What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-02-27 compared with 2024-02-28 · 58 added, 64 removed, 263 unchanged (32% of the section changed)

15 unchanged sentences

Through our risk-based benefit products, we assume the risk of both medical and administrative costs for our customers in return for monthly premiums.

We generally use approximately 80% to 85% of our premium revenues to pay the costs of health care services delivered to these customers.

The profitability of our products depends in large part on our ability to predict and effectively price for and manage medical costs.

2 unchanged sentences

Estimates of benefit expense payments involve extensive judgement and are subject to considerable inherent variability.

Relatively small differences between predicted and actual medical costs, or utilization rates as a percentage of revenues, can result in significant changes in our financial results.

Relatively small differences between predicted and actual medical costs, or utilization rates as a percentage of revenues, have resulted and in the future may result in significant changes in our financial results.

If we fail to predict accurately, or effectively price for or manage, the costs of providing care under risk-based arrangements, our results of operations could be materially and adversely affected.

21 unchanged sentences

We depend on the integrity of the data in our information systems to implement new and innovative services, automate and deploy new technologies to simplify administrative processes and clinical decision making, price our products and services adequately, provide effective service to our customers and consumers in an efficient and uninterrupted fashion, provide timely payments to care providers, and accurately report our results of operations.

In addition, connectivity among technologies is becoming increasingly important and recent trends toward greater consumer engagement in health care require new and enhanced technologies, including more sophisticated applications for mobile devices and new tools and products that leverage AI/ML to improve the customer experience.

In addition, increasing connectivity among technologies and recent trends toward greater consumer engagement in health care require new and enhanced technologies, including more sophisticated applications for mobile devices and new tools and products that leverage AI/ML to improve the customer experience.

We anticipate that fast-evolving AI/ML technologies, including generative AI, will play an increasingly important role in our information systems and customer-facing technology products.

Our ability to protect and enhance existing systems and develop new systems to keep pace with changes in information processing technology (including AI/ML), regulatory standards and changing customer preferences will require an ongoing commitment of significant development and operational resources.

If these commitments fail to provide the anticipated benefits, if we are unable to successfully anticipate future technology developments, or if the cost to keep pace with the technological changes exceed our estimates, we could be exposed to reputational harm and experience adverse effects on our business.

If these commitments fail to provide the anticipated benefits, if we are unable to successfully anticipate future technology developments, or if the cost to keep pace with the technological changes exceeds our estimates, we could be exposed to reputational harm and experience adverse effects on our business.

We may not successfully implement our initiatives to consolidate the number of systems we operate, upgrade and expand our information systems’ capabilities, integrate and enhance our systems and develop new systems to keep pace with recent regulations and changes in information processing technology.

5 unchanged sentences

and international laws and regulations related to health data and health information technologies, including those powered by or incorporating AI/ML, may alter the competitive landscape or impose new compliance requirements and could materially and adversely affect the configuration of our information systems and platforms, and our ability to compete in our markets.

If we or third parties we rely on sustain cyber-attacks or other privacy or data security incidents resulting in disruption to our operations or the disclosure of protected personal information or proprietary or confidential information, we could suffer a loss of revenue and increased costs, negative operational affects, exposure to significant liability, reputational harm and other serious negative consequences.

If we or third parties we rely on sustain cyberattacks or other privacy or data security incidents resulting in disruption to our operations or the disclosure of protected personal information or proprietary or confidential information, we could suffer a loss of revenue and increased costs, negative operational effects, exposure to significant liability, reputational harm and other serious negative consequences.

We routinely process, store and transmit large amounts of data in our operations, including protected personal information subject to privacy, security or data breach notification laws, as well as proprietary or confidential information relating to our business or third parties.

Some of the data we process, store and transmit may be outside of the United States due to our information technology systems and international business operations.

We are regularly the target of attempted cyber-attacks and other security threats and have previously been, and may in the future be, subject to compromises of the information technology systems we use, information we hold, or information held on our behalf by third parties.

While we have programs in place to detect, contain and respond to data security incidents and provide employee awareness training regarding phishing, malware and other cyber threats to protect against cyber risks and security incidents, we expect that we will continue to experience these incidents, some of which may negatively affect our business.

Further, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are increasing in sophistication, in part due to use of evolving AI/ML technologies (including generative AI), and because our businesses are changing as well, we

may be unable to anticipate these techniques and threats, detect data security incidents or implement adequate preventive measures.

We are regularly the target of attempted cyberattacks and other security threats and have previously been, and may in the future be, subject to compromises of the information technology systems we use, information we hold, or information held on our behalf by third parties.

For example, we previously reported our Change Healthcare business, which we had recently acquired, was subject to a cyberattack in 2024, in which the data involved contained protected health information or personally identifiable information.

While we have programs in place to detect, contain and respond to data security incidents and provide employee awareness training regarding phishing, malware and other cyber threats to protect against cybersecurity risks and incidents, we expect that we will continue to experience these incidents, some of which may negatively affect our business.

incidents or implement adequate preventive measures.

Threat actors and hackers have previously been, and may in the future be, able to negatively affect our operations by penetrating our security controls and causing system and operational disruptions or shutdowns, accessing, misappropriating or otherwise compromising protected personal information or proprietary or confidential information or that of third parties, and developing and deploying viruses, ransomware and other malware that can attack our systems, exploit any security vulnerabilities, and disrupt or shutdown our systems and operations.

In addition, hardware, software, or applications we develop or procure from third parties may contain defects or other problems which could unexpectedly compromise our information security controls.

Our systems may also be vulnerable to financial fraud schemes, misplaced or lost data, human error, malicious social engineering, or other events which could negatively affect the data or financial accounts, proprietary or confidential information relating to our business or third parties, or our operations.

There have previously been and may be in the future heightened vulnerabilities due to the lack of physical supervision and on-site infrastructure for remote workforce operations and for recently-acquired or non-integrated businesses.

We rely in some circumstances on third-party vendors to process, store and transmit large amounts of data for our business whose operations are subject to similar risks.

The costs to eliminate or address the foregoing security threats and vulnerabilities before or after a cyber-incident could be material.

We have business continuation and resiliency plans which are maintained, updated and tested regularly in an effort to contain and remediate potential disruptions or cyber events.

Our systems may also be vulnerable to financial fraud schemes, misplaced or lost data, error, malicious social engineering, or other events which could negatively affect the data or financial accounts, proprietary or confidential information relating to our business or third parties, or our operations.

There have previously been and may be in the future heightened vulnerabilities due to recently-acquired or non-integrated businesses.

We rely in some circumstances on third-party vendors to process, store and transmit large amounts of data for our business.

The operations of these vendors are subject to similar risks, but are outside our direct oversight and control.

The costs to eliminate or address the foregoing security threats and vulnerabilities before or after a cybersecurity incident could be material.

We have business continuation and resiliency plans which we maintain, update and test regularly in an effort to contain and remediate potential disruptions or cybersecurity events.

If our remediation efforts are not successful, we may experience operational interruptions, delays, or cessation of service and loss of existing or potential customers.

In addition, compromises of our security measures or the unauthorized dissemination of sensitive personal information, proprietary information or confidential information about us, our customers or other third parties, previously and in the future, could expose us or them to the risk of financial or medical identity theft, negative operational affects, expose us or them to a risk of loss or misuse of this information, result in litigation and liability, including regulatory penalties, for us, damage our brand and reputation, or otherwise harm our business.

If we fail to compete effectively to maintain or increase our market share, including maintaining or increasing enrollments in businesses providing health benefits, our results of operations, financial position and cash flows could be materially and adversely affected.

Our businesses face significant competition in all of the geographic markets in which we operate.

In particular geographies or product segments, our competitors may have certain competitive advantages.

Our competitive position may also be adversely affected by significant merger and acquisition activity in the industries in which we operate, among both our competitors and suppliers.

Consolidation may make it more difficult for us to retain or increase our customer base, improve the terms on which we do business with our suppliers, or maintain or increase our profitability.

In addition, our success in the health care marketplace and future growth depends on our ability to develop and deliver innovative and potentially disruptive products and services to satisfy evolving market demands.

If we do not continue to innovate and provide products and services which are useful and relevant to health care payers, consumers and our customers, we may not remain competitive and risk losing market share to existing competitors and disruptive new market entrants.

We may face risks from new technologies and market entrants which could affect our existing relationship with health plan enrollees in these areas.

We could sustain competitive disadvantages and loss of market share if we fail to continue developing innovative care models, including by accelerating the transition of care to value-based models that achieve higher quality outcomes and better experiences at lower costs and expand access to virtual and in-home care.

Additionally, our competitive position could be adversely affected by any failure to develop and apply innovative technologies and other effective data and analytics capabilities or to provide services to our clients focused on these technologies and capabilities.

Our business, results of operations, financial position and cash flows also could be materially and adversely affected if we do not compete effectively in our markets, if we set rates too high or too low in highly competitive markets, if we do not design and price our products properly and competitively, if we are unable to innovate and deliver products and services demonstrating value to our customers, if we do not provide a satisfactory level of services, if membership or demand for other services does not increase as we expect or declines, or if we lose accounts with more profitable products while retaining or increasing membership in accounts with less profitable products.

The resumption of Medicaid redeterminations has impacted our membership levels and may impact our ability to maintain market share if we are unable to retain or add new consumers to other benefit offerings.

In addition, compromises of our security measures or the unauthorized dissemination of sensitive personal information, proprietary information or confidential information about us, our customers or other third parties, previously and in the future, could expose us or them to the risk of financial or medical identity theft, negative operational impacts, and loss or misuse of this information, result in litigation and liability, including regulatory penalties, for us, damage our brand and reputation, or otherwise harm our business.

If we fail to develop and maintain satisfactory relationships with health care payers, physicians, hospitals and other service providers, our business could be materially and adversely affected.

We depend substantially on our continued ability to contract with health care payers (as a service provider to those payers), as well as physicians, hospitals, pharmaceutical benefit service providers, pharmaceutical manufacturers and other care and service providers at competitive prices.

If we fail to develop and maintain satisfactory relationships with health care providers, whether in-network or out-of-network, our failure to do so could materially and adversely affect our business, results of operations,

financial position and cash flows.

In addition, some of our activities related to network design, provider participation in networks and provider payments could result in disputes, which may be costly and attract negative publicity.

15 unchanged sentences

In some instances, those providers may dispute the payment for these services and may institute litigation or arbitration relying on state and federal laws that define the compensation that must be paid to out-of-network providers in some circumstances.

The success of some of our businesses depends on maintaining satisfactory relationships with physicians as our employees, independent contractors or joint venture partners.

The success of some of our businesses depends on maintaining satisfactory relationships with employed, affiliated, and independently contracted physicians and joint venture partners.

The physicians who practice medicine or contract with our affiliated physician organizations could terminate their provider contracts or otherwise become unable or unwilling to continue practicing medicine or contracting with us.

6 unchanged sentences

Given the importance of health care providers and other constituents to our businesses, failure to maintain satisfactory relationships with them could materially and adversely affect our results of operations, financial position and cash flows.

Our businesses face significant competition in all of the markets in which we operate.

In many geographies or product segments, our competitors have and may continue to have certain competitive advantages.

Our competitive position may also be adversely affected by significant merger and acquisition activity in the industries in which we operate, among both our competitors and suppliers.

Consolidation among competitors may make it more difficult for us to retain or increase our customer base, maintain or improve the terms on which we do business with our suppliers, or maintain or increase our profitability.

We may face risks from new technologies and market entrants which could affect our existing relationship with health plan enrollees in the affected markets.

If health care payers or providers are unwilling or unable to enter into value-based agreements with us, we may be unable to successfully establish or maintain the contractual or employment relationships necessary to achieve the quality and cost objectives we have for value-based contracting.

Our business, results of operations, financial position and cash flows also could be materially and adversely affected if we do not compete effectively in our markets, if our reputation suffers harm, if we set rates too high or too low in highly competitive markets, if we do not design and price our products properly and competitively, if we are unable to innovate and deliver products and services demonstrating value to our customers, if we do not provide a satisfactory level of services, if membership or demand for other services does not increase as we expect or declines, or if we lose accounts with more profitable products while retaining or increasing membership in accounts with less profitable products.

We are routinely subject to various private party and governmental legal actions and investigations, which could damage our reputation and, if resolved unfavorably, could result in substantial penalties or monetary damages and materially and adversely affect our results of operations, financial position and cash flows.

1 unchanged sentence

Any failure by us to adhere to the laws and regulations applicable to our businesses could subject us to civil and criminal penalties.

Legal actions to which we are a party have included and in the future could include matters related to health care benefits coverage and payment of claims (including disputes with enrollees, customers and contracted and non-contracted physicians, hospitals and other health care professionals), tort claims (including claims related to the delivery of health care services, such as medical malpractice by personnel at our affiliates’ facilities, or by health care practitioners who are employed by us, have contractual relationships with us, or serve as providers to our managed care networks, including as a result of a failure to adhere

to applicable clinical, quality and/or patient safety standards), antitrust claims (including as a result of changes in the enforcement of antitrust laws), whistleblower claims (including claims under the False Claims Act or similar statutes), matters related to our use of personal information or other proprietary data, claims related to alleged failure of our technology products to operate properly or fairly, contract and labor disputes, tax claims and claims related to disclosure of certain business practices.

enforcement of antitrust laws), whistleblower claims (including claims under the False Claims Act or similar statutes), matters related to our use of or alleged failure to adequately safeguard personal information or other proprietary data, claims related to alleged failure of our technology products to operate properly or fairly, contract and labor disputes, tax claims and claims related to disclosure of certain business practices.

In addition, some of our pharmacy services operations are subject to clinical quality, patient safety and other risks inherent in the dispensing, packaging and distribution of drugs, including claims related to purported dispensing and other operational errors.

4 unchanged sentences

Additionally, physicians and other healthcare providers have become subject to an increasing number of legal actions alleging medical malpractice and general professional liabilities.

Even in states that have imposed caps on damages for such actions, litigants are seeking recoveries under new theories of liability that might not be subject to the caps on damages.

Even in states that have imposed caps on damages for such actions, litigants are seeking recoveries under theories of liability that might not be subject to the caps on damages.

These actions involve significant defense costs and could result in substantial monetary damages or damage to our reputation.

We cannot predict the outcome of significant legal actions in which we are involved.

Even in situations where we engage external insurers, our coverage may not be sufficient to cover the entirety of certain claims.

We incur expenses to resolve these matters and current and future legal actions could further increase our cost of doing business and materially and adversely affect our results of operations, financial position and cash flows.

Even in situations where we engage external insurers, our coverage may be disputed or may not be sufficient to cover the entirety of certain claims.

We incur expenses to resolve these matters and current and future legal actions could further increase our cost of doing business, require us to potentially change the way we conduct our business, and materially and adversely affect our results of operations, financial position and cash flows.

Moreover, certain legal actions could result in adverse publicity which could damage our reputation and materially and adversely affect our ability to retain our current business or grow our market share in some markets and businesses.

Our business could suffer, and our results of operations, financial position and cash flows could be materially and adversely affected, if we fail to successfully manage our strategic alliances, to complete, manage or integrate acquisitions and other significant strategic transactions or relationships domestically or outside the United States.

Our business could suffer, and our results of operations, financial position and cash flows could be materially and adversely affected, if we fail to successfully manage our strategic alliances, or to complete, manage or integrate acquisitions and other significant strategic transactions or relationships.

As part of our business strategy, we frequently engage in discussions with third parties regarding possible investments, acquisitions, divestitures, strategic alliances, joint ventures and outsourcing transactions and often enter into agreements relating to such transactions.

3 unchanged sentences

Successful acquisitions also require us to effectively integrate the acquired business into our existing operations, including our internal control environment and culture, or otherwise leveraging its operations which may present risks different from those presented by organic growth and may be difficult for us to manage.

In addition, even with appropriate diligence, pre-acquisition practices of an acquired business have in the past and may in the future expose us to legal challenges and investigations that could subject us to criminal fines or reputational harm.

Even if we are ultimately successful, defending such claims may be costly and result in negative publicity.

For example, we have experienced and in the future may encounter more acute information technology system vulnerabilities or different litigation risk profiles in recently acquired business than we have historically managed.

We may be unable to address such vulnerabilities, inadequacies, differences, or failures soon after acquiring a business, which could undermine integration activities, delay launch of acquired products, and increase infrastructure risk.

In addition, even with appropriate diligence, pre-acquisition practices of an acquired business have exposed us in the past and may expose us in the future to legal challenges and investigations that could subject us to criminal fines or reputational harm.

Even if we are ultimately successful in resolving these matters, defending such claims may be costly and result in negative publicity.

If we cannot successfully integrate our acquired businesses and realize contemplated revenue growth opportunities, cost savings and other synergies, our business, prospects, results of operations, financial position and cash flows could be materially and adversely affected.

As we operate our business outside of the United States, we face risks different from those presented by acquisitions of domestic businesses, including risks in adapting to new markets, languages, business, labor and cultural practices and regulatory environments.

Managing these risks could require us to devote significant senior management attention and other resources to the acquired businesses before we realize anticipated synergies or other benefits from those businesses.

These risks vary widely by country and, outside of the United States, may include political instability, government intervention, unanticipated court decisions, discriminatory regulation and currency exchange controls or other restrictions, which could prevent us from transferring funds from these operations out of the countries in which our acquired businesses operate, or converting local currencies we hold into U.S.

dollars or other currencies.

Foreign currency exchange rates and fluctuations have had and may in future periods have an impact on our shareholders’ equity from period to period, which could adversely affect our debt to debt-plus-equity ratio, and our future revenues, costs and cash flows from international operations.

Any measures we may implement to reduce the effect of volatile currencies may be costly or ineffective.

We are subject to risks associated with public health crises arising from large-scale medical emergencies, pandemics, natural disasters and other extreme events, which have and could have an adverse effect on our business, results of operations, financial condition and financial performance.

We are subject to risks associated with public health crises arising from large-scale medical emergencies, pandemics, natural disasters and other extreme events, which have had and could have an adverse effect on our business, results of operations, financial condition and financial performance.

Large-scale medical emergencies, pandemics, natural disasters, public health crises and other extreme events could have a material adverse effect on our business operations, cash flows, financial conditions and results of operations.

19 unchanged sentences

Our failure to attract, develop, retain, and manage the succession of key employees and executives could adversely affect our business, results of operations and future performance.

We depend on our ability to attract, develop and retain qualified employees and executives, including those with diverse backgrounds, experiences and skills, to operate and expand our business.

We depend on our ability to attract, develop and retain qualified employees and executives, including those with diverse talents, backgrounds, experiences and perspectives, to operate and expand our business.

While we have development and succession plans in place for our key employees and executives, these plans do not guarantee that the services of our key employees and executives will continue to be available to us.

1 unchanged sentence

Experienced and highly skilled employees and executives in the health care and technology industries are in high demand and the market for their services is competitive.

We may have difficulty in replacing key executives because of the limited number of qualified individuals in these industries with the breadth of skills and experience required to operate and

successfully expand our business.

We may have difficulty in replacing key executives because of the limited number of qualified individuals in these industries with the breadth of skills and experience required to operate and successfully expand our business.

Adverse changes to our corporate culture could harm our business operations and our ability to retain key employees and executives.

34 unchanged sentences

Under state guaranty association laws, certain insurance companies can be assessed (up to prescribed limits) for certain obligations to the policyholders and claimants of impaired or insolvent insurance companies which write the same line or similar lines of business.

Any such assessment could expose our insurance entities and other insurers to the risk they would be required to pay a portion of an impaired or insolvent insurance company’s claims through state guaranty associations.

Any such assessment could expose our

insurance entities and other insurers to the risk they would be required to pay a portion of an impaired or insolvent insurance company’s claims through state guaranty associations.

Some of our businesses provide products or services to government agencies.

30 unchanged sentences

regulatory regimes, which vary by jurisdiction, encompass, among other matters, local and cross-border taxation, licensing, tariffs, intellectual property, investment, capital (including minimum solvency margin and reserve requirements), management control, labor, anti-fraud, anti-corruption and privacy and data protection regulations (including requirements for cross-border data transfers).

Any foreign regulator or court may take an approach to the interpretation, implementation and enforcement of

industry regulations which could differ from the approach taken by U.S.

Any foreign regulator or court may take an approach to the interpretation, implementation and enforcement of industry regulations which could differ from the approach taken by U.S.

regulators or courts.

3 unchanged sentences

The health care industry is regularly subject to negative publicity, including as a result of governmental investigations, adverse media coverage and political debate concerning industry regulation.

Negative publicity may adversely affect our stock price and damage our reputation, and expose us to unexpected or unwarranted regulatory scrutiny.

Negative publicity may adversely affect our stock price, damage our reputation, and expose us to unexpected or unwarranted regulatory scrutiny.

As a result of our participation in various government health care programs, both as a payer and as a service provider to payers, we are exposed to additional risks associated with program funding, enrollments, payment adjustments, audits and government investigations which could materially and adversely affect our business, results of operations, financial position and cash flows.

16 unchanged sentences

In general, our bids are based upon certain assumptions regarding enrollment, utilization, medical costs and other factors.

If any of these assumptions are materially incorrect, either as a result of unforeseen changes to the programs on which we bid, implementation of material program or policy changes after our bid submission, or submission by our competitors at lower rates than our bids, our results of operations, financial position and cash flows could be materially and adversely affected.

If any of these assumptions are materially incorrect, either as a result of unforeseen changes to the programs on which we bid, implementation of material program or policy changes after our bid submission, or submissions by our competitors at lower rates than our bids, our results of operations, financial position and cash flows could be materially and adversely affected.

Many of the government health care coverage programs we participate in are subject to the prior satisfaction of certain conditions or performance standards or benchmarks.

1 unchanged sentence

The star rating system considers various measures adopted by CMS, including, among others, quality of care, preventive services, chronic illness management, handling of appeals and customer satisfaction.

Plans must have a rating of four stars or higher to qualify for bonus payments.

Plans must have a rating of four stars or higher to qualify for bonus payments, and CMS has and may make changes to the star rating program that impact the ability of plans to achieve four-star or higher ratings.

If we do not maintain or continue to improve our star ratings, our plans may not be eligible for quality bonuses and we may experience a negative impact on our revenues and the benefits our plans can offer, which could materially and adversely affect the marketability of our plans and the number of people we serve.

4 unchanged sentences

Some state Medicaid programs utilize a similar process.

For example, our UnitedHealthcare Medicare & Retirement and UnitedHealthcare Community & State businesses submit information relating to the health status of enrollees to CMS or state agencies for purposes of determining the amount of certain payments to us.

For example, our UnitedHealthcare Medicare & Retirement and UnitedHealthcare Community & State businesses submit information relating to the health status of enrollees to CMS or state agencies for

purposes of determining the amount of certain payments to us.

CMS and the Office of Inspector General for HHS periodically perform risk adjustment data validation (RADV) audits of selected Medicare health plans to validate the coding practices of and supporting documentation maintained by health care providers.

Some of our local plans have been selected for such audits, which in the past have resulted and in future periods could result in retrospective adjustments to payments made to our health plans, fines, corrective action plans or other adverse action by CMS.

We have been involved, and in the future may become involved in routine, regular and special governmental investigations, audits, reviews and assessments.

We have been and in the future may become involved in routine, regular and special governmental investigations, audits, reviews and assessments.

Such investigations, audits, reviews or assessments sometimes arise out of, or prompt claims by private litigants or whistleblowers regarding, among other allegations, claims that we failed to disclose certain business practices or, as a government contractor, submitted false or erroneous claims to the government.

6 unchanged sentences

As a provider of pharmacy benefit management services, Optum Rx is also subject to an increasing number of licensure, registration and other laws and accreditation standards.

Optum Rx conducts business through home delivery, specialty and compounding pharmacies, pharmacies located in community mental health centers and home infusion, which subjects it to extensive federal, state and local laws and regulations, including those of the DEA and individual state controlled substance authorities, the Food and Drug Administration (FDA) and Boards of Pharmacy.

We could face potential claims in connection with purported errors by our home delivery, specialty or compounding or clinic-based pharmacies or the provision of home infusion services, as well as claims related to the inherent risks in the packaging and distribution of pharmaceuticals and other health care products.

4 unchanged sentences

If we fail to comply with applicable privacy, security, technology and data laws, regulations and standards, including with respect to third-party service providers utilizing protected personal information on our behalf, our business, reputation, results of operations, financial position and cash flows could be materially and adversely affected.

The collection, maintenance, protection, use, transmission, disclosure and disposal of protected personal information are regulated at the federal, state, international and industry levels and addressed in requirements imposed on us by contracts with customers.

Additionally, legislative and regulatory action in the United States at the federal, state and local levels, as well as internationally, is emerging in the areas of AI/ML and automation.

3 unchanged sentences

We expect there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection, information security, and AI/ML and automation in the European Union, UK, Chile, India and other jurisdictions, and we cannot yet determine the impacts such future laws, regulations and standards may have on our businesses or the businesses of our customers.

For example, the European Union’s General Data Protection Regulation (GDPR) imposes stringent European Union data protection requirements on us or our customers, and prescribes substantial penalties for noncompliance.

Many of our businesses are also subject to the Payment Card Industry Data Security Standard, which is a multifaceted security standard designed to protect payment card account data.

Some of our businesses are also subject to the Payment Card Industry Data Security Standard, which is a multifaceted security standard designed to protect payment card account data.

HIPAA requires business associates as well as covered entities to comply with specified privacy and security requirements.

1 unchanged sentence

Several of our businesses act as business associates to their covered entity customers and, as a result, collect, use, disclose and maintain protected personal information in order to provide services to these customers.

HHS administers its audit program to assess HIPAA compliance efforts by covered entities and business associates.

An audit resulting in findings or allegations of noncompliance could damage our reputation and subject us to monetary and other sanctions.

If HHS alleges or finds noncompliance with HIPAA privacy or security requirements, the allegations or findings could damage our reputation and subject us to monetary and other sanctions.

Through our Optum businesses, we maintain a database of administrative and clinical data statistically de-identified in accordance with HIPAA standards.

Noncompliance or findings of noncompliance with applicable laws, regulations or requirements, or the occurrence of any privacy or security breach involving the misappropriation, loss or other unauthorized disclosure of protected personal information, whether by us or by one of our third-party service providers, could have a material adverse effect on our reputation and business and, among other consequences, could subject us to mandatory disclosure to the media, loss of existing or new customers, significant increases in the cost of managing and remediating privacy or security incidents, and material fines, penalties and litigation awards.

Noncompliance or findings of noncompliance with applicable laws, regulations or requirements, or the occurrence of any privacy or security breach involving the misappropriation, loss or other unauthorized disclosure of protected personal information, whether by us or by one of our third-party service providers, could have an adverse effect on our reputation and business and, among other consequences, could subject us to mandatory disclosure to affected customers and the media, loss of existing or new customers, significant increases in the cost of managing and remediating privacy or security incidents, and could also result in significant fines, penalties and litigation awards.

Any of these consequences could have a material and adverse effect on our results of operations, financial position and cash flows.

2 unchanged sentences

With respect to AI/ML, we have developed and implemented policies and procedures intended to promote and sustain responsible design, development, and use of AI/ML, consistent with industry best practices.

Any inadequacy or failure in compliance with our responsible use of AI/ML policies and procedures or emerging laws, regulations and standards governing AI/ML use could cause our technology products not to operate as intended or to produce outcomes that could have a material and adverse effect on our business, reputation, results of operations, financial position and cash flows.

Any inadequacy or failure in compliance with our responsible use of AI/ML policies and procedures or emerging laws, regulations and standards governing AI/ML use could cause our technology products not to operate as intended or to produce outcomes, including possible regulatory enforcement action or litigation that could have a material and adverse effect on our business, reputation, results of operations, financial position and cash flows.

Restrictions on our ability to obtain funds from our regulated subsidiaries could materially and adversely affect our ability to reinvest in our business, service our debt and return capital to our shareholders.

7 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors