What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-02-29 compared with 2023-02-23 · 94 added, 92 removed, 363 unchanged (34% of the section changed)

18 unchanged sentences

• access or continue accessing key drugs and successfully penetrate key treatment categories in our specialty pharmacy business;

• attract and retain sufficient numbers of qualified employees, particularly in an increasingly competitive job market;

• attract and retain sufficient numbers of qualified employees, particularly in a competitive job market;

• attract, develop and maintain collaborative relationships with a sufficient number of qualified partners;

19 unchanged sentences

• the ability of larger employers and clients to contract directly with providers;

• technological changes and rapid shifts in the use of technology, such as telehealth;

• technological changes and rapid shifts in the use of technology, such as telehealth and AI;

• the impact or consequences of legislation or regulatory changes;

• changes in the United States Postal Service or the consolidation of shipping carriers;

• impacts to distribution channels, including changes to the United States Postal Service or the consolidation of shipping carriers;

• increased drug acquisition cost or unexpected changes to drug pricing trend;

• changes in the generic drug market or the failure of new generic drugs to come to market;

• changes in the generic/biosimilar drug market or the failure of new generic/biosimilar drugs to come to market;

• changes in utilization of health care, prescription drugs or other covered services and items, including under risk-based contracts in the health benefit management market and for those businesses that utilize risk adjustment methodology.

5 unchanged sentences

Our Express Scripts client contracts generally have three-year terms and may be subject to periodic renegotiation of pricing terms based on market factors.

As described in greater detail in the description of our business in Item 1 of this Form 10-K, one of our key clients in the Evernorth Health Services segment is the United States Department of Defense.

As described in greater detail in the description of our business in Item 1 of this Form 10-K, our key clients in the Evernorth Health Services segment include the DoD, Prime and Centene.

If one or more of our large clients terminates or does not renew a contract for any reason, including as a result of being acquired, or if the provisions of a contract with a large client are modified, renewed or otherwise changed with terms less favorable to us, our results of operations could be adversely affected and we could experience a negative reaction in the investment community resulting in decreases in the trading price of our securities or other adverse effects.

9 unchanged sentences

Clients can easily move between our competitors and us.

Our clients are well informed and typically have knowledgeable consultants that seek competing bids from our competitors before

contract renewal.

Our clients are well informed and typically have knowledgeable consultants that seek competing bids from our competitors before contract renewal.

In addition, as brokers and benefit consultants seek to enhance their revenue streams, they look to take on services that we typically provide.

27 unchanged sentences

In some markets, certain providers, particularly hospitals, physician/hospital organizations and multispecialty physician groups, may have significant or controlling market positions that could result in a diminished bargaining position for us.

If providers refuse to contract with us, use

their market position to negotiate more favorable contracts or place us at a competitive disadvantage, our ability to market products or to be profitable in those areas could be materially adversely affected.

If providers refuse to contract with us, use their market position to negotiate more favorable contracts or place us at a competitive disadvantage, our ability to market products or to be profitable in those areas could be materially adversely affected.

Additionally, certain regulations may impact our ability to obtain competitive prices.

Establishing collaborative arrangements with physician groups, specialist groups, independent practice associations, hospitals and health care delivery systems is key to our strategic focus to transition from volume-based fee-for-service arrangements to a value-based health care system.

If such collaborative arrangements do not result in the lower medical costs that we project or if we fail to attract health care providers to such arrangements, or are less successful at implementing such arrangements than our competitors, our attractiveness to customers may be reduced and our ability to profitably grow our business may be adversely affected.

than our competitors, our attractiveness to customers may be reduced and our ability to profitably grow our business may be adversely affected.

Our ability to develop and maintain satisfactory relationships with providers may also be negatively impacted by other factors not associated with us, such as changes in Medicare or Medicaid reimbursement levels, increasing pressure on revenue and other pressures on health care providers and increasing consolidation activity among hospitals, physician groups and providers.

1 unchanged sentence

In some instances, these organizations may compete directly with us, potentially affecting the way we price our products and services or causing us to incur increased costs if we change our operations to be more competitive.

Out-of-network providers are not limited by any agreement with us in the amounts they bill.

Out-of-network providers for non-Medicare services are not limited by any agreement with us in the amounts they bill.

For Medicare Advantage, out-of-network providers can only receive the same rate that CMS pays for Medicare services.

While benefit plans place limits on the amount of charges that will be considered for reimbursement and regulations seek to prescribe payment levels, establish methodologies and dispute resolution processes, providers are increasingly sophisticated and aggressive.

As a result, the outcome of disputes where we do not have a provider contract may cause us to pay higher medical or other benefit costs than we projected.

Additionally, certain of our products and services are sold in part through nonexclusive producers and consultants for whose services and allegiance we compete.

Additionally, certain of our products and services are sold in part through non-exclusive producers and consultants for whose services and allegiance we compete.

Our sales could be materially adversely affected if we are unable to attract, retain and support such independent producers and consultants or if our sales strategy is not appropriately aligned across distribution channels.

6 unchanged sentences

• access to limited distribution specialty pharmaceuticals by our specialty pharmacies.

Our contracts with pharmaceutical manufacturers are typically nonexclusive and terminable on relatively short notice by either party.

Our contracts with pharmaceutical manufacturers are typically non-exclusive and terminable on relatively short notice by either party.

The consolidation of pharmaceutical manufacturers, the termination or material alteration of our relationships, or our failure to renew contracts on market competitive terms could have a material adverse effect on our business and results of operations.

5 unchanged sentences

In certain geographic areas of the United States, our networks may be comprised of higher concentrations of one or more large pharmacy chains.

Contracts with retail pharmacies are generally nonexclusive and are terminable on relatively short notice by either party.

Contracts with retail pharmacies are generally non-exclusive and are terminable on relatively short notice by either party.

If one or more of the larger pharmacy chains terminates its relationship with us, or is able to renegotiate terms substantially less favorable to us, our customers' access to retail pharmacies or our business could be materially adversely affected.

The entry of one or more additional large pharmacy chains into the pharmacy benefit management business, the consolidation of existing pharmacy chains or increased leverage or market share by the largest pharmacy providers could increase the likelihood of negative changes in our relationship with such pharmacies.

Changes in the overall composition of our pharmacy networks, or reduced pharmacy access under our networks, could have a negative

impact on our claims volume or our competitiveness in the marketplace, which could cause us to fall short of certain guarantees in our contracts with clients or otherwise impair our business or results of operations.

Changes in the overall composition of our pharmacy networks, or reduced pharmacy access under our networks, could have a negative impact on our claims volume or our competitiveness in the marketplace, which could cause us to fall short of certain guarantees in our contracts with clients or otherwise impair our business or results of operations.

Changes in drug pricing or industry pricing benchmarks could materially impact our financial performance.

1 unchanged sentence

If these benchmarks are no longer published by third parties, we, or our contractual partners, adopt other pricing benchmarks for establishing prices within the industry, legislation or regulation requires the use of other pricing benchmarks, or future changes in drug prices substantially deviate from our expectations, the short- or long-term impacts may have a material adverse effect on our business and results of operations.

Additionally, laws such as the Inflation Reduction Act have granted CMS the ability to negotiate drug prices for certain Part D and Part B drugs, and other federal and state legislative proposals may lead to changes in drug pricing for federal health care programs.

Our business depends on our ability to effectively invest in, implement improvements to and properly maintain the uninterrupted operation, availability and data integrity of our information technology and other business systems.

Our business is highly dependent on maintaining effective information systems as well as the integrity and timeliness of the data we use to serve our customers and health care providers and to operate our business.

If our data were found to be inaccurate or unreliable due to fraud or other error, or if we, or any of the third-party providers we engage, were to fail to maintain information systems and data integrity effectively, we could experience operational disruptions that may impact our clients, customers and health care providers and hinder our ability to provide or establish appropriate pricing for products and services, retain and attract clients and customers, establish reserves and report financial results timely and accurately and maintain regulatory compliance, among other things.

If our data were found to be inaccurate or unreliable due to fraud or other error, or if we, or any of the third-party providers or subcontractors that we or they engage, were to fail to maintain information systems and data integrity effectively, we could experience operational disruptions that may impact our clients, customers and health care providers and hinder our ability to provide or establish appropriate pricing for products and services, retain and attract clients and customers, establish reserves and report financial results timely and accurately and maintain regulatory compliance, among other things.

Our information technology strategy and execution are critical to our continued success.

10 unchanged sentences

If we are unable to prevent or contain the effects of any such attacks, or fail to ensure vendors do the same, we may suffer exposure to substantial liability, reputational harm, loss of revenue or other damages.

Our business depends on our clients' and customers' willingness to entrust us with their health-related and other sensitive personal information, including information that is subject to privacy, security or data breach notification laws.

Computer systems may be vulnerable to physical break-ins, computer viruses or malware, programming errors, attacks by third parties or similar disruptive problems.

Our business depends on our clients' and customers' willingness to entrust us with their health-related and other personal information ("PI"), including Protected Health Information ("PHI") that is subject to privacy, security or data breach notification laws.

Computer networks or systems may be vulnerable to intrusion, computer viruses or malware, programming errors, attacks by third parties or similar disruptive problems.

We have been, and will likely continue to be, the target of computer viruses or other malicious codes, unauthorized access, cyberattacks or other computer-related penetrations.

2 unchanged sentences

Human or technological error has and could in the future result in, for example, unauthorized access to, acquisition, disclosure, modification, misuse, loss, or destruction of company, customer, or other third-party data or systems;

theft of sensitive, regulated, or confidential data including personal information and intellectual property;

theft of sensitive, regulated, or confidential data including PI and intellectual property;

the loss of access to critical data or systems through ransomware, destructive attacks or other means;

and business delays, service or system disruptions or denials of service.

As we increase the amount of personal information that we store and share digitally, our exposure to unauthorized disclosures, data privacy and related cybersecurity risks increases, including the risk of undetected attacks, damage, loss or unauthorized access or acquisition or misappropriation of proprietary or personal information, and the cost of attempting to protect against these risks also increases.

The health care data ecosystem is complex and requires data exchange with vendors, business partners, the government and others.

If disruptions, disclosures, security incidents or breaches are not detected quickly, their effect could be compounded.

We have dedicated significant resources to implement security technologies, processes and procedures to protect consumer identity and provide

employee awareness training around phishing, malware and other cyber risks;

As we increase the amount of PI that we store and share digitally, our exposure to unauthorized uses and disclosures, and data privacy and related cybersecurity risks increases, including the risk of undetected attacks, damage, loss or unauthorized access or acquisition or misappropriation of proprietary or personal information, and the cost of attempting to protect against these risks also increases.

The health care data ecosystem is complex and requires data exchange with vendors, business partners, health care professionals, the government and others.

If disruptions, data disclosures, security incidents or breaches are not detected quickly, their effect could be compounded.

We have dedicated significant resources to implement privacy and security technologies, processes and procedures to

protect PI and provide employee awareness training around phishing, malware and other cyber risks;

however, there are no assurances that such measures will be effective against all types of security incidents or breaches.

Further, we depend on many vendors to support and assist our business, which requires such vendors to generate, store and use sensitive personal information.

Further, we depend on many vendors to support and assist our business, which requires such vendors to generate, store and use PI.

Cybersecurity threats are rapidly evolving and those threats and the means for obtaining access to our proprietary systems are becoming increasingly sophisticated.

Cyberattacks can originate from a wide variety of sources including terrorists, nation states, internal actors, or third parties, such as external service providers, and the techniques used change frequently or are often not recognized until after they have been launched.

For example, there has been an increase in new financial fraud schemes akin to ransomware attacks on large companies whereby a cybercriminal installs a type of malicious software, or malware, that prevents a user or enterprise from accessing computer files, systems or networks and demands payment of a ransom for their return.

Those parties may also attempt to fraudulently induce employees, customers or other users of our systems to disclose sensitive information in order to gain access to our data or that of our customers.

For example, there continues to be an increase in new financial fraud schemes akin to ransomware attacks on large companies whereby a cybercriminal installs a type of malicious software, or malware, that prevents a user or enterprise from accessing computer files, systems or networks and demands payment of a ransom for their return.

Those parties may also attempt to fraudulently induce employees, customers or other users of our systems to disclose or inadvertently provide access to systems in order to gain access to our data or that of our customers.

In addition, while we have certain standards for all vendors that provide us services, our vendors, and in turn, their own service providers, may become subject to the same types of security breaches.

2 unchanged sentences

Our remediation efforts may not be successful and could result in interruptions, delays, or cessation of service and loss of existing or potential customers.

In addition, the unauthorized access, acquisition, use, disclosure or dissemination of sensitive personal information, proprietary information or confidential information about us, our customers or other third parties could expose our customers' and their private information to the risk of financial or medical identity theft.

In addition, the unauthorized access, acquisition, use, disclosure or dissemination of personal information, proprietary information or confidential information about us, our customers or other third parties could expose our customers' and their private information to the risk of financial or medical identity theft.

Unauthorized access, acquisition, use, disclosure or dissemination of confidential and proprietary information about our business and strategy could also negatively affect the achievement of our strategic initiatives.

1 unchanged sentence

These events would negatively affect our ability to compete, our reputation, customer base and revenues and expose us to mandatory disclosure requirements, government investigations, litigation and other enforcement proceedings, material fines, penalties or remediation costs and compensatory, special, punitive and statutory damages, consent orders and other adverse actions, any of which could adversely affect our business, results of operations, financial condition or liquidity.

The scale, scope and duration of the ongoing COVID-19 pandemic continues to be unknown and the overall impact on our business, operating results, cash flows or financial condition has been and may continue to be material.

The COVID-19 pandemic has adversely affected, and is continuing to affect, global economies, financial markets and the overall environment for our business, and the extent to which it may impact our future results of operations and overall financial performance remains uncertain.

While vaccination rates continue to rise, the COVID-19 pandemic, including vaccination efficacy, the implementation of and reaction to vaccination and testing mandates and the occurrence of new variants, could continue to effect such economies and financial markets as well as the health and availability of our workforce.

As a result, we may experience new disruptions to our business operations and our business could be adversely affected further, directly or indirectly, by the ongoing pandemic.

The COVID-19 pandemic has in some instances, and may continue to, heighten the potential adverse effects on our business, operating results, cash flows or financial condition as described below or in other risk factors within this section of the Form 10-K including, but not limited to, the likelihood of and impact from:

• unfavorable economic conditions on our clients and customers (both employers and individuals), health care and pharmacy providers, pharmaceutical manufacturers and third-party vendors, as well as federal and state entities and programs;

• changes in medical claims submission and processing patterns or procedures;

changes in customer base and product mix;

changes in utilization of prescription drugs, medical or other covered items or services, including increased behavioral health services utilization;

changes in medical cost trends;

changes in our health management practices;

and the introduction of new benefits and products causing actual claims to exceed our estimates;

• changes in health care utilization patterns, provider billing practices and other external events that we cannot forecast or project and over which we have little or no control impacting our ability to accurately predict, price for and manage health care costs and ultimately our profitability, including impacts from care deferral on, among other things, risk adjustment revenue and acuity of future care;

• increased costs or reductions in revenue, including costs for COVID-19-related care, testing and treatment;

vaccine and other coverage mandates;

and support for employees, clients, customers and providers;

• compliance with substantial government regulation, including privacy and security requirements associated with providing telehealth and remote care options and new laws or regulations or changes in existing laws or regulations, such as vaccine, testing and coverage mandates and premium deferrals, which laws or regulations may vary significantly by jurisdiction;

• cyberattacks or other privacy or data security incidents, including as a result of the transition to a hybrid work environment by substantially all of our workforce and the workforces of third parties with whom we contract;

• significant shifts in the structure of the industry which could alter dynamics and, if we fail to adapt, negatively impact our business;

• risks inherent in foreign operations, including political, legal, operational, regulatory, economic and other risks;

• economic and market conditions affecting the value of our financial instruments and the value of particular assets and liabilities;

• fluctuations in equity market prices, interest rates and credit spreads limiting our ability to raise or deploy capital and affecting our overall liquidity.

We believe COVID-19 and its variants' adverse impact on our business, operating results, cash flows or financial condition will be driven primarily by the severity and duration of the pandemic, including the impact of the breadth and timing of implementation and the efficacy and costs of vaccination programs, the pandemic's continued impact on our employees, clients, customers, suppliers and partners, as well as the U.S.

and global economies and the continued actions taken by governmental authorities and other third parties in response to the pandemic.

Those primary drivers are largely beyond our knowledge and control, and may be more adverse than our current expectations.

Given these uncertainties, we cannot estimate the full impact COVID-19 will have on our business, operating results, cash flows or financial condition, but the adverse impact could be material.

Our use of artificial intelligence and machine learning present regulatory and legal challenges that could negatively affect our business and our reputation.

Our use of artificial intelligence (“AI”), including machine learning (“ML”) technologies, as well as more recent technological advances in AI/ML, pose risks to us and subject us to new and existing laws and regulations.

While we are committed to responsible use of AI/ML and following applicable laws and regulations, and while we have made progress developing governance as to use of AI/ML by our organization, any failure to use AI/ML responsibly and to adhere to such laws, regulations and governance could have a material unfavorable effect on our business, results of operations, and financial condition.

Depending on how existing laws and regulations are interpreted, and as new laws are passed, we may have to make changes to our business practices to comply with such obligations.

These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us retrain our AI/ML, or prevent or limit our use of AI/ML.

Our use of AI/ML technologies could also result in additional compliance costs, regulatory investigations and actions, and consumer or other lawsuits.

If we are unable to use AI/ML, or if regulators restrict our ability to use AI/ML for certain purposes, it could make our business less efficient, result in competitive disadvantages, and subject us to potential unfavorable business impacts.

To the extent that we rely on or use the output of AI/ML, any inaccuracies, biases or errors could have unfavorable impacts on us, our business and our results of operations or financial condition.

The impact of regulatory and legal risks associated with AI/ML is largely unknown.

As a global company, we face political, legal, operational, regulatory, economic and other risks that present challenges and could negatively affect our multinational operations or our long-term growth.

7 unchanged sentences

restrictions that prevent us from transferring funds out of the countries in which we operate;

foreign currency exchange rates and fluctuations and restrictions on converting currencies from foreign operations into other currencies;

uncertainty with respect to the interpretation of tax positions;

foreign currency exchange rates and fluctuations and restrictions on converting currencies

from foreign operations into other currencies;

uncertainty with respect to the adoption of new tax laws and the interpretation of tax positions;

• reliance on local employees and interpretations of labor laws in foreign jurisdictions;

2 unchanged sentences

• the global trend for companies to enact local data residency requirements;

• acts of civil unrest, war and terrorism, as well as other political and economic conflicts such as through imposition of economic or political sanctions;

• man-made disasters, natural disasters (including those arising as a result of climate change) and pandemics, such as the COVID-19 pandemic, in locations where we operate;

• general economic and political conditions.

• acts of civil unrest, war and terrorism, including the ongoing conflict in the Middle East as well as other political and economic conflicts such as through imposition of economic or political sanctions;

• man-made disasters, natural disasters (including those arising as a result of climate change) and pandemics in locations where we operate;

• general economic and political conditions, including conditions that may become unpredictable during a U.S.

presidential election year.

These factors may increase in significance as we continue to expand globally and operating in new foreign markets may require considerable management time before operations generate any significant revenues and earnings.

5 unchanged sentences

Our failure to comply with laws and regulations governing our conduct outside of the United States or to establish constructive relations with non-U.S.

could have a material adverse effect on our business, results of operations, financial condition, liquidity and long-term growth.

Strategic transactions involve risks and we may not realize the expected benefits because of integration difficulties, underperformance relative to our expectations and other challenges.

regulators could have a material adverse effect on our business, results of operations, financial condition, liquidity and long-term growth.

Please see "—Legal and Compliance Risks" below.

Strategic transactions involve risks and we may not realize the expected benefits because of integration or separation difficulties, underperformance relative to our expectations and other challenges.

As part of our strategy, we regularly consider and enter into strategic transactions, including mergers, acquisitions, joint ventures, licensing arrangements, divestitures and other relationships (collectively referred to as "strategic transactions").

2 unchanged sentences

We may be unable to complete any such divestiture on terms favorable to us, within the expected timeframes, or at all.

For example, in January 2024 we announced the HCSC transaction, which is subject to regulatory approvals and other closing conditions.

We may be unable to satisfy the closing conditions in a timely manner to complete the HCSC transaction, or we may otherwise fail to receive the anticipated benefits from the transaction, even if it is completed.

We may have continued financial exposure to divested businesses following the completion of any such transaction, including increased costs due to potential litigation, contingent liabilities and indemnification of the buyer related to, among other things, lawsuits, regulatory matters or tax liabilities.

9 unchanged sentences

A material decrease in shareholders' equity could negatively impact our debt ratings or potentially impact our compliance with existing debt covenants.

See Note 19 to the Consolidated Financial Statements for more information on goodwill and intangibles.

See Note 20 to the Consolidated Financial Statements for more information on goodwill and

In addition, the trading price of our securities may decline if, among other things, we are unable to achieve our estimates of earnings growth and operational cost savings, or the transaction costs are greater than expected.

19 unchanged sentences

Even though contracts are intended to provide certain protections, we have limited control over the actions of third parties.

For example, noncompliance with any privacy or security laws and regulations,

any security breach involving one of our third-party vendors or a dispute between us and a third-party vendor related to our arrangement could have a material adverse effect on our business, results of operations, financial condition, liquidity and reputation.

For example, noncompliance with any privacy or security laws and regulations, any security breach involving one of our third-party vendors or a dispute between us and a third-party vendor related to our arrangement could have a material adverse effect on our business, results of operations, financial condition, liquidity and reputation.

Outsourcing also may require us to change our existing operations, adopt new processes for managing these service providers or redistribute responsibilities to realize the potential productivity and operational efficiencies.

7 unchanged sentences

In some instances, our ability to provide services or products (including processing and dispensing prescriptions) depends on the availability of services and products provided by suppliers, providers, pharmaceutical manufacturers, vendors or shipping carriers.

A disruption, or threat of disruption, in our supply chain, including as a result of the COVID-19 pandemic, or inability to access or deliver products that meet requisite quality safety standards and patient needs in a timely and efficient manner could adversely impact our business.

A disruption, or threat of disruption, in our supply chain, including as a result of future pandemics or public health emergencies, or inability to access or deliver products that meet requisite quality safety standards and patient needs in a timely and efficient manner could adversely impact our business.

Increasing natural disasters in connection with climate change could also be a direct threat to us and our third-party vendors, service providers or other stakeholders.

23 unchanged sentences

As disclosed in Part II, Item 5 of this Form 10-K, we have an active share repurchase program authorized by our board of directors.

Existing or future laws, rules, regulatory interpretations or judgments could force us to change how we conduct our business, affect the products and services we offer and where we offer them, restrict revenue and enrollment growth, increase our costs, including medical, operating, health care technology and administrative costs, and require enhancements to our compliance infrastructure and internal controls environment.

For example, health care reforms or the invalidation, modification, repeal or replacement of the ACA or portions thereof could result in material changes to the way we conduct our business, as well as the loss of subsidies related to our IFP offerings and could impact the market for our products.

Regulators, customers, investors, employees and other stakeholders are increasingly focusing on ESG matters and related disclosures.

These changing rules, regulations and stakeholder expectations have resulted in, and are likely to continue to result in, increased general and administrative expenses and increased management time and attention spent complying with such regulations or meeting such expectations.

For example, the European Union's ("EU’s") Corporate Sustainability Reporting Directive (“CSRD”) will require expansive disclosures on various sustainability topics such as climate change, biodiversity, workforce, supply chain, and business ethics by in-scope EU entities and certain non-EU entities with significant cross-border business in EU markets.

In addition, California’s recently-enacted Climate Corporate Data Accountability Act will require annual disclosures of covered companies’ Scope 1, 2 and 3 greenhouse gas emissions.

We are assessing our obligations under CSRD and other enhanced reporting requirements, and expect that compliance could require substantial effort in the future.

Overall, ESG matters and related stakeholder reaction may impact our reputation and have other business impacts which could adversely affect our business.

Existing or future laws, rules, U.S.

Presidential Executive Orders, regulatory interpretations or judgments could force us to change how we conduct our business, affect the products and services we offer and where we offer them, restrict revenue and enrollment growth, increase our costs, including medical, operating, health care technology and administrative costs, and require enhancements to our compliance infrastructure and internal controls environment.

the loss of subsidies related to our IFP offerings and could impact the market for our products.

We are required to obtain and maintain insurance and other regulatory approvals to, among other things, market many of our products, expand into additional geographic or product markets, increase prices for certain regulated products and consummate some of our acquisitions and dispositions.

7 unchanged sentences

Through our U.S.

Government business, we contract with CMS and various state governmental agencies to provide managed health care services including Medicare Advantage plans and Medicare Part D plans.

Healthcare business, we contract with CMS and various state governmental agencies to provide managed health care services including Medicare Advantage plans and Medicare Part D plans.

Additionally, our Evernorth Health Services business provides services to government entities and payors participating in government health care programs and our relationships with these government entities is subject to laws and regulations regarding government contracts.

7 unchanged sentences

Additionally, a portion of each Medicare Advantage plan's reimbursement is tied to the plan's Star Rating, with those plans receiving a rating of four or more stars eligible for quality-based bonus payments.

A plan's Star Rating affects its image in the market and plans that perform well are able to offer enhanced benefits, market more effectively and for longer periods of time than other

A plan's Star Rating affects its image in the market and plans that perform well are able to offer enhanced benefits, market more effectively and for longer periods of time than other plans.

The Star Rating system is subject to change annually by CMS, which may make it more difficult to achieve four stars or greater.

6 unchanged sentences

Additionally, if we fail to comply with CMS' contractual requirements, including data submission, enrollment and marketing, provider network adequacy, provider directory accuracy, quality measures, claims payment, continuity of care, timely and accurate processing of appeals and grievances, adverse findings under RADV audits, oversight of first tier downstream and related entities and call center performance, we may be subject to administrative actions, including enrollment sanctions or contract termination, fines or other penalties or enforcement actions that could materially impact our profitability.

Any failure, or alleged failure, to comply with various state and federal health care laws and regulations, including those directed at preventing fraud and abuse in government funded programs, has resulted in and could in the future result in investigations or litigation, such as actions under the federal False Claims Act and similar whistleblower statutes under state laws.

A successful action or claim against us could subject us to damage awards, including treble damages, fines, penalties or other enforcement actions, restrictions on our ability to market or enroll new customers, limits on expansion, restrictions or exclusions from programs or other agreements with federal or state governmental agencies, which could adversely impact our business, cash flows, financial condition, results of operations and reputation.

We face risks related to litigation, regulatory audits and investigations.

We are routinely involved in numerous claims, lawsuits, regulatory audits, investigations and other legal matters arising, for the most part, in the ordinary course of business.

These legal matters could include benefit claims, breach of contract actions, tort claims (including claims related to the delivery of health care services, such as medical malpractice by staff at our affiliates' facilities, or by health care practitioners who are employed by us, have contractual relationships with us, or serve as providers to our managed care networks, including as a result of a failure to adhere to applicable clinical, quality and/or patient safety standards), claims arising from consumer protection laws, false claims act laws, claims disputes under federal or state laws and disputes regarding reinsurance arrangements, employment and employment discrimination-related suits, antitrust claims (including as a result of changes in the enforcement of antitrust laws), employee benefit claims, wage and hour claims, tax, privacy, intellectual property and whistleblower claims, shareholder suits and other securities law claims, real estate disputes, claims related to disclosure of certain business practices and claims arising from customer audits and contract performance, including government contracts.

health care practitioners who are employed by us, have contractual relationships with us, or serve as providers to our managed care networks, including as a result of a failure to adhere to applicable clinical, quality and/or patient safety standards), claims arising from consumer protection laws, false claims act laws, claims disputes under federal or state laws and disputes regarding reinsurance arrangements, employment and employment discrimination-related suits, antitrust claims (including as a result of changes in the enforcement of antitrust laws), employee benefit claims, wage and hour claims, tax, privacy, intellectual property and whistleblower claims, shareholder suits and other securities law claims, real estate disputes, claims related to disclosure of certain business practices and claims arising from customer audits and contract performance, including government contracts.

In addition, we have incurred and likely will continue to incur liability for practices and claims related to our health care business, such as marketing misconduct, failure to timely or appropriately pay for or provide health care, provider network structure, poor outcomes for care delivered or arranged, provider disputes including disputes over compensation or contractual provisions, ERISA claims, allegations related to calculations of cost sharing and claims related to our administration of self-funded business.

10 unchanged sentences

We are frequently the subject of regulatory market conduct and other reviews, audits and investigations by state insurance and health and welfare and pharmacy departments, attorneys general, DOJ, CMS, DOL and the HHS-OIG and comparable authorities in foreign jurisdictions.

Additionally, we are, and may in the future be, subject to qui tam actions in which the government may or may not

Additionally, we have in the past been, and may in the future be, subject to qui tam actions in which the government may or may not intervene.

With respect to our Medicare Advantage and Medicare Part D businesses, CMS and HHS-OIG perform audits to determine a health plan's compliance with federal regulations and contractual obligations, including compliance with proper coding practices and fraud and abuse enforcement practices through audits designed to detect and correct improper payments.

Certain of our contracts are currently subject to RADV audits by CMS and the HHS-OIG.

These audits could result in significant adjustments in payments made to our health plans, which could adversely affect our results of operations.

Certain of our contracts currently have RADV audits by CMS and the HHS-OIG that are awaiting CMS finalization.

These audits could result in repayments to the government.

There also continues to be heightened review by federal and state regulators of business and reporting practices within the health services industry, including with respect to claims payment and related escheat practices, and increased scrutiny by other federal and state governmental agencies (such as state attorneys general) empowered to bring criminal actions in circumstances that could have previously given rise only to civil or administrative proceedings.

In addition, various government agencies have conducted investigations and audits into certain pharmacy benefit management practices.

Many of these investigations and audits have resulted in other companies being subject to civil penalties, including the payment of money and entry into corporate integrity agreements.

For example, the FTC is conducting an ongoing study of the pharmacy benefit manager industry and the impact of pharmacy benefit managers on the accessibility and affordability of prescription drugs.

In June 2022, the FTC issued an enforcement policy statement indicating the FTC would scrutinize the impact of rebates and fees paid by pharmaceutical manufacturers to pharmacy benefit managers and other intermediaries to determine if laws such as the FTC Act, the Clayton Act, the Robinson-Patman Act and the Sherman Act may have been violated.

In July 2023, the FTC voted to issue a statement cautioning against reliance on prior advocacy letters that advocated against proposals to increase regulatory oversight and transparency of pharmacy benefit managers.

The FTC previously required three group purchasing organizations to provide information and records on business practices and the six largest pharmacy benefit managers to provide information and records on topics including rebate contracts and ancillary agreements, documents related to strategies, conditions and plans for formulary placement, formulary exclusion, formulary tier assignment, and prior authorization regarding rebated drug products, and annual pharmacy reimbursement data for drugs on specialty drug lists and for rebated drug products.

Many investigations and audits have resulted in companies being subject to civil penalties, including the payment of money and entry into corporate integrity agreements.

For example, in September 2023, we resolved certain matters related to our Medicare Advantage Business and risk adjustment practices by entering into the Corporate Integrity Agreement (the “CIA”) with the HHS-OIG.

The CIA imposes various compliance, reporting and governance obligations on us for five years and requires record reviews by an independent review organization.

Our failure to meet these obligations could result in monetary penalties and our exclusion from participation in federal healthcare programs (such as Medicare and Medicaid), which could adversely impact our business, cash flows, financial condition, results of operations and reputation.

Any failure, or alleged failure, to comply with various state and federal health care laws

and regulations, including those related to the CIA or otherwise directed at preventing fraud and abuse in government funded programs, has resulted in and could in the future result in investigations or litigation, such as actions under the federal False Claims Act and similar whistleblower statutes under state laws.

We cannot predict what effect, if any, such government investigations and audits may ultimately have on us or on the industry in general.

However, we will likely continue to experience government scrutiny and audit activity, which has and may in the future result in civil penalties.

Regulatory audits, investigations, litigation or reviews or actions by other government agencies could result in changes to our business practices, retroactive adjustments to certain premiums, significant fines, penalties, civil liabilities, criminal liabilities or other sanctions, including corporate integrity agreements, restrictions on our ability to participate in government programs or exclusion from such programs, market certain products or engage in business-related activities, that could have a material adverse effect on our business, results of operation, financial condition and liquidity.

Regulatory audits, investigations, litigation or reviews or actions by other government agencies have resulted in and could result in changes to our business practices, retroactive adjustments to certain premiums, significant fines, penalties, civil liabilities, criminal liabilities or other sanctions, including corporate integrity agreements, restrictions on our ability to participate in government programs or exclusion from such programs, market certain products or engage in business-related activities, that could have a material adverse effect on our business, results of operation, financial condition and liquidity.

In addition, disclosure of an adverse investigation or audit or the imposition of fines or other sanctions could negatively affect our reputation in certain markets and make it more difficult for us to sell our products and services.

2 unchanged sentences

If we fail to comply with applicable privacy, security and data laws, regulations and standards, our business and reputation could be materially adversely affected.

Most of our activities involve the receipt, use, storage or transmission of a substantial amount of individuals' PHI and personally identifiable information.

We also use aggregated and anonymized data for research and analysis purposes, and in some cases, provide access to such de-identified data, or analytics created from such data, to pharmaceutical manufacturers and third-party data aggregators and analysts.

Most of our activities involve the receipt, use, storage or transmission of a substantial amount of individuals' PI, including PHI.

We also use aggregated and/or anonymized data for research and analysis purposes, and in some cases, provide access to such anonymized data, or analytics created from such data, to pharmaceutical manufacturers and third-party data aggregators and analysts.

We may also use such information to create analytic models designed to predict, and potentially improve, outcomes and patient care.

The collection, dissemination, receipt, maintenance, protection, use, transmission, disclosure, privacy, confidentiality, security, availability, integrity, creation, processing, and disposal of sensitive personal information are regulated at the federal, state, international and industry levels and requirements are imposed on us by contracts with clients.

The collection, dissemination, receipt, maintenance, protection, use, transmission, disclosure, privacy, confidentiality, security, availability, integrity, creation, processing, and disposal of PI are regulated at the federal, state, international and industry levels and requirements are imposed on us by contracts with clients.

In some cases, such laws, rules, regulations and contractual requirements also apply to our vendors and require us to obtain written assurances of their compliance with such requirements.

We are also subject to various other consumer protection laws that regulate our communications with customers.

We are also subject to various other consumer protection laws that regulate our communications with customers, such as the FTC Act and the Telephone Consumer Protection Act.

Certain of our businesses are also subject to the Payment Card Industry Data Security Standard, which is designed to protect credit card account data as mandated by payment card industry entities.

6 unchanged sentences

While we endeavor to provide appropriate protections through our contracts with our third-party service providers and in certain cases assess their security controls, we have limited oversight or control over their actions and practices.

Several of our businesses act as business associates to their covered entity customers and, as a result, collect, receive, use, disclose, transmit and maintain sensitive personal information in order to provide services to these customers.

Several of our businesses act as business associates to their covered entity clients and, as a result, collect, receive, use, disclose, transmit and maintain PHI in order to provide services to these customers.

HHS administers an audit program to assess HIPAA compliance efforts by covered entities and business associates.

In addition, HHS continues to exercise its enforcement authority to bring enforcement actions resulting from complaints, compliance reviews, audits and investigations brought on by notification to HHS of a breach.

An audit resulting in findings or allegations of noncompliance or the implementation of an enforcement action could have an adverse effect on our results of operations, financial position, cash flows and reputation.

Noncompliance or findings of noncompliance with applicable laws, regulations or requirements, or the occurrence of any privacy or security breach involving the misappropriation, loss or other unauthorized disclosure of protected personal information, whether by us or by one of our third-party service providers, could materially adversely affect our business and reputation, including our results of operations, financial position and cash flows.

Effective prevention, detection and control systems are critical to maintain regulatory compliance and prevent fraud and failure of these systems could adversely affect us.

Noncompliance or findings of noncompliance with applicable laws, regulations or requirements, or the occurrence of any privacy or security breach involving the misappropriation, loss or other unauthorized disclosure of PI, whether by us or by one of our third-party service providers, could materially adversely affect our business and reputation, including our results of operations, financial position and cash flows.

Effective prevention, detection and control systems are critical to maintain regulatory compliance and prevent fraud;

failure of these systems could adversely affect us.

Federal and state governments have made investigating and prosecuting health care and other insurance fraud and abuse a priority.

13 unchanged sentences

The value of these investment assets can fluctuate significantly with changes in market conditions.

A rise in interest rates would likely reduce the value of our investment portfolio, increase interest expense on our indebtedness and increase investment income as investment assets mature and are replaced.

In addition, an economic contraction could result in delay in payment of principal or interest by issuers, or defaults by issuers, reducing our investment income and requiring us to write down the value of our investments.

8 unchanged sentences

Financial strength, claims paying ability and debt ratings by recognized rating organizations are each important factors in establishing the competitive position of insurance and health benefits companies.

Ratings information by nationally recognized ratings agencies is broadly disseminated and generally used throughout the industry.

Ratings information by nationally recognized rating agencies is broadly disseminated and generally used throughout the industry.

We believe that the claims paying ability and financial strength ratings of our principal insurance subsidiaries are important factors in marketing our products to certain customers.

Our debt ratings impact both the cost and availability of future borrowings and, accordingly, our cost of capital.

Each of the rating agencies reviews

ratings periodically and there can be no assurance that current ratings will be maintained in the future.

Each of the rating agencies reviews ratings periodically and there can be no assurance that current ratings will be maintained in the future.

A downgrade of any of these ratings in the future could make it more difficult to either market our products successfully or raise capital to support business growth.

15 unchanged sentences

• Employers may take action to reduce their operating costs by modifying, delaying or canceling plans to purchase our products or making changes in the mix of products purchased that are unfavorable to us.

• Higher unemployment rates, employee attrition (including challenges filling open positions in light of an increasingly competitive job market) and workforce reductions could result in lower enrollment in our employer-based plans (including an increase in the number of employees who opt out of employer-based plans) or our individual plans.

• Higher unemployment rates, employee attrition (including challenges filling open positions in light of a competitive job market) and workforce reductions could result in lower enrollment in our employer-based plans (including an increase in the number of employees who opt out of employer-based plans) or our individual plans.

• Because of unfavorable economic conditions or the ACA, employers may stop offering health care coverage to employees or elect to offer this coverage on a voluntary, employee-funded basis as a means to reduce their operating costs.

20 unchanged sentences

Although a portion of our reinsurance exposures are secured, the inability to collect a material recovery from a reinsurer could have a material adverse effect on our results of operations, financial condition and liquidity.

UNRESOLVED STAFF COMMENTS

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors