Cigna Group: 10-K Risk Factor Changes

Our business is highly dependent on maintaining effective information systems, as well as the integrity and timeliness of the data we use to serve our customers and health care providers and to operate our business. If our data were found to be inaccurate or unreliable due to fraud or other error, or if we, or any of the third-party providers or subcontractors that we or they engage, were to fail to maintain information systems and data integrity effectively, we could experience operational disruptions that may impact our clients, customers and health care providers and hinder our ability to provide or establish appropriate pricing for products and services, retain 25 25 25 and attract clients and customers, establish reserves, report financial results accurately and in a timely manner, and maintain regulatory compliance, among other things. Any failure or disruption of our performance of, or our ability to perform, key business functions, including through unavailability or cyberattack of our information technology systems or those of third parties (including cloud service providers), could cause slower response times, decreased levels of service satisfaction and harm to our reputation. Our systems interface with and depend on third-party systems, and we could experience service denials if demand for such service exceeds capacity or a third-party system fails or experiences an interruption. While we have adopted, and continue to enhance, business continuity and disaster recovery plans and strategies, there is no guarantee that such plans and strategies will be effective, which could interrupt the functionality of our information technology systems or those of third parties. Our failure to implement adequate business continuity and disaster recovery strategies could significantly reduce our ability to provide products and services to our customers and clients, which could have material adverse effects on our business and results of operations. Our information technology strategy and execution are critical to our continued success. We must continue to invest in and maintain long-term solutions that will enable us to anticipate customer needs and expectations, enhance the customer experience, act as a differentiator in the market, and protect against cybersecurity risks and threats or other events that could disrupt our information technology systems. Our success is dependent, in large part, on maintaining the effectiveness of existing technology systems and continuing to deliver and enhance technology systems that support our business processes in a cost- and resource-efficient manner. Increasing regulatory and legislative changes will place additional demands on our infrastructure that could have a direct impact on resources available for other strategic initiatives. In addition, recent trends toward greater consumer engagement in health care require new and enhanced technologies, including applications for mobile devices. Connectivity among technologies is becoming increasingly important. We must also develop new systems to meet current market standards and keep pace with continuing changes in information processing technology, evolving industry and regulatory standards, and customer needs. Failure to do so may present compliance challenges and impede our ability to deliver services in a competitive manner. Further, because system development projects are long-term in nature, they may be more costly than expected to complete and may not deliver the expected benefits upon completion. Our failure to effectively invest in, implement improvements to and properly maintain the uninterrupted operation, availability and data integrity of our systems could adversely affect our results of operations, financial position, cash flow and internal controls over financial reporting.

Our business is highly dependent on maintaining effective information systems as well as the integrity and timeliness of the data we use to serve our customers and health care providers and to operate our business. If our data were found to be inaccurate or unreliable due to fraud or other error, or if we, or any of the third-party providers or subcontractors that we or they engage, were to fail to maintain information systems and data integrity effectively, we could experience operational disruptions that may impact our clients, customers and health care providers and hinder our ability to provide or establish appropriate pricing for products and services, retain and attract clients and customers, establish reserves and report financial results accurately and in a timely manner and maintain regulatory compliance, among other things. Our information technology strategy and execution are critical to our continued success. We must continue to invest in and maintain long-term solutions that will enable us to anticipate customer needs and expectations, enhance the customer experience, act as a differentiator in the market, and protect against cybersecurity risks and threats or other events that could disrupt our information technology systems. Our success is dependent, in large part, on maintaining the effectiveness of existing technology systems and continuing to deliver and enhance technology systems that support our business processes in a cost- and resource-efficient manner. Increasing regulatory and legislative changes will place additional demands on our infrastructure that could have a direct impact on resources available for other strategic initiatives. In addition, recent trends toward greater consumer engagement in health care require new and enhanced technologies, including applications for mobile devices. Connectivity among technologies is becoming increasingly important. We must also develop new systems to meet current market standards and keep pace with continuing changes in information processing technology, evolving industry and regulatory standards, and customer needs. Failure to do so may present compliance challenges and impede our ability to deliver services in a competitive manner. Further, because system development projects are long-term in nature, they may be more costly than expected to complete and may not deliver the expected benefits upon completion. Our failure to effectively invest in, implement improvements to and properly maintain the uninterrupted operation, availability and data integrity of our systems could adversely affect our results of operations, financial position, cash flow and internal controls over financial reporting. 23 23 23

We are routinely involved in legal matters arising from our health services business, including but not limited to claims related to the dispensing of pharmaceutical products by our home delivery and specialty pharmacies; pharmacy benefit management services, such as formulary management services; health benefit management services; and provider services. Our pharmacy services operations are subject to liability arising from clinical quality, patient safety and other risks inherent in the dispensing, packaging and distribution of drugs, including claims related to purported dispensing and other operational errors. We also have incurred and likely will continue to incur liability for practices and claims related to our health care business, such as marketing misconduct; failure to timely or appropriately pay for or provide health care services; provider network structure; poor outcomes for care delivered or arranged; provider disputes, including disputes over compensation or contractual provisions; ERISA claims; allegations related to calculations of cost-sharing; and claims related to our administration of self-funded business. In addition, we are routinely involved in numerous claims, lawsuits, regulatory audits, investigations and other legal matters arising, for the most part, in the ordinary course of business. These legal matters could include civil claims (including tort and breach of contract claims) as well as claims arising from alleged violations of certain laws (such as consumer protection or false claims act laws). There are currently, and may be in the future, attempts to bring class action lawsuits against the Company and other companies in our industry; individual plaintiffs also may bring multiple claims regarding the same subject matter against us and other companies in our industry. In addition, various government agencies have conducted investigations, inquiries and audits into certain pharmacy benefit management practices, which in certain instances have resulted in litigation or other adverse outcomes for our Company. For example, the FTC has released two staff reports on PBMs and the accessibility and affordability of prescription drugs. In September 2024, the FTC filed an administrative complaint against Express Scripts and two other PBMs, among others, for allegedly engaging in anticompetitive and unfair rebate practices related to insulin drug pricing. In February 2026, we reached a final settlement with the FTC, which resolved all FTC matters and litigation without a monetary penalty, finding of fault or admission of liability. The settlement requires, among other things, updates to our business practices related to affordability of medications of Express Scripts customers. We are frequently the subject of regulatory market conduct and other reviews, audits and investigations by state insurance, health and welfare and pharmacy departments; attorneys general; the DOJ; the FTC; CMS; the DOL; the HHS-OIG; and comparable authorities in foreign jurisdictions. Additionally, we have previously been, and may in the future be, subject to qui tam actions in which the government may or may not intervene. Although our Medicare Advantage and Medicare Part D businesses were included in the HCSC 24 24 24 transaction, we may have indemnification obligations in certain circumstances related to regulatory audits that were ongoing at the time that transaction was completed. There also continues to be heightened review by federal and state regulators of business and reporting practices within the health services industry, including with respect to claims payment and related escheat practices, and increased scrutiny by other federal and state governmental agencies (such as state attorneys general) empowered to bring criminal actions in circumstances that could have previously given rise only to civil or administrative proceedings. Court decisions and legislative and regulatory activities may increase our exposure to any type of claim. In some cases, substantial noneconomic or punitive damages may be sought. We procure insurance coverage to cover some of these potential liabilities, and we also self-insure a significant portion of our litigation risks. While we maintain some third-party insurance coverage, including excess liability insurance with third-party insurance carriers, certain liabilities or types of damages, such as punitive damages, may not be covered by insurance, insurers may dispute coverage, or the amount of insurance may be insufficient to cover the entire damages awarded. Resolving disputes is often expensive and disruptive, regardless of the outcome. Additionally, it is possible that the resolution of current or future legal matters and claims could result in changes to our industry and business practices, losses material to our results of operations, financial condition, and liquidity or damage to our reputation. Moreover, regulatory investigations and audits have resulted in, and could result in, sanctions or changes to our business practices, including retroactive adjustments to certain premiums, corporate integrity agreements, restrictions on our ability to participate in government programs or exclusion from such programs, and our ability to market certain products or engage in business-related activities. We cannot predict what effect, if any, such government investigations and audits may ultimately have on us or on the industry in general. However, we will likely continue to experience government scrutiny and audit activity, which has resulted in, and may result in, civil penalties. Any failure, or alleged failure, to comply with various state and federal health care laws and regulations, including those directed at preventing fraud, waste and abuse in government-funded programs, has resulted in, and could in the future result in, investigations or litigation, such as actions under the federal False Claims Act and similar whistleblower statutes under state laws. In addition, disclosure of an adverse investigation or audit or the imposition of fines or other sanctions could negatively affect our reputation in certain markets and make it more difficult for us to sell our products and services. A description of material pending legal actions and other legal and regulatory matters is included in Note 22 to the Consolidated Financial Statements included in this Form 10-K. The outcome of litigation and other legal or regulatory matters is always uncertain.

We are routinely involved in numerous claims, lawsuits, regulatory audits, investigations and other legal matters arising, for the most part, in the ordinary course of business. These legal matters could include civil claims (including tort and breach of contract claims) as well as claims arising from alleged violations of certain laws (such as consumer protection or false claims act laws). In addition, we have incurred and likely will continue to incur liability for practices and claims related to our health care business, such as marketing misconduct, failure to timely or appropriately pay for or provide health care, provider network structure, poor outcomes for care delivered or arranged, provider disputes including disputes over compensation or contractual provisions, ERISA claims, allegations related to calculations of cost-sharing, and claims related to our administration of self-funded business. We are also routinely involved in legal matters arising from our health services business, including without limitation claims related to the dispensing of pharmaceutical products by our home delivery and specialty pharmacies, pharmacy benefit management services, such as formulary management services, health benefit management services and provider services. Our pharmacy services operations are subject to the clinical quality, patient safety and other risks inherent in the dispensing, packaging and distribution of drugs, including claims related to purported dispensing and other operational errors. There are currently, and may be in the future, attempts to bring class action lawsuits against the Company and other companies in our industry; individual plaintiffs also may bring multiple claims regarding the same subject matter against us and other companies in our industry. Court decisions and legislative and regulatory activity may increase our exposure to any of these types of claims. In some cases, substantial noneconomic or punitive damages may be sought. We procure insurance coverage to cover some of these potential liabilities, and we also self-insure a significant portion of our litigation risks. While we maintain some third-party insurance coverage, including excess liability insurance with third-party insurance carriers, certain liabilities or types of damages, such as punitive damages, may not be covered by insurance, insurers may dispute coverage, or the amount of insurance may be insufficient to cover the entire damages awarded. Resolving disputes is often expensive and disruptive, regardless of the outcome. Additionally, it is possible that the resolution of current or future legal matters and claims could result in changes to our industry and business practices, losses material to our results of operations, financial condition, and liquidity or damage to our reputation. We are frequently the subject of regulatory market conduct and other reviews, audits and investigations by state insurance and health and welfare and pharmacy departments, attorneys general, DOJ, FTC, CMS, DOL and the HHS-OIG and comparable authorities in 29 29 29 foreign jurisdictions. Additionally, we have, in the past, been, and may in the future be, subject to qui tam actions in which the government may or may not intervene. With respect to our Medicare Advantage and Medicare Part D businesses, which are subject to the HCSC transaction, CMS and HHS-OIG perform audits to determine a health plan's compliance with federal regulations and contractual obligations, including compliance with proper coding practices and fraud and abuse enforcement practices through audits designed to detect and correct improper payments. Certain of our contracts currently have RADV audits by CMS and the HHS-OIG that are awaiting CMS finalization. These audits could result in repayments to the government. There also continues to be heightened review by federal and state regulators of business and reporting practices within the health services industry, including with respect to claims payment and related escheat practices, and increased scrutiny by other federal and state governmental agencies (such as state attorneys general) empowered to bring criminal actions in circumstances that could have previously given rise only to civil or administrative proceedings. In addition, various government agencies have conducted investigations, inquiries and audits into certain pharmacy benefit management practices, which in certain instances has resulted in litigation or other adverse outcomes. For example, the FTC recently released staff reports on PBMs and the accessibility and affordability of prescription drugs. In September 2024, the FTC filed a complaint against Express Scripts and two other PBMs for allegedly engaging in anticompetitive and unfair rebate practices related to insulin drug pricing. Although we strongly disagree with the claims made by the FTC and intend to respond to them vigorously, there can be no assurance that the outcome of these matters will be resolved to our satisfactions. Many investigations and audits have resulted in companies being subject to civil penalties, including the payment of money and entry into corporate integrity agreements. For example, in September 2023, we resolved certain matters related to our Medicare Advantage Business and risk adjustment practices by entering into the CIA with the HHS-OIG. The CIA imposes various compliance, reporting and governance obligations on us for five years and requires record reviews by an independent review organization. Our failure to meet these obligations could result in monetary penalties and our exclusion from participation in federal health care programs (such as Medicare and Medicaid), which could adversely impact our business, cash flows, financial condition, results of operations and reputation. Any failure, or alleged failure, to comply with various state and federal health care laws and regulations, including those related to the CIA or otherwise directed at preventing fraud and abuse in government-funded programs, has resulted in and could in the future result in investigations or litigation, such as actions under the federal False Claims Act and similar whistleblower statutes under state laws. A successful action or claim against us could subject us to damage awards, including treble damages, fines, penalties or other enforcement actions, restrictions on our ability to market or enroll new customers, limits on expansion, restrictions or exclusions from programs or other agreements with federal or state governmental agencies, which could adversely impact our business, cash flows, financial condition, results of operations and reputation. We cannot predict what effect, if any, such government investigations and audits may ultimately have on us or on the industry in general. However, we will likely continue to experience government scrutiny and audit activity, which has and may in the future result in civil penalties. Regulatory audits, investigations, litigation, or reviews or actions by other government agencies have resulted in and could result in changes to our business practices, retroactive adjustments to certain premiums, significant fines, penalties, civil liabilities, criminal liabilities or other sanctions, including corporate integrity agreements, restrictions on our ability to participate in government programs or exclusion from such programs, and our ability to market certain products or engage in business-related activities, that could have a material adverse effect on our business, results of operation, financial condition and liquidity. In addition, disclosure of an adverse investigation or audit or the imposition of fines or other sanctions could negatively affect our reputation in certain markets and make it more difficult for us to sell our products and services. A description of material pending legal actions and other legal and regulatory matters is included in Note 21 to the Consolidated Financial Statements included in this Form 10-K. The outcome of litigation and other legal or regulatory matters is always uncertain.

Our use of AI and ML technologies, as well as more recent technological advances in AI/ML, pose risks to us and subject us to new and existing laws and regulations. The use of generative AI, a relatively new and emerging technology still in the early stages of commercial use, potentially exposes us to additional risks, such as damage to our reputation, competitive position, and business, legal and regulatory risks and additional costs. For example, generative AI has been known to produce false or “hallucinatory” inferences or output. Certain generative AI uses ML and predictive analytics, which can produce inaccurate, incomplete or misleading content; unintended biases and other discriminatory or unexpected results; or errors and inadequacies, any of which may not be easily detectable by us or any of our related service providers. Accordingly, while AI systems may help provide more tailored or personalized user experiences, if the content, analyses or recommendations that AI systems assist in producing on our platform are, or are perceived to be, deficient, inaccurate, biased, unethical or otherwise flawed, our reputation, competitive position and business may be materially and adversely affected. While we are committed to responsible use of AI/ML and following applicable laws and regulations, and while we have made progress developing governance as to use of AI/ML by our organization, any failure to use AI/ML responsibly and to adhere to such laws, regulations and governance could have a material unfavorable effect on our business, results of operations and financial condition. Depending on how existing laws and regulations are interpreted, and as new laws go into effect, we may have to make changes to our business practices to comply with such obligations. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to retrain our AI/ML, require us to comply with outside standards, or cease or limit our use of AI/ML. We may not be able to adequately anticipate or respond to these evolving laws and regulations, and we may need to expend additional resources to adjust our offerings in certain jurisdictions if applicable legal frameworks are inconsistent across jurisdictions. Moreover, because these technologies are highly complex and rapidly developing, it is not possible to predict all of the legal or regulatory risks that may arise relating to our use of such technologies. Our use of AI/ML technologies has resulted and could continue to result in additional compliance costs, regulatory investigations and actions, and lawsuits. For example, we are currently subject to litigation claiming that we improperly used AI in the claims evaluation 27 27 27 process. If we are unable to use AI/ML, or if regulators restrict our ability to use AI/ML for certain purposes, it could make our business less efficient, result in competitive disadvantages, and subject us to potentially unfavorable business impacts. To the extent that we rely on or use the output of AI/ML, any inaccuracies, biases or errors could have unfavorable impacts on us, our business, and our results of operations or financial condition. The impact of regulatory and legal risks associated with AI/ML is largely unknown.

Our use of AI, including ML technologies, as well as more recent technological advances in AI/ML, poses risks to us and subjects us to new and existing laws and regulations. While we are committed to responsible use of AI/ML and following applicable laws and regulations, and while we have made progress developing governance as to use of AI/ML by our organization, any failure to use AI/ML responsibly and to adhere to such laws, regulations and governance could have a material unfavorable effect on our business, results of operations and financial condition. Depending on how existing laws and regulations are interpreted, and as new laws go into 24 24 24 effect, we may have to make changes to our business practices to comply with such obligations. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to retrain our AI/ML, require us to comply with outside standards, or prevent or limit our use of AI/ML. Our use of AI/ML technologies has resulted in and could continue to result in additional compliance costs, regulatory investigations and actions, and lawsuits. For example, we are currently subject to litigation claiming that we improperly used AI in the claims evaluation process. If we are unable to use AI/ML, or if regulators restrict our ability to use AI/ML for certain purposes, it could make our business less efficient, result in competitive disadvantages, and subject us to potential unfavorable business impacts. To the extent that we rely on or use the output of AI/ML, any inaccuracies, biases or errors could have unfavorable impacts on us, our business, and our results of operations or financial condition. The impact of regulatory and legal risks associated with AI/ML is largely unknown.

The future performance of our business depends on our ability to effectively implement and execute our strategic and operational initiatives. Strategic execution risk may be heightened by the complexity across our pharmacy services and health care businesses. In particular, our strategic and operational performance depends on our ability to: •grow and support our product portfolio, expand our addressable markets, develop and effectively implement products and services to improve the accessibility, affordability and transparency of healthcare, and identify and introduce the proper mix, coordination or integration of products that the marketplace will accept; •evaluate drugs for efficacy, value and price to assist clients in selecting a cost-effective formulary; •offer cost-effective home delivery pharmacy and specialty services; •access or continue accessing key drugs and successfully penetrate key treatment categories in our specialty pharmacy business; •deliver discounts to health benefit providers; •transition health care providers from volume-based, fee-for-service arrangements to a value-based system; •improve medical cost competitiveness in our targeted markets; •manage our medical, pharmacy, administrative and other operating costs effectively; •contract with health care providers, pharmacy providers and pharmaceutical manufacturers on market competitive terms; and •develop and create responsible data and analytic solutions to support and improve outcomes for our products, services and solutions, including creating and developing solutions and services through partnerships with other industry participants. 29 29 29 We will be unable to rapidly respond to competitive, economic and regulatory changes if we do not make important strategic and operational decisions quickly; define our appetite for risk; implement new governance, managerial and organizational processes smoothly; and communicate roles and responsibilities clearly. If our strategic and operational initiatives fail or are not executed effectively, our business may be unable to grow as planned, and our consolidated financial position and results of operations could be negatively affected.

The future performance of our business will depend in large part on our ability to effectively implement and execute our strategic and operational initiatives. Successfully executing on these initiatives depends on a number of factors, including our ability to: •differentiate our products, services and solutions from those of our competitors; •develop and bring to market new and innovative products, solutions or programs that focus on improving patient outcomes and experiences, assist in controlling costs, respond to government regulation or respond to challenges within the health care system; •develop and create responsible data and analytic solutions to support and improve outcomes for our products, services and solutions, including creating and developing solutions and services through partnerships with other industry participants; •grow and support our product portfolio, expand our addressable markets, and identify and introduce the proper mix, coordination or integration of products that the marketplace will accept; •evaluate drugs for efficacy, value and price to assist clients in selecting a cost-effective formulary; •offer cost-effective home delivery pharmacy and specialty services; •access or continue accessing key drugs and successfully penetrate key treatment categories in our specialty pharmacy business; •attract and retain sufficient numbers of qualified employees, particularly in a competitive job market; 19 19 19 •attract, develop and maintain collaborative relationships with a sufficient number of qualified partners; •attract new and maintain existing customer and client relationships; •leverage purchase volume to deliver discounts to health benefit providers; •transition health care providers from volume-based fee-for-service arrangements to a value-based system; •improve medical cost competitiveness in our targeted markets; •manage our medical, pharmacy, administrative and other operating costs effectively; and •contract with health care providers, pharmacy providers and pharmaceutical manufacturers on market competitive terms. If our strategic initiatives fail, our business may be unable to grow as planned and we will be unable to rapidly respond to competitive, economic and regulatory changes if we do not make important strategic and operational decisions quickly; define our appetite for risk, implement new governance, managerial and organizational processes smoothly; and communicate roles and responsibilities clearly. If these initiatives fail or are not executed effectively, our consolidated financial position and results of operations could be negatively affected.

Our profitability depends in part on our ability to accurately predict, price for and effectively manage future health care costs. Relatively small differences between predicted and actual medical costs or utilization rates as a percentage of revenue can result in significant changes in our financial results. In addition to appropriately pricing health care costs, we must accurately manage costs through medical management, product design, negotiation of favorable provider contracts and underwriting criteria. Our health care costs are also affected by external events that we cannot forecast or project and over which we have little or no control, including changes in laws and regulations, costly new treatments, new treatment guidelines, provider billing practices, inflation and changes in customers' health care utilization patterns, pandemics, natural disasters, and other large-scale medical emergencies. If we do not accurately price our health care costs, our business, cash flows, financial condition and results of operations could be materially adversely impacted. While we compete on the basis of many service- and quality-related factors, we expect that price will continue to be a significant basis of competition. Our client contracts are subject to negotiation as clients seek to contain their costs, including by reducing benefits offered. Increasingly, our clients seek to negotiate performance guarantees that require us to pay penalties if the guaranteed performance standard is not met. Clients can easily move between our competitors and us. Our clients are well-informed and typically have knowledgeable consultants who seek competing bids from our competitors before contract renewal. For example, our Express Scripts client contracts generally have three-year terms and may be subject to periodic renegotiation of pricing terms based on market factors. If one or more of our large clients terminates or does not renew a contract for any reason, or if the provisions of a contract with a large client are modified with terms less favorable to us, our results of operations could be adversely affected, and we could experience a negative reaction in the investment community. A significant loss of customers or clients resulting from our need to increase or maintain premiums, administrative fees or reimbursement levels could adversely affect our business, cash flows, financial condition and results of operations. In addition, as brokers and benefit consultants seek to enhance their revenue streams, they look to take on services that we typically provide. Each of these events could negatively impact our financial results. Strong competition within the pharmacy benefit business has generated greater demand for lower product and service pricing, increased revenue sharing, and enhanced product and service offerings. These competitive factors have historically applied pressure on our operating margins and caused many companies, including us, to reduce the prices charged for products and services while sharing with clients a greater portion of the formulary rebates and related fees received from pharmaceutical manufacturers. If we are unable to respond effectively, including through the implementation of a rebate-free model for our pharmacy benefit services clients, these trends could negatively impact our ability to attract or retain clients or sell additional services, which could negatively impact our margins and have a material adverse effect on our business and results of operations. In addition, legislative reforms and regulatory or executive actions related to rebates, reporting, owned pharmacies and other activities may adversely affect our ability to price our pharmacy products and services appropriately, as well as our competitive position, cash flows, financial condition and results of operations. Premiums in the Cigna Healthcare segment are generally set for a one-year period and are priced well in advance of the date on which the contract commences or renews. Federal and state regulatory agencies may restrict or prevent entirely our ability to implement changes in premium rates or collect certain administrative fees. Fiscal or other concerns related to the government-sponsored programs in which we participate may cause decreasing reimbursement rates, delays in premium payments, restrictions on implementing changes in premium rates or insufficient increases in reimbursement rates. Our participation in health insurance exchanges through our IFP offerings in certain states involves uncertainties associated with mix and volume of business and could adversely affect our results of operations, financial position and cash flows. 19 19 19

While we compete on the basis of many service- and quality-related factors, we expect that price will continue to be a significant basis of competition and we may face pressure to contain premium rates or administrative fees. Our client contracts are subject to negotiation as clients seek to contain their costs, including by reducing benefits offered. Increasingly, our clients seek to negotiate performance guarantees that require us to pay penalties if the guaranteed performance standard is not met. Clients can easily move between our competitors and us. Our clients are well-informed and typically have knowledgeable consultants who seek competing bids from our competitors before contract renewal. In addition, as brokers and benefit consultants seek to enhance their revenue streams, they look to take on services that we typically provide. Each of these events could negatively impact our financial results. Federal and state regulatory agencies may restrict or prevent entirely our ability to implement changes in premium rates or collect certain administrative fees. Fiscal or other concerns related to the government-sponsored programs in which we participate may cause decreasing reimbursement rates, delays in premium payments, restrictions on implementing changes in premium rates or insufficient increases in reimbursement rates. Any limitation on our ability to maintain or increase our premium or reimbursement levels, or a significant loss of customers or clients resulting from our need to increase or maintain premium, administrative fees or reimbursement levels, could adversely affect our business, cash flows, financial condition and results of operations. Premiums in the Cigna Healthcare segment are generally set for one-year periods and are priced well in advance of the date on which the contract commences or renews. Our revenue on Medicare Advantage plans, IFPs and Medicare Part D plans has been based on rates and bids submitted midyear in the year before the contract year, and in January 2024, the Company entered into the HCSC transaction to sell the Medicare Advantage and Part D plans. Although we have based the premiums we charge and our Medicare Advantage, IFP and Medicare Part D rates and bids on our estimate of future health care costs over the contract period, actual costs may exceed what we estimate in setting premiums. Our participation in health insurance exchanges through our IFP offerings involves uncertainties associated with mix and volume of business and could adversely affect our results of operations, financial position and cash flows. Our health care costs are also affected by external events that we cannot forecast or project and over which we have little or no control, including changes in laws and regulations, as well as pandemics, costly new treatments, new treatment guidelines, provider billing practices, inflation and changes in customers' health care utilization patterns, which may, among other things, impact our ability to appropriately document their health conditions. Our profitability depends, in part, on our ability to accurately predict, price for and effectively manage future health care costs. Relatively small differences between predicted and actual medical costs or utilization rates as a percentage of revenue can result in significant changes in our financial results. Strong competition within the pharmacy benefit business has also generated greater demand for lower product and service pricing, increased revenue sharing, and enhanced product and service offerings. These competitive factors have historically applied pressure on our operating margins and caused many companies, including us, to reduce the prices charged for products and services while sharing with clients a greater portion of the formulary fees and related rebates received from pharmaceutical manufacturers. Our inability to maintain positive trends, or failure to identify and implement new ways to mitigate pricing pressures, could negatively impact our ability to attract or retain clients or sell additional services, which could negatively impact our margins and have a material adverse effect on our business and results of operations. In addition, legislative reforms and regulatory or executive actions related to rebates, reporting, owned pharmacies and other activities may adversely affect our competitive position, cash flows, financial condition and results of operations.

Our business is regulated at the federal, state and international level. The laws and rules governing our business and related interpretations are increasing in number and complexity, are subject to frequent change, and can be inconsistent or in conflict with each other. Noncompliance with applicable regulations by us or third-party vendors could have material adverse effects on our business, results of operations, financial condition, liquidity and reputation. We must identify, assess and respond to new trends in the legislative and regulatory environment, as well as comply with the various existing laws and regulations applicable to our business and respond to policymakers and enforcement agencies accordingly. We expect federal and state governments to continue to enact legislative and regulatory reforms that will or could materially impact various aspects of the health services system, including pharmacy benefits manager, drug pricing or insurance market reforms. These reforms could result in material changes to the way we conduct our business and could impact the market for our products. Existing or future laws, regulations, actions by governmental or regulatory authorities, or judgments could force us to change how we conduct our business; affect the products and services we offer and where we offer them; restrict revenue and enrollment growth; increase our costs, including medical, operating, health care technology and administrative costs; increase our liability; and require enhancements to our compliance infrastructure and internal controls environment. For example, we are required to obtain and maintain approvals from state boards of pharmacy, departments of insurance, and other federal and state regulatory agencies to, among other things, market many of our products, expand into additional geographic or product markets, increase prices for certain regulated products, and consummate some of our acquisitions and dispositions. Delays in obtaining or failure to obtain or maintain these approvals could reduce our revenue or increase our costs. Additionally, we must maintain licenses and registrations in the jurisdictions in which we conduct business, and the suspension, material adverse modification or termination of such licenses and registrations could adversely affect operations. Such licensure subjects many of our business operations and products to state regulation, as well as risks associated with doing business in those jurisdictions. Failure to effectively implement or adjust our strategic and operational initiatives, such as reducing operating costs, adjusting premium pricing or benefit design, or transforming our business model in response to new laws, regulatory changes or executive actions may have a material adverse effect on our results of operations, financial condition and cash flows. Our effective tax rate or tax payments could also be adversely affected by new laws or regulations, both within the United States and in other foreign jurisdictions in which we operate. While we believe that our historical tax positions are consistent with applicable laws, regulations and existing precedent, our tax positions could be challenged by relevant tax authorities, and we may not be successful in any such challenge. The market price of our securities may react to the announcement of such proposals. Customers, investors, employees and other stakeholders have focused on corporate governance, environmental stewardship and social matters. Environmental, social and governance-related laws and regulations, including those aimed at restricting the consideration of these factors by companies and requiring climate- and sustainability-related disclosures, and related stakeholder expectations have resulted, and may in the future result, in increased expenses and management time and attention spent complying with or meeting such laws, regulations or expectations. Overall, environmental, social and governance matters, and related stakeholder reactions, which may be conflicting or divergent, may impact our reputation and have other business impacts which could adversely affect our business. For more information on regulations affecting our business, see "Business – Regulation" in Part I, Item 1 of this Form 10-K.

Our business is regulated at the federal, state, local and international levels. The laws and rules governing our business and related interpretations are increasing in number and complexity, are subject to frequent change, and can be inconsistent or in conflict with 27 27 27 each other. Noncompliance with applicable regulations by us or our third-party vendors could have material adverse effects on our business, results of operations, financial condition, liquidity and reputation. We must identify, assess and respond to new trends in the legislative and regulatory environment, as well as comply with the various existing regulations applicable to our business and respond to policymakers and enforcement agencies accordingly. There are currently pending, and in the future there will likely be, legislative or regulatory proposals or executive actions which seek to manage or significantly change the health services industry, including managing prescription drug costs and health records as well as regulating drug distribution. These and other legislative ideas and executive actions could adversely affect our business. Federal and state governments have enacted, and we expect federal and state governments to continue to enact and seriously consider, many broad-based legislative and regulatory proposals that will or could materially impact various aspects of the health care and related benefits system. In addition, changes to government policies not specifically targeted to the health services industry, such as a change in tax laws and the corporate tax rate, government spending or program cuts or changes, imposition of tariffs across an industry sector such as pharmaceuticals could have significant impacts on our business, results of operations, financial condition and liquidity. There can be no assurance that our effective tax rate or tax payments will not be adversely affected by legislation resulting from these initiatives both within the United States and other foreign jurisdictions in which we operate. In addition, tax laws and regulations are extremely complex and subject to varying interpretations. While we believe that our historical tax positions are consistent with applicable laws, regulations and existing precedent, there can be no assurance that our tax positions will not be challenged by relevant tax authorities or that we would be successful in any such challenge. The trading price of our securities may react to the announcement of such proposals. As disclosed in Part II, Item 5 of this Form 10-K, we have an active share repurchase program authorized by our Board of Directors (the "Board"). Regulators, customers, investors, employees and other stakeholders have focused on environmental, social and governance matters and related disclosures. These changing rules, regulations and stakeholder expectations have previously resulted in increased general and administrative expenses and increased management time and attention spent complying with such regulations or meeting such expectations. For example, the EU's Corporate Sustainability Reporting Directive ("CSRD") will require expansive disclosures on various sustainability topics such as climate change, biodiversity, workforce, supply chain and business ethics by in-scope EU entities and certain non-EU entities with significant cross-border business in EU markets. In addition, California's enacted Climate Corporate Data Accountability Act will require annual disclosures of covered companies' Scope 1, 2 and 3 greenhouse gas emissions. We are assessing our obligations under CSRD and other enhanced reporting requirements based on policymaker direction and expect that compliance could require substantial efforts in the future. Overall, sustainability matters and related stakeholder reaction may impact our reputation and have other business impacts which could adversely affect our business. Existing or future laws, rules, actions by governmental or regulatory authorities, or judgments could force us to change how we conduct our business, affect the products and services we offer and where we offer them, restrict revenue and enrollment growth, increase our costs, including medical, operating, health care technology and administrative costs, and require enhancements to our compliance infrastructure and internal controls environment. Some proposals or criticisms may be bipartisan or gain momentum, and we expect that governmental and regulatory authorities will continue to seek changes to business practices and the health care industry as a whole. For example, health care reforms or the invalidation, modification, repeal or replacement of the ACA or portions thereof could result in material changes to the way we conduct our business, as well as the loss of subsidies related to our IFP offerings, and could impact the market for our products. We are required to obtain and maintain insurance and other regulatory approvals to, among other things, market many of our products, expand into additional geographic or product markets, increase prices for certain regulated products, and consummate some of our acquisitions and dispositions. Delays in obtaining or failure to obtain or maintain these approvals could reduce our revenue or increase our costs. Additionally, we must maintain licenses and registrations in the jurisdictions in which we conduct business, and the suspension, material adverse modification or termination of such licenses and registrations could adversely affect our operations. Such licensure subjects many of our businesses to state regulation of our operations and products, as well as risks associated with doing business in those jurisdictions. Existing or future laws and rules could also require or lead us to take other actions, such as changing our business practices, and could increase our liability. Further, failure to effectively implement or adjust our strategic and operational initiatives, such as by reducing operating costs, adjusting premium pricing or benefit design, or transforming our business model in response to laws, regulatory changes or executive actions may have a material adverse effect on our results of operations, financial condition and cash flows. For more information on regulations affecting our business, see "Business – Regulation" in Part I, Item 1 of this Form 10-K.

As part of our strategy, we regularly consider and enter into strategic transactions, including mergers, acquisitions, joint ventures, licensing arrangements, divestitures and other relationships (collectively referred to as "strategic transactions"). The risks we may face with respect to such strategic transactions include: •significant competition for attractive targets and opportunities, and we may be unable to identify or successfully complete strategic transactions; •the inability to complete any strategic transactions on terms favorable to us within the expected time frames, or at all; •divestitures may result in continued financial exposure, including increased costs due to potential litigation, contingent liabilities, and indemnification of the buyer related to, among other things, lawsuits, regulatory matters, or tax liabilities, following the completion of any other such transaction; •the anticipated benefits from any strategic transactions may not be fully realized or may take longer to realize than expected; •integration and separation activities may result in additional and unforeseen expenses, including facilities and systems consolidation or separation costs and costs to retain key employees, as well as decreases in expected revenues, earnings or cash flows; •the carrying value of goodwill or other intangible assets - which, as of December 31, 2025, was approximately $73.5 billion, representing 47% of our total consolidated assets - may be materially and adversely impacted if acquired businesses do not perform as expected, or if future evaluations require impairment charges that could materially affect our results of operations and shareholders' equity in the period in which the impairment occurs; •the issuance of additional common stock could dilute ownership interests of our shareholders, or the incurrence of additional debt could increase costs and impact our ability to access capital in the future in connection with a strategic transaction; •the integration of businesses may cause increasing complexity in our systems and internal controls and could cause us to fail to meet our financial reporting obligations; and •announcements related to an acquisition could have an adverse effect on the market price of our common stock and other securities. Further, joint ventures and equity investments present risks that are different from acquisitions, including risks related to specific operations and finances of the businesses we invest in; selection of appropriate parties; differing objectives of the various parties; competition between and among parties; compliance activities (including compliance with applicable CMS requirements); growing of the business in a manner acceptable to all parties; the maintenance of positive relationships among the parties, clients and customers; and initial and ongoing governance of joint ventures and customer and business disruption that may occur upon a joint venture termination. For example, in the year ended December 31, 2024, we determined our investment in VillageMD was fully impaired and recorded a $2.7 billion loss in Net investment gains/losses in our Consolidated Statements of Income. See Note 19 to the Consolidated Financial Statements for more information on goodwill and intangibles.

As part of our strategy, we regularly consider and enter into strategic transactions, including mergers, acquisitions, joint ventures, licensing arrangements, divestitures and other relationships (collectively referred to as "strategic transactions"). There is significant competition for attractive targets and opportunities, and we may be unable to identify and successfully complete strategic transactions in the future. In addition, from time to time, we evaluate alternatives for our businesses that do not meet our strategic, growth or profitability objectives, and we may divest or wind down such businesses. We may be unable to complete any such divestiture on terms favorable to us within the expected time frames, or at all. For example, in January 2024, we entered into the HCSC transaction, which is subject to regulatory approvals and other closing conditions. We may be unable to satisfy the closing conditions in a timely 25 25 25 manner to complete the HCSC transaction, or we may otherwise fail to receive the anticipated benefits from the transaction, even if it is completed. We may fail to receive the anticipated benefits from the transaction. We may have continued financial exposure to divested businesses, including the businesses subject to the HCSC transaction, following the completion of any such transaction, including increased costs due to potential litigation, contingent liabilities and indemnification of the buyer related to, among other things, lawsuits, regulatory matters or tax liabilities. Our ability to achieve the anticipated benefits of strategic transactions, including synergies, cost savings, innovation and operational efficiencies, is subject to numerous uncertainties and risks, including our ability to successfully combine or separate business operations, resources and systems, including data security systems and internal financial control standards, in an efficient and effective manner. Integration and separation activities may result in additional and unforeseen expenses, and the anticipated benefits may not be fully realized or may take longer to realize than expected. These activities are complex, costly and time-consuming and may divert management's attention from ongoing business concerns. Delays or issues encountered in these activities could have a material adverse effect on the revenues, expenses, operating results and financial condition of the Company. Additionally, the benefits of strategic transactions and the related timing could be impacted by various factors, including political instability, natural disasters, fluctuations in currency exchange rates, delays in obtaining regulatory approval and changes in regulations. Strategic transactions could result in increased costs, including facilities and systems consolidation or separation costs and costs to retain key employees, decreases in expected revenues, earnings or cash flows, and goodwill or other intangible asset impairment charges. As of December 31, 2024, our goodwill and other intangible assets had a carrying value of approximately $73.8 billion, representing 47% of our total consolidated assets. The value of our goodwill may be materially and adversely impacted if the businesses we acquire do not perform in a manner consistent with our assumptions. Future evaluations requiring an impairment to goodwill and other intangible assets could materially affect our results of operations and shareholders' equity in the period in which the impairment occurs. A material decrease in shareholders' equity could negatively impact our debt ratings or potentially impact our compliance with existing debt covenants. See Note 18 to the Consolidated Financial Statements for more information on goodwill and intangibles. In addition, the trading price of our securities may decline if, among other things, we are unable to achieve our estimates of earnings growth and operational cost savings or the transaction costs are greater than expected. The trading price also may decline if we do not achieve the perceived benefits of a transaction as rapidly or to the extent anticipated by financial or industry analysts. Additionally, joint ventures and equity investments present risks that are different from acquisitions, including risks related to specific operations and finances of the businesses we invest in; selection of appropriate parties; differing objectives of the various parties; competition between and among parties; compliance activities (including compliance with applicable CMS requirements); growing of the business in a manner acceptable to all the parties; the maintenance of positive relationships among the parties, clients and customers; and initial and ongoing governance of joint ventures and customer and business disruption that may occur upon a joint venture termination. For example, in the year ended December 31, 2024, we determined our investment in VillageMD was fully impaired and recorded a $2.7 billion loss in Net investment losses in our Consolidated Statements of Income. Further, we may finance strategic transactions by issuing common stock for some or all of the purchase price that could dilute the ownership interests of our shareholders or by incurring additional debt that could increase costs and impact our ability to access capital in the future. In addition, effective internal controls are necessary to provide reliable and accurate financial reports and to mitigate the risk of fraud. The integration of businesses is likely to cause increasing complexity in our systems and internal controls and make them more difficult to manage. Any difficulties in assimilating businesses into our control system could cause us to fail to meet our financial reporting obligations. We also rely on the internal controls and financial reporting controls of joint venture entities and other entities in which we invest, and their failure to maintain effectiveness or comply with applicable standards may materially and adversely affect us. Ineffective internal controls could also cause investors to lose confidence in our reported financial information, which could negatively impact the trading price of our securities and our access to capital.

Our business is highly dependent upon our ability to perform, in an efficient and uninterrupted fashion, necessary business functions, such as claims processing and payment; the operation of internet support and customer call centers, data centers and corporate facilities; the processing of new and renewal business; the maintenance of appropriate shipment and storage conditions for prescriptions (such as temperature and protection from contamination); and home delivery processing. In some instances, our ability to provide services or products (including processing and dispensing prescriptions) depends on the availability of services and products provided by suppliers, providers, pharmaceutical manufacturers, vendors or shipping carriers. A disruption, or threat of disruption, in our supply chain, or an inability to access or deliver products that meet requisite quality safety standards and patient needs in a timely and efficient manner, could adversely impact our business. Increasing natural disasters in connection with climate change could also be a direct threat to us and our third-party vendors, service providers or other stakeholders. Natural disasters have impacted, and may continue to impact, our customers and pose a risk to our employees and facilities located in the affected region. Responses to such scenarios have included and may include, among other things, making temporary policy changes, such as waiving various medical requirements; assisting with replacement medications; transferring prescriptions; and expanding our help line.

Our business is highly dependent upon our ability to perform, in an efficient and uninterrupted fashion, necessary business functions, such as claims processing and payment, internet support and customer call centers, data centers and corporate facilities, the processing of new and renewal business, the maintenance of appropriate shipment and storage conditions for prescriptions (such as temperature and protection from contamination) and home delivery processing. In some instances, our ability to provide services or products (including processing and dispensing prescriptions) depends on the availability of services and products provided by suppliers, providers, pharmaceutical manufacturers, vendors or shipping carriers. A disruption, or threat of disruption, in our supply chain or inability to access or deliver products that meet requisite quality safety standards and patient needs in a timely and efficient manner could adversely impact our business. Increasing natural disasters in connection with climate change could also be a direct threat to us and our third-party vendors, service providers or other stakeholders. Natural disasters have impacted and may continue to impact our customers and pose a risk to our employees and facilities located in the impacted region. Responses to such scenarios have included and may include, among other things, making temporary policy changes, such as waiving various medical requirements, assisting with replacement medications, transferring prescriptions and expanding our help line. In addition, there is a risk that actions taken to respond to climate change could increase the cost of energy, fuel and other commodities, which would increase our operating costs. We are also subject to risk as a result of information technology disruptions. Any failure or disruption of our performance of, or our ability to perform, key business functions, including through unavailability or cyberattack of our information technology systems or those of third parties (including cloud service providers), could cause slower response times, decreased levels of service satisfaction and harm to our reputation. Our systems interface with and depend on third-party systems, and we could experience service denials if demand for such service exceeds capacity or a third-party system fails or experiences an interruption. For further information related to risks as a result of information technology disruptions, please refer to "—As a large global health company, we and our vendors are subject to cyberattacks or other privacy or data security incidents. If we are unable to prevent or contain the effects of any such attacks, or fail to ensure vendors do the same, we may suffer exposure to substantial liability, reputational harm, loss of revenue or other damages." While we have adopted, and continue to enhance, business continuity and disaster recovery plans and strategies, there is no guarantee that such plans and strategies will be effective, which could interrupt the functionality of our information technology systems or those of third parties. Our failure to implement adequate business continuity and disaster recovery strategies could significantly reduce our ability to provide products and services to our customers and clients, which could have material adverse effects on our business and results of operations.

Our Evernorth Health Services business provides services to government entities and payors participating in government health care programs, and our relationships with these government entities are subject to laws and regulations regarding government contracts. Additionally, through our U.S. Healthcare business, we contract with CMS and various state government agencies. Our revenues from government-funded programs, including our government clients, are dependent, in whole or in part, upon annual funding from the federal government or applicable state or local governments. Funding for these programs is dependent on many factors outside our control, including general economic conditions, continuing government efforts to contain health care costs, budgetary constraints at the federal or applicable state or local level, and general political issues and priorities. These entities generally have the right to not renew or to cancel their contracts with us on short notice without cause or if funds are not available. Unanticipated changes in funding, such as the application of sequestration by the federal or state governments, retroactive rate adjustments, a delay by Congress in raising the federal debt ceiling, or the failure to provide for continued appropriations or regular ongoing scheduled payments to us, could substantially reduce our revenues or profitability or impact our liquidity. 22 22 22 Additionally, if we fail to comply with applicable state or federal regulatory or contractual requirements, including data submission, enrollment and marketing, provider network adequacy, provider directory accuracy, quality measures, claims payment, continuity of care, timely and accurate processing of appeals and grievances, oversight of first-tier downstream and related entities, and call center performance, we may be subject to administrative actions, including enrollment sanctions or contract termination, fines or other penalties or enforcement actions that could materially impact our profitability.

Through our U.S. Healthcare business, we contract with CMS and various state governmental agencies. Additionally, our Evernorth Health Services business provides services to government entities and payors participating in government health care programs, and our relationships with these government entities are subject to laws and regulations regarding government contracts. 28 28 28 Our revenues from government-funded programs, including our Medicare programs and our government clients, are dependent, in whole or in part, upon annual funding from the federal government or applicable state or local governments. Funding for these programs is dependent on many factors outside our control, including general economic conditions, continuing government efforts to contain health care costs, budgetary constraints at the federal or applicable state or local level, and general political issues and priorities. These entities generally have the right to not renew or to cancel their contracts with us on short notice without cause or if funds are not available. Unanticipated changes in funding, such as the application of sequestration by the federal or state governments, retroactive rate adjustments, a delay by Congress in raising the federal debt ceiling, or the failure to provide for continued appropriations or regular ongoing scheduled payments to us, could substantially reduce our revenues or profitability or impact our liquidity. The Medicare program has been the subject of regulatory reform initiatives. The premium rates paid to Medicare Advantage plans and Medicare Part D plans are established by contract, although the rates differ depending on a combination of factors, some of which are outside our control. For example, the base premium rate paid differs depending upon a combination of various factors, such as defined upper payment limits, a member's health status, age, gender, county or region, benefit mix, member eligibility category, and risk scores. Additionally, a portion of each Medicare Advantage plan's reimbursement is tied to the plan's Star Rating, with those plans receiving a rating of four or more stars eligible for quality-based bonus payments. A plan's Star Rating affects its image in the market, and plans that perform well are able to offer enhanced benefits and market more effectively and for longer periods of time than other plans. The Star Rating system is subject to change annually by CMS, which may make it more difficult to achieve four stars or greater. Our Medicare Advantage plans' and Medicare Part D plans' operating results, premium revenue and benefit offerings are likely to continue to be significantly determined by their Star Ratings. There can be no assurances that we will be successful in maintaining or improving our Star Ratings in future years. In addition, audits of our performance for past or future periods may result in downgrades to our Star Ratings. If we do not maintain or improve our Star Ratings, or if the quality-based bonus payments are reduced or eliminated, we may experience a negative impact on our revenue and the marketability of our plans may be adversely affected. Accordingly, our plans may not be eligible for full-level quality bonuses, which could adversely affect the benefits such plans can offer, reduce membership or impact our financial performance. Additionally, if we fail to comply with CMS' regulatory or contractual requirements, including data submission, enrollment and marketing, provider network adequacy, provider directory accuracy, quality measures, claims payment, continuity of care, timely and accurate processing of appeals and grievances, adverse findings under RADV audits, oversight of first-tier downstream and related entities, and call center performance, we may be subject to administrative actions, including enrollment sanctions or contract termination, fines or other penalties or enforcement actions that could materially impact our profitability.

Most of our activities involve the receipt, use, storage, transmission or other processing of a substantial amount of PII, including PHI, as well as financial information (including payment card information) and other confidential and sensitive information about our clients and employees. The processing of such information is regulated at the federal, state, international and industry levels, and requirements are imposed on us by industry standards and contracts with clients. In some cases, such laws, rules, regulations, industry 23 23 23 standards and contractual requirements also apply to our vendors and require us to obtain written assurances of their compliance with such requirements. At the federal level, we are subject to, among other laws and regulations, HIPAA, which requires business associates as well as covered entities to comply with specified privacy and security requirements. While we endeavor to provide appropriate protections through our contracts with our third-party service providers and in certain cases assess their security controls, we have limited oversight or control over their actions and practices. Several of our businesses act as business associates to their covered entity clients and, as a result, collect, receive, use, disclose, transmit and maintain PHI in order to provide services to these customers. If HHS alleges or finds noncompliance with HIPAA requirements or implements an enforcement action against us, it could have an adverse effect on our results of operations, financial position, cash flows and reputation. For example, in 2025, we responded to a voluntary HIPAA security rule audit from HHS's Office for Civil Rights ("OCR"). As participation in this audit was voluntary, the information provided did not result in any HIPAA enforcement action or civil monetary penalty; however, any serious compliance issues could open up subsequent compliance reviews that could include a range of remedies from OCR. Additionally, we are, or may become, subject to U.S. state and international laws and regulations, as well as industry standards such as PCI DSS. These laws, regulations, rules, industry standards and contractual requirements are subject to change and the regulatory environment surrounding data security and privacy is increasingly demanding. Compliance with existing or new privacy, security and data laws, regulations and requirements may result in increased operating costs and may constrain or require us to alter our business model or operations. For more information on privacy regulations to which we are subject, see "Business – Regulation" in Part I, Item 1 of this Form 10-K. Noncompliance or findings of noncompliance with applicable laws, regulations or requirements, or the occurrence of any privacy or security breach involving the misappropriation, loss or other unauthorized disclosure of PII, whether by us or by one of our third-party service providers, could materially adversely affect our business and reputation, including our results of operations, financial position and cash flows.

Most of our activities involve the receipt, use, storage or transmission of a substantial amount of individuals' PII, including PHI. We also use aggregated and/or anonymized data for research and analysis purposes and, in some cases, provide access to such anonymized data, or analytics created from such data, to pharmaceutical manufacturers and third-party data aggregators and analysts. We may also use such information to create analytic models designed to predict, and potentially improve, outcomes and patient care. The collection, dissemination, receipt, maintenance, protection, use, transmission, disclosure, privacy, confidentiality, security, availability, integrity, creation, processing and disposal of PII are regulated at the federal, state, international and industry levels, and requirements are imposed on us by contracts with clients. In some cases, such laws, rules, regulations and contractual requirements also apply to our vendors and require us to obtain written assurances of their compliance with such requirements. We are also subject to various other consumer protection laws that regulate our communications with customers, such as the FTC Act and the Telephone Consumer Protection Act. Certain of our businesses are also subject to the Payment Card Industry Data Security Standard ("PCI DSS"), which is designed to protect credit card account data as mandated by payment card industry entities. International laws, rules and regulations governing the use and disclosure of such information, such as the GDPR, can be more stringent than similar laws in the United States, 30 30 30 and they vary across jurisdictions. In addition, more jurisdictions are regulating the transfer of data across borders, and domestic privacy and data protection laws are generally becoming more onerous. These laws, rules and contractual requirements are subject to change and the regulatory environment surrounding data security and privacy is increasingly demanding. Compliance with existing or new privacy, security and data laws, regulations and requirements may result in increased operating costs and may constrain or require us to alter our business model or operations. For more information on privacy regulations to which we are subject, see "Business – Regulation" in Part I, Item 1 of this Form 10-K. HIPAA requires covered entities and business associates to comply with the HIPAA privacy, security and breach rules. While we endeavor to provide appropriate protections through our contracts with our third-party service providers and in certain cases assess their security controls, we have limited oversight or control over their actions and practices. Several of our businesses act as business associates to their covered entity clients and, as a result, collect, receive, use, disclose, transmit and maintain PHI in order to provide services to these customers. HHS administers an audit program to assess HIPAA compliance efforts by covered entities and business associates. In addition, HHS continues to exercise its enforcement authority to bring enforcement actions resulting from complaints, compliance reviews, audits and investigations brought on by notification to HHS of a breach or other HIPAA violation. An audit resulting in findings or allegations of noncompliance or the implementation of an enforcement action could have an adverse effect on our results of operations, financial position, cash flows and reputation. For example, in December 2024, we received a request for a voluntary audit from HHS's Office for Civil Rights ("OCR") to review our compliance with HIPAA security rules. We are in the process of preparing our initial response to OCR's request. As participation in this audit is voluntary, the information provided will not result in any HIPAA enforcement action or civil monetary penalty; however, any serious compliance issues could open up subsequent compliance reviews that could include a range of remedies from OCR. Noncompliance or findings of noncompliance with applicable laws, regulations or requirements, or the occurrence of any privacy or security breach involving the misappropriation, loss or other unauthorized disclosure of PII, whether by us or by one of our third-party service providers, could materially adversely affect our business and reputation, including our results of operations, financial position and cash flows.

As a global company, our business is increasingly exposed to risks inherent in foreign operations, including challenges arising out from geopolitical conditions, evolving legal and regulatory environment, labor and cultural practices, local civil unrest or political controversy, and foreign currency exchange fluctuations. These factors may increase in significance as we continue to expand globally, and operating in new foreign markets may require considerable management time before operations generate any significant revenues and earnings. Any one of these challenges could negatively affect our operations or long-term growth. International operations also require us to devote significant resources to implement controls and systems in new markets to comply with, and to ensure that our vendors and partners comply with, U.S. and foreign laws prohibiting bribery, corruption and money laundering, in addition to other regulations regarding, among other things, our products, direct-to-consumer communications, customer privacy, data protection and data residency. Violations of these laws and regulations could result in fines; criminal sanctions against us, our officers or employees, restrictions or outright prohibitions on the conduct of our business; and significant reputational harm. Our success depends, in part, on our ability to anticipate these risks and manage these challenges. Our failure to comply with laws and regulations governing our conduct outside of the United States, or to establish constructive relations with non-U.S. regulators, could have a material adverse effect on our business, results of operations, financial condition, liquidity and long-term growth. Please see "—Legal, Regulatory and Public Policy Risks Arising from our Business" above. 28 28 28

As a global company, our business is increasingly exposed to risks inherent in foreign operations. These risks can vary substantially by market and include political, legal, operational, regulatory, economic and other risks, including government intervention that we do not face in our U.S. operations. The global nature of our business and operations may present challenges including, but not limited to, those arising from: •geopolitical business conditions and demands; •regulation that may discriminate against U.S. companies, favor nationalization or expropriate assets; •price controls or other pricing issues and exchange controls, including tariffs; •restrictions that prevent us from transferring funds out of the countries in which we operate; •foreign currency exchange rates and fluctuations and restrictions on converting currencies from foreign operations into other currencies; •uncertainty with respect to the adoption of new tax laws and the interpretation of tax positions, such as the European Union's ("EU’s") recent adoption of the Pillar Two directive; •reliance on local employees and interpretations of labor laws in foreign jurisdictions; •the management of our partner relationships in countries outside of the United States; •the provision of data protection on a global basis and sufficient levels of technical support in different locations; •the global trend for companies to enact local data residency requirements; •acts of civil unrest, war and terrorism, including the ongoing conflict in the Middle East as well as other political and economic conflicts, such as through imposition of economic or political sanctions; •man-made disasters, natural disasters (including those arising as a result of climate change) and pandemics in locations where we operate; and •general economic and political conditions. These factors may increase in significance as we continue to expand globally, and operating in new foreign markets may require considerable management time before operations generate any significant revenues and earnings. Any one of these challenges could negatively affect our operations or long-term growth. International operations also require us to devote significant resources to implement controls and systems in new markets to comply with, and to ensure that our vendors and partners comply with, U.S. and foreign laws prohibiting bribery, corruption and money laundering, in addition to other regulations regarding, among other things, our products, direct-to-consumer communications, customer privacy, data protection and data residency. Violations of these laws and regulations could result in fines; criminal sanctions against us, our officers or employees, restrictions or outright prohibitions on the conduct of our business; and significant reputational harm. Our success depends, in part, on our ability to anticipate these risks and manage these challenges. Our failure to comply with laws and regulations governing our conduct outside of the United States or to establish constructive relations with non-U.S. regulators could have a material adverse effect on our business, results of operations, financial condition, liquidity and long-term growth. Please see "—Legal and Compliance Risks" below.

We operate in a highly competitive, evolving and rapidly changing industry. Industry shifts have resulted and could result from, among other things: •a large intra- or inter-industry merger or industry consolidation; •strategic alliances; •new or alternative business models or new government options or offerings; •continuing consolidation among physicians, hospitals and other health care providers, as well as changes in the organizational structures chosen by physicians, hospitals and health care providers; •new market entrants, including those not traditionally in the health services industry; •the ability of larger employers and clients to contract directly with providers; •technological changes and rapid shifts in the use of technology, such as telehealth and AI; •the impact or consequences of legislation, executive actions or regulatory changes including premium rate increases, public debates over drug pricing, government involvement in drug pricing and purchasing, and public debate over current or proposed legislation; •impacts to distribution channels, including changes to the United States Postal Service or the consolidation of shipping carriers; •increased drug acquisition cost or unexpected changes to drug pricing trend; •changes in the generic/biosimilar drug market or the failure of new generic/biosimilar drugs to come to market; and •changes in utilization of health care, prescription drugs or other covered services and items, including under risk-based contracts in the health benefit management market and for those businesses that utilize risk adjustment methodology. Any significant shifts in the structure of the industry could alter industry dynamics and adversely affect our ability to attract or retain clients and customers. Our failure to anticipate or appropriately adapt to changes in the industry could negatively impact our competitive position and adversely affect our business and results of operations. We must remain competitive to attract new customers, retain existing customers and further integrate additional product and service offerings. We are subject to significant market pressures brought about by customer and client needs, legislative and regulatory developments, and other market factors. Our competitors may have greater, better or more established capabilities, resources, market share, reputation or business relationships, or lower profit margin or financial return expectations. Unless we can demonstrate greater value to our clients through innovative and cost-effective product and service offerings in the rapidly changing health care industry, we may be unable to remain competitive, which could have a material adverse effect on our business, results of operations, financial position and cash flows. Additionally, to succeed in this highly competitive marketplace, we must maintain a strong reputation. Increasingly, our customers, clients and investors consider our efforts on a variety of matters that could impact our stakeholders, including our employees and the communities in which we operate. Our reputation may be negatively impacted by a failure to meet customer expectations for consistent, transparent, high-quality and accessible care or by other significant events, including a failure to execute on customer or client contracts or strategic or operational initiatives, failure to comply with applicable laws or regulations, or failure to innovate and deliver cost-effective products and services that demonstrate greater value to our customers. Negative publicity may come as a result of adverse media coverage, litigation against us and other industry participants, the ongoing public debates over the affordability, accessibility and transparency of health care, and social media and other media relations activities.

The health service industry continues to be dynamic and rapidly evolving. Any significant shifts in the structure of the industry could alter industry dynamics and adversely affect our ability to attract or retain clients and customers. Industry shifts could result (and have resulted) from, among other things: •a large intra- or inter-industry merger or industry consolidation; •strategic alliances; •new or alternative business models or new government options or offerings; •continuing consolidation among physicians, hospitals and other health care providers, as well as changes in the organizational structures chosen by physicians, hospitals and health care providers; •new market entrants, including those not traditionally in the health service industry; •the ability of larger employers and clients to contract directly with providers; •technological changes and rapid shifts in the use of technology, such as telehealth and AI; •the impact or consequences of legislation, executive actions or regulatory changes; •impacts to distribution channels, including changes to the United States Postal Service or the consolidation of shipping carriers; •increased drug acquisition cost or unexpected changes to drug pricing trend; •changes in the generic/biosimilar drug market or the failure of new generic/biosimilar drugs to come to market; or •changes in utilization of health care, prescription drugs or other covered services and items, including under risk-based contracts in the health benefit management market and for those businesses that utilize risk adjustment methodology. Our failure to anticipate or appropriately adapt to changes in the industry could negatively impact our competitive position and adversely affect our business and results of operations.

Federal and state governments have made investigating and prosecuting health care and other insurance fraud, waste and abuse a priority. Fraud, waste and abuse prohibitions encompass a wide range of activities, including kickbacks for referral of customers, billing for unnecessary medical services, improper marketing and violations of patient privacy rights. Some of our businesses are also subject to federal and state laws and regulations that may impact our relationships with health care providers and customers, including laws on self-referrals, beneficiary inducements, false claims, fee-splitting, telemedicine, corporate practice of medicine, dispensing, packaging, fulfillment and distribution of controlled substances, other pharmaceutical products and medical devices, medical malpractice, consumer protection, product liability, narrow networks, provider tiering programs, provider contracts, overpayments, reimbursement of out-of-network claims, and licensure. The regulations and contractual requirements applicable to us are complex and subject to change and may affect our ability to market or provide our products or services. In addition, ongoing vigorous law enforcement, a highly technical regulatory scheme, and the Dodd-Frank Act and related regulations enhance regulators' enforcement powers and whistleblower incentives and protections. Our compliance efforts in this area will continue to require significant resources, and failure to comply with such regulation could adversely affect our reputation and also expose us to litigation and other proceedings, fines and penalties.

Federal and state governments have made investigating and prosecuting health care and other insurance fraud and abuse a priority. Fraud and abuse prohibitions encompass a wide range of activities including kickbacks for referral of customers, billing for unnecessary medical services, improper marketing and violations of patient privacy rights. Some of our businesses are also subject to federal and state laws and regulations that may impact our relationships with health care providers and customers, including laws on self-referrals, beneficiary inducements, false claims, fee-splitting, telemedicine, corporate practice of medicine, dispensing, packaging, fulfillment and distribution of controlled substances, other pharmaceutical products and medical devices, medical malpractice, consumer protection, product liability, narrow networks, provider tiering programs, provider contracts, overpayments, reimbursement of out-of-network claims and licensure. The regulations and contractual requirements applicable to us are complex and subject to change and may affect our ability to market or provide our products or services. In addition, ongoing vigorous law enforcement, a highly technical regulatory scheme, and the Dodd-Frank Act and related regulations enhance regulators' enforcement powers and whistleblower incentives and protections. Our compliance efforts in this area will continue to require significant resources. Failure of our prevention, detection or control systems related to regulatory compliance, or the failure of employees to comply with our internal policies, including data systems security or unethical conduct by managers and employees, could adversely affect our reputation and also expose us to litigation and other proceedings, fines and penalties. In addition, provider or customer fraud that is not prevented or detected could impact our medical costs or those of our self-insured clients. Further, during an economic downturn, we may experience increased fraudulent claims volume that may lead to additional costs due to an increase in disputed claims and litigation.