Elevance Health Inc.: 10-K Risk Factor Changes

Our business depends significantly on effective information systems, and we have many different information systems for our various businesses, including those that we have acquired as a result of our merger and acquisition activities. Our information systems require an ongoing investment, commitment of significant resources to maintain and enhance existing systems, and development of new systems to keep pace with continuing changes in information processing technology, emerging cyber-security risks, changing customer preferences, evolving industry and regulatory standards and legal requirements, including as a result of the ACA, the Health Plan Transparency Rule, the 2021 Appropriations Act and federal data interoperability regulations. In addition, we may obtain significant portions of our systems-related or other services from independent third parties (and their vendors), which may make our operations vulnerable if such third parties fail to perform and oversee adequately. Further, unauthorized third parties present additional risk, including by propagating misinformation related to products, business and the health industry. Failure to adequately implement, consolidate, integrate, streamline, maintain and upgrade effective and efficient information systems with sufficiently advanced technological capabilities could result in investigations, audits, fines and penalties, competitive and cost disadvantages to us compared to our competitors, could divert management’s time, and could have a material adverse effect on our business, financial condition and results of operations. Failure or disruption of our performance of, or our ability to perform, key business functions, including as a result of the unavailability or cyber-attack of our information technology systems or those of third parties (including cloud service providers), could decrease response times, lower levels of service satisfaction and harm our reputation. Our systems interface with and depend on third-party systems and we could experience service denials if demand for such service exceeds capacity, or these systems fail or experience interruption. Despite our adoption and continued enhancement of business continuity and disaster recovery strategies, there is no guarantee that such efforts will be effective, which could interrupt the functionality of our information technology systems or those of third parties. Our failure to implement adequate business continuity and disaster recovery strategies could significantly reduce our ability to provide products and services to our customers and clients, which could have a material adverse effect on our business and results of operations. In addition, connectivity amongst technologies is becoming increasingly important, with recent trends bringing greater consumer engagement in healthcare; therefore, the pace at which our customers will need enhanced technologies with sophisticated applications for mobile interfaces will quicken. If the information systems we rely upon to run our business were found to be inaccurate or unreliable or if we fail to adequately maintain, upgrade, enhance, expand and protect our information systems, security controls and data integrity effectively, we could experience problems in determining medical -28- -28- -28- cost estimates and establishing appropriate pricing and reserves, have disputes with customers and providers, lengthen the pace of integration activities or otherwise delay the launch of acquired products, face regulatory problems, including sanctions and penalties, incur increases in operating expenses or suffer other adverse consequences, including a decrease in membership. Further, as connectivity of technologies advances, artificial intelligence and business processes supported by large language models that are used by businesses and consumers may not operate as expected or may lead to unintentional bias, discrimination and/or data exposure.

Our business depends significantly on effective information systems, and we have many different information systems for our various businesses, including those that we have acquired as a result of our merger and acquisition activities. Our information systems require an ongoing investment, commitment of significant resources to maintain and enhance existing systems, and development of new systems to keep pace with continuing changes in information processing technology, emerging cyber-security risks, changing customer preferences, evolving industry and regulatory standards and legal requirements, including as a result of the ACA, the Health Plan Transparency Rule, the 2021 Appropriations Act and proposed federal data interoperability regulations. In addition, we may obtain significant portions of our systems-related or other services from independent third parties, which may make our operations vulnerable if such third parties fail to perform adequately. Failure to adequately implement, consolidate, integrate, streamline, maintain and upgrade effective and efficient information systems with sufficiently advanced technological capabilities could result in investigations, audits, fines and penalties, competitive and cost disadvantages to us compared to our competitors, could divert management’s time, and could have a material adverse effect on our business, financial condition and results of operations. Failure or disruption of our performance of, or our ability to perform, key business functions, including as a result of the unavailability or cyber-attack of our information technology systems or those of third parties (including cloud service providers), could decrease response times, lower levels of service satisfaction and harm our reputation. Our systems interface with and depend on third-party systems and we could experience service denials if demand for such service exceeds capacity or these systems fail or experience interruption. Despite our adoption and continued enhancement of business continuity and disaster recovery strategies, there is no guarantee that such efforts will be effective, which could interrupt the functionality of our information technology systems or those of third parties. Our failure to implement adequate business continuity and disaster recovery strategies could significantly reduce our ability to provide products and services to our customers and clients, which could have a material adverse effect on our business and results of operations. The volume of health care data generated and the uses of this data, including electronic health records, are rapidly expanding. Our ability to develop, implement, price, support new and existing products and services, provide service to our customers in an efficient and uninterrupted fashion, and report on our operations depends on the integrity of this data and our information systems. In addition, connectivity amongst technologies is becoming increasingly important, with recent trends bringing greater consumer engagement in healthcare; therefore, the pace at which our customers will need enhanced technologies with sophisticated applications for mobile interfaces will continue to expand. If the information systems we rely upon to run our business were found to be inaccurate or unreliable or if we fail to adequately maintain our information systems, security controls and data integrity effectively, we could experience problems in determining medical cost estimates -27- -27- -27- and establishing appropriate pricing and reserves, have disputes with customers and providers, face regulatory problems, including sanctions and penalties, incur increases in operating expenses or suffer other adverse consequences, including a decrease in membership.

We continue to evolve our business to offer products and services beyond traditional health insurance, including digital health technology, pharmacy services, behavioral and clinical care services, which subjects us to litigation and regulatory risks that are different from our traditional product and services offerings and may materially affect our exposure to other risks. The direct provision of healthcare services by certain of our subsidiaries involves risks of additional litigation brought against us or our associates for alleged malpractice or professional liability claims arising out of the delivery of healthcare and related services. In addition, liability may arise from maintaining healthcare premises that serve the public. Behavioral -31- -31- -31- health services may also raise the risk profile of our business given the critical and sensitive nature of the services provided. In addition, we are, to a certain extent, self-insured with regard to litigation risks, including claims of medical malpractice against our affiliated physicians and us, and it is possible that the level of actual losses will significantly exceed the liabilities recorded for our estimates of the probable costs resulting from self-insured matters. The defense of any actions may result in significant expenses, and if we fail to maintain adequate insurance coverage for these liabilities, or if such insurance is not available, the resulting costs could adversely affect our business, cash flows, financial condition and results of operations. As we become more involved in direct care delivery and the provision of other services, such as crisis management services, there will be an increased possibility of litigation. Additionally, many states in which certain of our subsidiaries operate limit the practice of medicine to licensed individuals or professional organizations comprised of licensed individuals. Business corporations generally may not exercise control over the medical decisions of physicians, and we are not licensed to practice medicine. Rules and regulations relating to the practice of medicine, fee-splitting between physicians and referral sources, and similar issues vary from state to state, and any enforcement actions by governmental officials alleging non-compliance with these rules and regulations could adversely affect our business, cash flows, financial condition and results of operations. Further, in certain states we are required to use professional corporations that are not affiliates, which exposes us to risk in the event the physician owners of those professional corporations take actions that are in breach of the contractual obligations that exist between us. We rely on agreements with customers, confidentiality agreements with associates and third parties, and our trademarks, trade secrets, copyrights and patents to protect our proprietary rights. These legal protections and precautions may not prevent misappropriation of our proprietary information. Litigation and misappropriation of our proprietary information could hinder our ability to market and sell products and services, which could materially and adversely affect our results of operations, financial position and cash flows. Further, certain of our businesses use, develop or sell software products that may contain unexpected design defects or may encounter unexpected complications during integration or when used with other technologies utilized by the customer. A failure of these products to operate as intended and in a seamless fashion with other products could also materially and adversely affect our results of operations, financial position and cash flows.

We continue to evolve our business to offer products and services beyond traditional health insurance, including digital health technology, pharmacy, behavioral and clinical care services, which subjects us to litigation and regulatory risks that are different from our traditional product and services offerings and may materially affect our exposure to other risks. The direct provision of healthcare services by certain of our subsidiaries involves risks of additional litigation brought against us or our associates for alleged malpractice or professional liability claims arising out of the delivery of healthcare and related services. In addition, liability may arise from maintaining healthcare premises that serve the public. Behavioral health services may also raise the risk profile of our business given the critical and sensitive nature of the services provided. In addition, we are, to a certain extent, self-insured with regard to litigation risks, including claims of medical malpractice against our affiliated physicians and us, and it is possible that the level of actual losses will significantly exceed the liabilities recorded for our estimates of the probable costs resulting from self-insured matters. The defense of any actions may result in significant expenses, and if we fail to maintain adequate insurance coverage for these liabilities, or if such insurance is not available, the resulting costs could adversely affect our business, cash flows, financial condition and results of operations. As we become more involved in direct care delivery and the provision of other services, such as crisis management services, there will be an increased possibility of litigation. Additionally, many states in which certain of our subsidiaries operate limit the practice of medicine to licensed individuals or professional organizations comprised of licensed individuals. Business corporations generally may not exercise control over the medical decisions of physicians, and we are not licensed to practice medicine. Rules and regulations relating to the practice of medicine, fee-splitting between physicians and referral sources, and similar issues vary from state to state, and any enforcement actions by governmental officials alleging non-compliance with these rules and regulations could adversely affect our business, cash flows, financial condition and results of operations. Further, in certain states we are required to use professional corporations that are not affiliates, which exposes us to risk in the event the physician owners of those professional corporations take actions that are in breach of the contractual obligations that exist between us.

Our success depends on our ability to attract, develop and retain qualified associates, including those with diverse backgrounds, experience and skill sets, to operate and expand our business. We face intense competition for experienced and highly skilled associates, and we may be unable to attract and retain such associates or competition among potential associates may result in increasing salaries. Adverse changes to our corporate culture could harm our business operations and our ability to retain key associates and executives. An inability to retain existing associates or attract additional associates could have a material adverse effect on our business, cash flows, financial condition and results of operations. -35- -35- -35- In addition, if we are unable to attract, retain and effectively manage the succession plans for key associates and executives, including our President and Chief Executive Officer, our business, results of operations and future performance could be adversely affected. We may have difficulty in replacing key executives because of the limited number of qualified individuals with the breadth of skills and experience required to operate and successfully expand our business. The succession plans we have in place for members of our senior management and employment arrangements with certain key executives do not guarantee that the services of our senior executives will continue to be available to us or that we will be able to attract, transition and retain suitable successors.

Our success depends on our ability to attract, develop and retain qualified employees, including those with diverse backgrounds, experience and skill sets, to operate and expand our business. We face intense competition for experienced and highly skilled employees, and we may be unable to attract and retain such employees or competition among potential employers may result in increasing salaries. Adverse changes to our corporate culture could harm our business operations and our ability to retain key employees and executives. An inability to retain existing employees or attract additional employees could have a material adverse effect on our business, cash flows, financial condition and results of operations. In addition, if we are unable to attract, retain and effectively manage the succession plans for key employees and executives, including our President and Chief Executive Officer, our business, results of operations and future performance could be adversely affected. We may have difficulty in replacing key executives because of the limited number of qualified individuals with the breadth of skills and experience required to operate and successfully expand our business. The succession plans we have in place for members of our senior management and employment arrangements with certain key executives do not guarantee that the services of our senior executives will continue to be available to us or that we will be able to attract, transition and retain suitable successors.

A significant reduction in the number of enrollees in our health benefits programs, pharmacy services, or diversified products and services could adversely affect our business, cash flows, financial condition and results of operations. Factors that have contributed, and may continue to contribute to, a reduction in enrollment include: reductions in workforce by existing customers, a reduction in Medicaid membership due to the end of the temporary suspension of eligibility redetermination for Medicaid recipients in response to the COVID-19 pandemic, a general economic upturn that results in fewer individuals being eligible for Medicaid programs, a general economic downturn that results in business failures and high unemployment rates, employers no longer offering certain healthcare coverage as an employee benefit or electing to offer coverage on a voluntary, employee-funded basis, participation on Public Exchanges, federal and state regulatory changes, failure to obtain new customers or retain existing customers, premium increases and benefit changes, our exit from a specific market, negative publicity and news coverage, and failure to attain or maintain nationally recognized accreditations. The states in which we operate with the largest concentrations of revenues include California, Virginia, New York, Ohio, Indiana, Florida, Texas and Georgia. Due to this concentration of business in these states, we are exposed to potential losses resulting from the risk of state-specific or regional economic downturns impacting these states. If any such negative economic conditions do not improve, we may experience a reduction in existing and new business, which could have a material adverse effect on our business, cash flows, financial condition and results of operations.

A significant reduction in the number of enrollees in our health benefits programs or PBM products or services could adversely affect our business, cash flows, financial condition and results of operations. Factors that could contribute to a reduction in enrollment include: reductions in workforce by existing customers; the end of the temporary suspension of eligibility recertification for Medicaid recipients in response to the COVID-19 pandemic, which will likely result in a reduction in our Medicaid membership; a general economic upturn that results in fewer individuals being eligible for Medicaid programs; a general economic downturn that results in business failures and high unemployment rates; employers no longer offering certain healthcare coverage as an employee benefit or electing to offer coverage on a voluntary, employee-funded basis; participation on Public Exchanges; federal and state regulatory changes; failure to obtain new customers or retain existing customers; premium increases and benefit changes; our exit from a specific market; negative publicity and news coverage; and failure to attain or maintain nationally recognized accreditations. The states in which we operate with the largest concentrations of revenues include California, Virginia, Ohio, New York, Indiana, Texas, Florida and Georgia. Due to this concentration of business in these states, we are exposed to potential losses resulting from the risk of state-specific or regional economic downturns impacting these states. If any such negative economic conditions do not improve, we may experience a reduction in existing and new business, which could have a material adverse effect on our business, cash flows, financial condition and results of operations.

•adverse securities and credit market conditions, which could impact our ability to meet liquidity needs; •any requirement to restate financial results in the event of inappropriate application of accounting principles; •changes in tax laws and regulations or uncertainty in the interpretation of tax laws and regulations that could impact the future value of our deferred tax assets and deferred tax liabilities, or result in significant one-time charges in the current or future taxable years; •a significant failure of our internal control over financial reporting; •negative publicity, including as a result of governmental investigations, adverse media coverage and political debate surrounding industry regulation; •provider fraud that is not prevented or detected and impacts our medical costs or those of self-insured customers; and •failure of our corporate governance policies or procedures. -37- -37- -37-

•adverse securities and credit market conditions, which could impact our ability to meet liquidity needs; •any requirement to restate financial results in the event of inappropriate application of accounting principles; •changes in tax laws and regulations or changes in the interpretation of tax laws and regulations by governmental authorities that could impact the future value of our deferred tax assets and deferred tax liabilities, or result in significant one-time charges in the current or future taxable years; •a significant failure of our internal control over financial reporting; •failure of our prevention and control systems related to employee compliance with internal policies, including data security and data privacy; •provider fraud that is not prevented or detected and impacts our medical costs or those of self-insured customers; •failure to protect our proprietary information and other sensitive data; and •failure of our corporate governance policies or procedures.

We provide pharmacy services and are responsible to regulators and our customers for the delivery of those pharmacy services that we contract to provide. Our pharmacy services business is subject to the risks inherent in the dispensing, packaging, fulfillment and distribution of pharmaceuticals and other healthcare products, including exposure to liabilities and reputational harm related to purported dispensing and other operational errors by us or our pharmacy services suppliers. Any failure by us or one of our pharmacy services suppliers to adhere to the laws and regulations applicable to the dispensing of pharmaceuticals could subject our pharmacy services business to civil and criminal penalties. Our pharmacy services business is subject to federal and state laws and regulations that govern its relationships with pharmaceutical manufacturers, physicians, pharmacies and customers, including without limitation, federal and state anti-kickback laws, beneficiary inducement laws, consumer protection laws, ERISA, HIPAA and laws related to the operation of mail-service pharmacies, as well as an increasing number of licensure, registration and other laws and accreditation standards that impact the business practices of a pharmacy services business. In addition, the pharmacy services business, which conducts business through home delivery and specialty pharmacies, is subject to federal and state laws and regulations, including those of state boards of pharmacy, individual state-controlled substance authorities, the U.S. Drug Enforcement Agency and the U.S. Food and Drug Administration. Growth of our home delivery and specialty pharmacy business subjects us to an increase in licensure requirements, and regulatory and operational risks as our pharmacy services business becomes more vertically integrated. Also, we and our third-party vendors may be subject to certain registration requirements and state and federal laws related to the practice of pharmacy. Noncompliance with applicable laws and regulations by us or our third-party vendors could have material adverse effects on our business, results of operations, financial condition, liquidity and reputation. Federal and state legislatures and regulators also regularly consider new laws and regulations and changes to existing regulations and policies for the industry that could materially affect current industry practices and our business, including the regulation implemented by HHS in November 2020 related to drug manufacturer rebates, spread pricing contract arrangements, the pricing of pharmaceuticals, the 2021 Appropriations Act and potential new regulations regarding rebates, fees from pharmaceutical companies, the development and use of formularies and other utilization management tools, the use -32- -32- -32- of average wholesale prices or other pricing benchmarks, pricing for specialty pharmaceuticals, limited access to networks and pharmacy network reimbursement methodologies and reporting requirements. Recent case law, such as the 2020 U.S. Supreme Court reinstatement of an Arkansas law regulating PBMs, as well as industry publications like the 2021 NAIC white paper on the topic, may increase and impact greater state regulation of PBMs. Further, various government agencies have conducted and continue to conduct investigations and studies into certain pharmacy services practices, which have resulted and may in the future result in PBMs agreeing to civil penalties, including the payment of money and entry into corporate integrity agreements, or could materially and adversely impact the pharmacy services business model.

We provide PBM services through our CarelonRx business and are responsible to regulators and our customers for the delivery of those PBM services that we contract to provide. Our PBM services business is subject to the risks inherent in the dispensing, packaging, fulfillment and distribution of pharmaceuticals and other healthcare products, including exposure to liabilities and reputational harm related to purported dispensing and other operational errors by us or our PBM services suppliers. Any failure by us or one of our PBM services suppliers to adhere to the laws and regulations applicable to the dispensing of pharmaceuticals could subject our PBM business to civil and criminal penalties. Our PBM services business is subject to federal and state laws and regulations that govern its relationships with pharmaceutical manufacturers, physicians, pharmacies and customers, including without limitation, federal and state anti-kickback laws, beneficiary inducement laws, consumer protection laws, ERISA, HIPAA and laws related to the operation of internet and mail-service pharmacies, as well as an increasing number of licensure, registration and other laws and accreditation standards that impact the business practices of a PBM services business. In addition, the PBM services business -30- -30- -30- and the practice of pharmacy are subject to federal and state laws and regulations, including those of state boards of pharmacy, individual state-controlled substance authorities, the U.S. Drug Enforcement Agency and the U.S. Food and Drug Administration. Also, we and our third-party vendors are subject to registration requirements and state and federal laws concerning labeling, packaging, advertising, handling and adulteration of prescription drugs and dispensing of controlled substances. Noncompliance with applicable laws and regulations by us or our third-party vendors could have material adverse effects on our business, results of operations, financial condition, liquidity and reputation. Federal and state legislatures and regulators also regularly consider new laws and regulations and changes to existing regulations and policies for the industry that could materially affect current industry practices and our business, including the regulation implemented by HHS in November 2020 related to drug manufacturer rebates, spread pricing contract arrangements, the pricing of pharmaceuticals, the 2021 Appropriations Act and potential new regulations regarding rebates, fees from pharmaceutical companies, the development and use of formularies and other utilization management tools, the use of average wholesale prices or other pricing benchmarks, pricing for specialty pharmaceuticals, limited access to networks and pharmacy network reimbursement methodologies and reporting requirements. Recent case law, such as the 2020 U.S. Supreme Court reinstatement of an Arkansas law regulating PBMs, as well as industry publications like the 2021 NAIC white paper on the topic, may increase and impact greater state regulation of PBMs.