scrutiny and audit activity, which has and may in the future result in civil penalties.

Regulatory audits, investigations or reviews or actions by other government agencies could result in changes to our business practices, retroactive adjustments to certain premiums, significant fines, penalties, civil liabilities, criminal liabilities or other sanctions, including corporate integrity agreements, restrictions on our ability to participate in government programs, market certain products or engage in business-related activities, that could have a material adverse effect on our business, results of operation, financial condition and liquidity.

Regulatory audits, investigations, litigation or reviews or actions by other government agencies could result in changes to our business practices, retroactive adjustments to certain premiums, significant fines, penalties, civil liabilities, criminal liabilities or other sanctions, including corporate integrity agreements, restrictions on our ability to participate in government programs or exclusion from such programs, market certain products or engage in business-related activities, that could have a material adverse effect on our business, results of operation, financial condition and liquidity.

In addition, disclosure of an adverse investigation or audit or the imposition of fines or other sanctions could negatively affect our reputation in certain markets and make it more difficult for us to sell our products and services.

2 unchanged sentences

If we fail to comply with applicable privacy, security and data laws, regulations and standards, our business and reputation could be materially adversely affected.

Most of our activities involve the receipt, use, storage or transmission of a substantial amount of individuals' protected health information and personally identifiable information.

We also use aggregated and anonymized data for research and analysis purposes,

and in some cases, provide access to such de-identified data, or analytics created from such data, to pharmaceutical manufacturers and third-party data aggregators and analysts.

Most of our activities involve the receipt, use, storage or transmission of a substantial amount of individuals' PHI and personally identifiable information.

We also use aggregated and anonymized data for research and analysis purposes, and in some cases, provide access to such de-identified data, or analytics created from such data, to pharmaceutical manufacturers and third-party data aggregators and analysts.

We may also use such information to create analytic models designed to predict, and potentially improve, outcomes and patient care.

The collection, maintenance, protection, use, transmission, disclosure and disposal of sensitive personal information are regulated at the federal, state, international and industry levels and requirements are imposed on us by contracts with clients.

The collection, dissemination, receipt, maintenance, protection, use, transmission, disclosure, privacy, confidentiality, security, availability, integrity, creation, processing, and disposal of sensitive personal information are regulated at the federal, state, international and industry levels and requirements are imposed on us by contracts with clients.

In some cases, such laws, rules, regulations and contractual requirements also apply to our vendors and require us to obtain written assurances of their compliance with such requirements.

1 unchanged sentence

Certain of our businesses are also subject to the Payment Card Industry Data Security Standard, which is designed to protect credit card account data as mandated by payment card industry entities.

International laws, rules and regulations governing the use and disclosure of such information, such as the GDPR, can be more stringent than in the United States, and they vary across jurisdictions.

International laws, rules and regulations governing the use and disclosure of such information, such as the GDPR, can be more stringent than similar laws in the United States, and they vary across jurisdictions.

In addition, more jurisdictions are regulating the transfer of data across borders and domestic privacy and data protection laws are generally becoming more onerous.

2 unchanged sentences

For more information on privacy regulations to which we are subject, see "Business – Regulation" in Part I, Item 1 of this Form 10-K.

HIPAA requires covered entities to comply with the HIPAA privacy, security and breach rules.

In addition, business associates must comply with the HIPAA security and breach requirements.

HIPAA requires covered entities and business associates to comply with the HIPAA privacy, security and breach rules.

While we endeavor to provide appropriate protections through our contracts with our third-party service providers and in certain cases assess their security controls, we have limited oversight or control over their actions and practices.

Several of our businesses act as business associates to their covered entity customers and, as a result, collect, use, disclose and maintain sensitive personal information in order to provide services to these customers.

Several of our businesses act as business associates to their covered entity customers and, as a result, collect, receive, use, disclose, transmit and maintain sensitive personal information in order to provide services to these customers.

HHS administers an audit program to assess HIPAA compliance efforts by covered entities and business associates.

In addition, HHS continues to exercise its enforcement authority, such as enforcement actions resulting from investigations brought on by notification to HHS of a breach.

In addition, HHS continues to exercise its enforcement authority to bring enforcement actions resulting from complaints, compliance reviews, audits and investigations brought on by notification to HHS of a breach.

An audit resulting in findings or allegations of noncompliance or the implementation of an enforcement action could have an adverse effect on our results of operations, financial position, cash flows and reputation.

3 unchanged sentences

Fraud and abuse prohibitions encompass a wide range of activities including kickbacks for referral of customers, billing for unnecessary medical services, improper marketing and violations of patient privacy rights.

The regulations and contractual requirements applicable to us are complex and subject to change.

Some of our businesses are also subject to federal and state laws and regulations that may impact our relationships with health care providers and customers, including laws on self-referrals, beneficiary inducements, false claims, fee-splitting, telemedicine, corporate practice of medicine, dispensing, packaging, fulfillment, and distribution of controlled substances, other pharmaceutical products and medical devices, medical malpractice, consumer protection, product liability, narrow networks, provider tiering programs, provider contracts, overpayments, reimbursement of out-of-network claims, and licensure.

The regulations and contractual requirements applicable to us are complex and subject to change and may affect our ability to market or provide our products or services.

In addition, ongoing vigorous law enforcement, a highly technical regulatory scheme and the Dodd-Frank Act and related regulations enhance regulators' enforcement powers and whistleblower incentives and protections.

8 unchanged sentences

A substantial portion of our investment assets are in fixed interest-yielding debt securities of varying maturities and commercial mortgage loans.

The value of these investment assets can fluctuate

significantly with changes in market conditions.

The value of these investment assets can fluctuate significantly with changes in market conditions.

A rise in interest rates would likely reduce the value of our investment portfolio, increase interest expense on our indebtedness and increase investment income as investment assets mature and are replaced.

In addition, an economic contraction could result in delay in payment of principal or interest by issuers, or defaults by issuers, reducing our investment income and requiring us to write down the value of our investments.

Significant stock market or interest rate declines could result in additional unfunded pension obligations resulting in the need for additional plan funding by us and increased pension expenses.

We currently have unfunded obligations in our frozen pension plans.

Significant stock market or interest rate declines could result in unfunded pension obligations resulting in the need for additional plan funding by us and increased pension expenses.

We currently have overfunded obligations in our frozen pension plans.

A significant decline in the value of the plans' equity and fixed income investments or unfavorable changes in applicable laws or regulations could materially increase our expenses and change the timing and amount of required plan funding.

8 unchanged sentences

Our debt ratings impact both the cost and availability of future borrowings and, accordingly, our cost of capital.

Each of the rating agencies reviews ratings periodically and there can be no assurance that current ratings will be maintained in the future.

Each of the rating agencies reviews

ratings periodically and there can be no assurance that current ratings will be maintained in the future.

A downgrade of any of these ratings in the future could make it more difficult to either market our products successfully or raise capital to support business growth.

1 unchanged sentence

Our indebtedness could adversely affect our financial condition, our ability to react to changes in the economy or our industry and could divert our cash flow from operations for debt service costs, leaving us with less cash flow from operations available to fund growth, stock repurchases, dividends and other corporate purposes.

The total indebtedness of Cigna was approximately $33.7 billion as of December 31, 2021.

The total indebtedness of The Cigna Group was approximately $31.1 billion as of December 31, 2022.

Carrying indebtedness:

9 unchanged sentences

and global economies.

Our results of operations could be materially adversely affected by the impact of unfavorable

economic conditions on our clients and customers (both employers and individuals), health care providers, pharmacy manufacturers, pharmacy providers and third-party vendors.

Our results of operations could be materially adversely affected by the impact of unfavorable economic conditions on our clients and customers (both employers and individuals), health care providers, pharmacy manufacturers, pharmacy providers and third-party vendors.

• Employers may take action to reduce their operating costs by modifying, delaying or canceling plans to purchase our products or making changes in the mix of products purchased that are unfavorable to us.

24 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors