HCA Healthcare Inc.: 10-K Risk Factor Changes

There can be no assurance that we will continue to pay dividends.

The Company declares a regular quarterly cash dividend under our cash dividend program. During 2024, the Board of Directors declared four quarterly dividends of $0.66 per share, or $2.64 per share in the aggregate, on our common stock. On January 23, 2025, our Board of Directors declared a quarterly dividend of $0.72 per share on our common stock payable on March 31, 2025 to stockholders of record at the close of business on March 17, 2025.

The declaration, amount and timing of such dividends are subject to capital availability and determinations by our Board of Directors that cash dividends are in the best interest of our stockholders and are in compliance with all respective laws and our agreements applicable to the declaration and payment of cash dividends. Our ability to pay dividends will depend upon, among other factors, our cash flows from operations, our available capital and potential future capital requirements for strategic transactions, including acquisitions, debt service requirements, share repurchases and investing in our existing markets as well as our results of operations, financial condition and other factors beyond our control that our Board of Directors may deem relevant. A reduction in or suspension or elimination of our dividend payments could have a negative effect on our stock price.

Certain of our investors may continue to have influence over us.

On November 17, 2006, HCA Inc. was acquired by a private investor group, including affiliates of HCA founder, Dr. Thomas F. Frist, Jr. and certain other investors. Through their investment in Hercules Holding II and other holdings, certain of the Frist-affiliated investors continue to hold a significant interest in our outstanding common stock (approximately 28% as of January 31, 2025). In addition, pursuant to a stockholders' agreement we entered into with Hercules Holding II and the Frist-affiliated investors, certain representatives of these investors have the continued right to nominate certain of the members of our Board of Directors. As a result, certain of these investors potentially have the ability to influence our decisions to enter into corporate transactions (and the terms thereof) and prevent changes in the composition of our Board of Directors or any transaction that requires stockholder approval.

Item 1B. Unresolved Staff Comments

None.

Item 1C. Cybersecurity

Management is responsible for the day-to-day handling of risks facing our Company, while the Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated certain risk management responsibilities with respect to cybersecurity to our Audit and Compliance Committee.

The Audit and Compliance Committee periodically reviews our data security programs, including cybersecurity processes and procedures regarding cybersecurity threats, AI, disaster recovery and critical business continuity, and reviews our programs and plans that management has established to monitor compliance with data security compliance programs and test emergency operations preparedness. The Audit and Compliance Committee also receives reports regarding risks associated with our data security programs and management’s plans for monitoring and testing compliance with data security regulations.

The Audit and Compliance Committee meetings take place on a quarterly basis and include a report from our Chief Security Officer ("CSO") regarding our security programs, including (i) the status on activities under way to support our security strategy, (ii) an overview of the current threat landscape, including emerging threats and trends that may affect us, (iii) key performance measures of security operations and (iv) general security program needs. The security program includes cybersecurity and information security risk management. Our senior security leadership team has an average of 20 years of data security experience, and each member has served in multiple roles within our security programs.

Item 1C. Cybersecurity

Management is responsible for the day-to-day handling of risks facing our Company, while the Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated certain risk management responsibilities with respect to cybersecurity to our Audit and Compliance Committee.

The Audit and Compliance Committee periodically reviews our data security programs, including cybersecurity processes and procedures regarding cybersecurity threats, AI, disaster recovery and critical business continuity, and reviews our programs and plans that management has established to monitor compliance with data security compliance programs and test emergency operations preparedness. The Audit and Compliance Committee also receives reports regarding risks associated with our data security programs and management’s plans for monitoring and testing compliance with data security regulations.

The Audit and Compliance Committee meetings take place on a quarterly basis and include a report from our Chief Security Officer ("CSO") regarding our security programs, including (i) the status on activities under way to support our security strategy, (ii) an overview of the current threat landscape, including emerging threats and trends that may affect us, (iii) key performance measures of security operations and (iv) general security program needs. The security program includes cybersecurity and information security risk management. Our senior security leadership team has an average of 20 years of data security experience, and each member has served in multiple roles within our security programs.

Management is responsible for the day-to-day handling of risks facing our Company, while the Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated certain risk management responsibilities with respect to cybersecurity to our Audit and Compliance Committee.

The Audit and Compliance Committee periodically reviews our data security programs, including cybersecurity processes and procedures regarding cybersecurity threats, AI, disaster recovery and critical business continuity, and reviews our programs and plans that management has established to monitor compliance with data security compliance programs and test emergency operations preparedness. The Audit and Compliance Committee also receives reports regarding risks associated with our data security programs and management’s plans for monitoring and testing compliance with data security regulations.

Management is responsible for the day-to-day handling of risks facing our Company, while the Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated certain risk management responsibilities with respect to cybersecurity to our Audit and Compliance Committee.

The Board has delegated certain risk management responsibilities with respect to cybersecurity to our Audit and Compliance Committee. The Board has delegated certain risk management responsibilities with respect to cybersecurity to our Audit and Compliance Committee.

The Audit and Compliance Committee periodically reviews our data security programs, including cybersecurity processes and procedures regarding cybersecurity threats, AI, disaster recovery and critical business continuity, and reviews our programs and plans that management has established to monitor compliance with data security compliance programs and test emergency operations preparedness. The Audit and Compliance Committee also receives reports regarding risks associated with our data security programs and management’s plans for monitoring and testing compliance with data security regulations.

The Audit and Compliance Committee periodically reviews our data security programs, including cybersecurity processes and procedures regarding cybersecurity threats, AI, disaster recovery and critical business continuity, and reviews our programs and plans that management has established to monitor compliance with data security compliance programs and test emergency operations preparedness. The Audit and Compliance Committee also receives reports regarding risks associated with our data security programs and management’s plans for monitoring and testing compliance with data security regulations.

The Audit and Compliance Committee meetings take place on a quarterly basis and include a report from our Chief Security Officer ("CSO") regarding our security programs, including (i) the status on activities under way to support our security strategy, (ii) an overview of the current threat landscape, including emerging threats and trends that may affect us, (iii) key performance measures of security operations and (iv) general security program needs. The security program includes cybersecurity and information security risk management. Our senior security leadership team has an average of 20 years of data security experience, and each member has served in multiple roles within our security programs.

The Audit and Compliance Committee meetings take place on a quarterly basis and include a report from our Chief Security Officer ("CSO") Chief Security Officer ("CSO") regarding our security programs, including (i) the status on activities under way to support our security strategy, (ii) an overview of the current threat landscape, including emerging threats and trends that may affect us, (iii) key performance measures of security operations and (iv) general security program needs. Our senior security leadership team has an average of 20 years of data security experience, and each member has served in multiple roles within our security programs.

We seek to leverage a comprehensive risk management program aligned with the National Institute of Technology Cybersecurity Framework 2.0 that encompasses a structured approach to assess, identify, and manage cyber and information security risks. The internal processes for these activities are evaluated for alignment with our objectives and overall risk tolerance. This approach is consistent with our overall risk management efforts. The CSO participates with other senior officers, including the Chief Executive Officer, Chief Information Officer, Chief Financial Officer, Chief Legal and Administrative Officer, Chief Ethics and Compliance Officer and others on our risk management committee, which develops and coordinates enterprise cybersecurity and information security policy and strategy, and provides guidance to senior management.

We utilize cross-functional teams and risk assessment tools and technologies to identify potential cybersecurity and information security threats and risks. These teams include representatives from various departments within our Company to promote a holistic view of the organization’s cybersecurity and information security risk landscape and to facilitate communication. We have implemented multiple layers of security measures designed to protect the confidentiality, integrity and availability of our data and the systems and devices that store and transmit such data. We also seek to embed security measures into software and system development processes and to use current security technologies. In addition, we engage third parties to actively monitor potential threats as well as our security defenses. The risk landscape is assessed to determine the likelihood and potential impact of identified risks. This assessment involves a combination of qualitative and quantitative analyses to help prioritize identified risks and determine the appropriate risk treatment. The effectiveness of the cybersecurity and information security program is tested through a combination of internal and external assessments. Updates are provided to senior management and the Audit and Compliance Committee for informed decision-making and are integrated into our broader enterprise risk management processes.

We also seek to oversee and identify potential cybersecurity and information security threats and risks relating to suppliers and third-party service providers. These efforts may include due diligence to assess the party’s cybersecurity practices, controls, and compliance with relevant statutes and regulations; the use of contractual agreements that outline certain cybersecurity requirements; and using outside services to perform ongoing monitoring of select suppliers and third-party service providers. We also collaborate with select third-party suppliers to develop and align incident response plans.

No risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cybersecurity threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cybersecurity risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.

We seek to leverage a comprehensive risk management program aligned with the National Institute of Technology Cybersecurity Framework 2.0 that encompasses a structured approach to assess, identify, and manage cyber and information security risks. The internal processes for these activities are evaluated for alignment with our objectives and overall risk tolerance. This approach is consistent with our overall risk management efforts. The CSO participates with other senior officers, including the Chief Executive Officer, Chief Information Officer, Chief Financial Officer, Chief Legal and Administrative Officer, Chief Ethics and Compliance Officer and others on our risk management committee, which develops and coordinates enterprise cybersecurity and information security policy and strategy, and provides guidance to senior management.

We utilize cross-functional teams and risk assessment tools and technologies to identify potential cybersecurity and information security threats and risks. These teams include representatives from various departments within our Company to promote a holistic view of the organization’s cybersecurity and information security risk landscape and to facilitate communication. We have implemented multiple layers of security measures designed to protect the confidentiality, integrity and availability of our data and the systems and devices that store and transmit such data. We also seek to embed security measures into software and system development processes and to use current security technologies. In addition, we engage third parties to actively monitor potential threats as well as our security defenses. The risk landscape is assessed to determine the likelihood and potential impact of identified risks. This assessment involves a combination of qualitative and quantitative analyses to help prioritize identified risks and determine the appropriate risk treatment. The effectiveness of the cybersecurity and information security program is tested through a combination of internal and external assessments. Updates are provided to senior management and the Audit and Compliance Committee for informed decision-making and are integrated into our broader enterprise risk management processes.

We also seek to oversee and identify potential cybersecurity and information security threats and risks relating to suppliers and third-party service providers. These efforts may include due diligence to assess the party’s cybersecurity practices, controls, and compliance with relevant statutes and regulations; the use of contractual agreements that outline certain cybersecurity requirements; and using outside services to perform ongoing monitoring of select suppliers and third-party service providers. We also collaborate with select third-party suppliers to develop and align incident response plans.

No risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cybersecurity threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cybersecurity risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.

We seek to leverage a comprehensive risk management program aligned with the National Institute of Technology Cybersecurity Framework 2.0 that encompasses a structured approach to assess, identify, and manage cyber and information security risks. The internal processes for these activities are evaluated for alignment with our objectives and overall risk tolerance. This approach is consistent with our overall risk management efforts. The CSO participates with other senior officers, including the Chief Executive Officer, Chief Information Officer, Chief Financial Officer, Chief Legal and Administrative Officer, Chief Ethics and Compliance Officer and others on our risk management committee, which develops and coordinates enterprise cybersecurity and information security policy and strategy, and provides guidance to senior management.

We seek to leverage a comprehensive risk management program aligned with the National Institute of Technology Cybersecurity Framework 2.0 that encompasses a structured approach to assess, identify, and manage cyber and information security risks. The internal processes for these activities are evaluated for alignment with our objectives and overall risk tolerance. This approach is consistent with our overall risk management efforts. The CSO participates with other senior officers, including the Chief Executive Officer, Chief Information Officer, Chief Financial Officer, Chief Legal and Administrative Officer, Chief Ethics and Compliance Officer and others on our risk management committee, which develops and coordinates enterprise cybersecurity and information security policy and strategy, and provides guidance to senior management.

The CSO participates with other senior officers, including the Chief Executive Officer, Chief Information Officer, Chief Financial Officer, Chief Legal and Administrative Officer, Chief Ethics and Compliance Officer and others on our risk management committee, which develops and coordinates enterprise cybersecurity and information security policy and strategy, and provides guidance to senior management.

We utilize cross-functional teams and risk assessment tools and technologies to identify potential cybersecurity and information security threats and risks. These teams include representatives from various departments within our Company to promote a holistic view of the organization’s cybersecurity and information security risk landscape and to facilitate communication. We have implemented multiple layers of security measures designed to protect the confidentiality, integrity and availability of our data and the systems and devices that store and transmit such data. We also seek to embed security measures into software and system development processes and to use current security technologies. In addition, we engage third parties to actively monitor potential threats as well as our security defenses. The risk landscape is assessed to determine the likelihood and potential impact of identified risks. This assessment involves a combination of qualitative and quantitative analyses to help prioritize identified risks and determine the appropriate risk treatment. The effectiveness of the cybersecurity and information security program is tested through a combination of internal and external assessments. Updates are provided to senior management and the Audit and Compliance Committee for informed decision-making and are integrated into our broader enterprise risk management processes.

In addition, we engage third parties to actively monitor potential threats as well as our security defenses. The effectiveness of the cybersecurity and information security program is tested through a combination of internal and external assessments. Updates are provided to senior management and the Audit and Compliance Committee for informed decision-making and are integrated integrated into our broader enterprise risk management processes.

We also seek to oversee and identify potential cybersecurity and information security threats and risks relating to suppliers and third-party service providers. These efforts may include due diligence to assess the party’s cybersecurity practices, controls, and compliance with relevant statutes and regulations; the use of contractual agreements that outline certain cybersecurity requirements; and using outside services to perform ongoing monitoring of select suppliers and third-party service providers. We also collaborate with select third-party suppliers to develop and align incident response plans.

We also seek to oversee and identify potential cybersecurity and information security threats and risks relating to suppliers and third-party service providers. These efforts may include due diligence to assess the party ’ s cybersecurity practices, controls, and compliance with relevant statutes and regulations; the use of contractual agreements that outline certain cybersecurity requirements; and using outside services to perform ongoing monitoring of select suppliers and third-party service providers.

No risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cybersecurity threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cybersecurity risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.

No risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. No risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cybersecurity threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future.

Item 2. Properties

The following table lists, by state, the number of hospitals (general, acute care, behavioral and rehabilitation) directly or indirectly owned and operated by us as of December 31, 2024:

State

Hospitals

Beds

Alaska

California

1,660

Colorado

2,602

Florida

13,221

Georgia

1,543

Idaho

Indiana

Kansas

1,473

Kentucky

Louisiana

Missouri

1,080

Nevada

1,634

New Hampshire

North Carolina

1,219

South Carolina

1,054

Tennessee

2,651

Texas

14,316

Utah

1,057

Virginia

3,359