UnitedHealth Group: 10-K Risk Factor Changes

Our businesses face significant competition in all of the geographic markets in which we operate. In particular geographies or product segments, our competitors may have certain competitive advantages. Our competitive position may also be adversely affected by significant merger and acquisition activity in the industries in which we operate, among both our competitors and suppliers. Consolidation may make it more difficult for us to retain or increase our customer base, improve the terms on which we do business with our suppliers, or maintain or increase our profitability. In addition, our success in the health care marketplace and future growth depends on our ability to develop and deliver innovative and potentially disruptive products and services to satisfy evolving market demands. If we do not continue to innovate and provide products and services which are useful and relevant to health care payers, consumers and our customers, we may not remain competitive and risk losing market share to existing competitors and disruptive new market entrants. We may face risks from new technologies and market entrants which could affect our existing relationship with health plan enrollees in these areas. We could sustain competitive disadvantages and loss of market share if we fail to continue developing innovative care models, including by accelerating the transition of care to value-based models that achieve higher quality outcomes and better experiences at lower costs and expand access to virtual and in-home care. Additionally, our competitive position could be adversely affected by any failure to develop and apply innovative technologies and other effective data and analytics capabilities or to provide services to our clients focused on these technologies and capabilities. Our business, results of operations, financial position and cash flows also could be materially and adversely affected if we do not compete effectively in our markets, if we set rates too high or too low in highly competitive markets, if we do not design and price our products properly and competitively, if we are unable to innovate and deliver products and services demonstrating value to our customers, if we do not provide a satisfactory level of services, if membership or demand for other services does not increase as we expect or declines, or if we lose accounts with more profitable products while retaining or increasing membership in accounts with less profitable products. The resumption of Medicaid redeterminations has impacted our membership levels and may impact our ability to maintain market share if we are unable to retain or add new consumers to other benefit offerings.

Our businesses face significant competition in all of the geographic markets in which we operate. In particular geographies or product segments, our competitors, compared to us, may have greater capabilities, resources or market share; a more established reputation; superior supplier or health care professional arrangements; better existing business relationships; lower profit margin or financial return expectations; or other factors which give such competitors a competitive advantage. Our competitive position may also be adversely affected by significant merger and acquisition activity in the industries in which we operate, both among our competitors and suppliers. Consolidation may make it more difficult for us to retain or increase our customer base, improve the terms on which we do business with our suppliers, or maintain or increase profitability. In addition, our success in the health care marketplace depends on our ability to develop and deliver innovative and potentially disruptive products and services to satisfy evolving market demands. If we do not continue to innovate and provide products and services, which are useful and relevant to health care payers, consumers and our customers, we may not remain competitive and risk losing market share to existing competitors and disruptive new market entrants. For example, new direct-to-consumer business models from competing businesses may make it more difficult for us to directly engage consumers in the selection and management of their health care benefits and health care usage. We may face challenges from new technologies and market entrants which could affect our existing relationship with health plan enrollees in these areas. Any failure by us to continue to develop innovative care models, including accelerating the transition of care to value-based models achieving higher quality outcomes and better experiences at lower costs and expanding access to virtual and in-home care, could result in competitive disadvantages and loss of market share. Additionally, our competitive position could be adversely affected by a failure to develop satisfactory data and analytics capabilities or provide services focused on these capabilities to our clients. Our business, results of operations, financial position and cash flows also could be materially and adversely affected if we do not compete effectively in our markets, if we set rates too high or too low in highly competitive markets, if we do not design and price our products properly and competitively, if we are unable to innovate and deliver products and services demonstrating value to our customers, if we do not provide a satisfactory level of services, if membership or demand for other services does not increase as we expect or declines, or if we lose accounts with more profitable products while retaining or increasing membership in accounts with less profitable products. The expected resumption of Medicaid redeterminations may also impact our ability to maintain market share if we are unable to retain or add new consumers to other benefit offerings. 12 12 12 Table of Contents Table of Contents

Our business depends on the integrity and timeliness of the data we use to serve our members, customers and health care professionals and to operate our business. If the data we rely upon to run our businesses is found to be inaccurate or unreliable or if we fail to effectively maintain or protect the integrity of our data and information systems, including systems powered by or incorporating artificial intelligence and machine learning (AI/ML), we could experience failures in our health, wellness and information technology products; lose existing customers; have difficulty attracting new customers; experience problems in determining medical cost estimates and establishing appropriate pricing; have difficulty preventing, detecting and controlling fraud; have disputes with customers, physicians and other health care professionals; become subject to regulatory sanctions, penalties, investigations or audits; incur increases in operating expenses; or suffer other adverse consequences. The volume of health care data generated, and the uses of data, including electronic health records, are rapidly expanding. We depend on the integrity of the data in our information systems to implement new and innovative services, automate and deploy new technologies to simplify administrative processes and clinical decision making, price our products and services adequately, provide effective service to our customers and consumers in an efficient and uninterrupted fashion, provide timely payments to care providers, and accurately report our results of operations. In addition, connectivity among technologies is becoming increasingly important and recent trends toward greater consumer engagement in health care require new and enhanced technologies, including more sophisticated applications for mobile devices and new tools and products that leverage AI/ML to improve the customer experience. We anticipate that fast-evolving AI/ML technologies, including generative AI, will play an increasingly important role in our information systems and customer-facing technology products. Our ability to protect and enhance existing systems and develop new systems to keep pace with changes in information processing technology (including AI/ML), regulatory standards and changing customer preferences will require an ongoing commitment of significant development and operational resources. If these commitments fail to provide the anticipated benefits, if we are unable to successfully anticipate future technology developments, or if the cost to keep pace with the technological changes exceed our estimates, we could be exposed to reputational harm and experience adverse effects on our business. We may not successfully implement our initiatives to consolidate the number of systems we operate, upgrade and expand our information systems’ capabilities, integrate and enhance our systems and develop new systems to keep pace with recent regulations and changes in information processing technology. Failure to protect, consolidate and integrate our systems successfully could result in higher than expected costs. Some of our businesses sell and install software products which may contain unexpected design defects or may encounter unexpected complications during installation or when used with other technologies utilized by the customer. A failure of our technology products to operate as intended and in a seamless fashion with other products could materially and adversely affect our results of operations, financial position and cash flows. Uncertain and rapidly evolving U.S. federal and state, non-U.S. and international laws and regulations related to health data and health information technologies, including those powered by or incorporating AI/ML, may alter the competitive landscape or impose new compliance requirements and could materially and adversely affect the configuration of our information systems and platforms, and our ability to compete in our markets.

Our business depends on the integrity and timeliness of the data we use to serve our members, customers and health care professionals and to operate our business. If the data we rely upon to run our businesses is found to be inaccurate or unreliable or if we fail to maintain or protect our information systems and data integrity effectively, we could experience failures in our health, wellness and information technology products; lose existing customers; have difficulty attracting new customers; experience problems in determining medical cost estimates and establishing appropriate pricing; have difficulty preventing, detecting and controlling fraud; have disputes with customers, physicians and other health care professionals; become subject to regulatory sanctions, penalties, investigations or audits; incur increases in operating expenses; or suffer other adverse consequences. The volume of health care data generated, and the uses of data, including electronic health records, are rapidly expanding. Our ability to implement new and innovative services, automate and deploy new technologies to simplify administrative processes and clinical decision making, price our products and services adequately, provide effective service to our customers and consumers in an efficient and uninterrupted fashion, provide timely payments to care providers, and report accurately our results of operations depends on the integrity of the data in our information systems. In addition, connectivity among technologies is becoming increasingly important and recent trends toward greater consumer engagement in health care require new and enhanced technologies, including more sophisticated applications for mobile devices. Our information systems require an ongoing commitment of significant resources to maintain, protect and enhance existing systems and develop new systems to keep pace with continuing changes in information processing technology, evolving systems and regulatory standards and changing customer preferences. We periodically consolidate, integrate, upgrade and expand our information systems’ capabilities as a result of technology initiatives, recently enacted regulations, changes in our system platforms and integration of new business acquisitions. Our process of consolidating the number of systems we operate, upgrading and expanding our information systems’ capabilities, enhancing our systems and developing new systems to keep pace with continuing changes in information processing technology may not be successful. Failure to protect, consolidate and integrate our systems successfully could result in higher than expected costs and diversion of management’s time and energy, which could materially and adversely affect our results of operations, financial position and cash flows. Certain of our businesses sell and install software products which may contain unexpected design defects or may encounter unexpected complications during installation or when used with other technologies utilized by the customer. A failure of our technology products to operate as intended and in a seamless fashion with other products could materially and adversely affect our results of operations, financial position and cash flows. Uncertain and rapidly evolving U.S. federal and state, non-U.S. and international laws and regulations related to health data and the health information technology market may alter the competitive landscape or present compliance challenges and could materially and adversely affect the configuration of our information systems and platforms, and our ability to compete in this market.

Market fluctuations could impair the value of our investment portfolio and our profitability. Volatility in interest rates affects our interest income and the market value of our investments in debt securities of varying maturities which constitute the substantial majority of the fair value of our investments as of December 31, 2023. In addition, a delay in payment of principal or interest by issuers, or defaults by issuers (primarily issuers of our investments in corporate and municipal bonds), could reduce our investment income and require us to write down the value of our investments which could adversely affect our profitability and equity. Our investments may not produce total positive returns and we may sell investments at prices which are less than their carrying values. Changes in the value of our investment assets, as a result of interest rate fluctuations, changes in issuer financial or market conditions, illiquidity or otherwise, could have an adverse effect on our equity. In addition, if it should become necessary for us to liquidate a material portion of our investment portfolio on an accelerated basis, such an action could have an adverse effect on our results of operations and the capital position of our regulated subsidiaries.

Market fluctuations could impair our profitability and capital position. Volatility in interest rates affects our interest income and the market value of our investments in debt securities of varying maturities which constitute the vast majority of the fair value of our investments as of December 31, 2022. In addition, a delay in payment of principal or interest by issuers, or defaults by issuers (primarily issuers of our investments in corporate and municipal bonds), could reduce our investment income and require us to write down the value of our investments which could adversely affect our profitability and equity. Our investments may not produce total positive returns and we may sell investments at prices which are less than their carrying values. Changes in the value of our investment assets, as a result of interest rate fluctuations, changes in issuer financial or market conditions, illiquidity or otherwise, could have an adverse effect on our equity. In addition, if it should become necessary for us to liquidate our investment portfolio on an accelerated basis, such an action could have an adverse effect on our results of operations and the capital position of our regulated subsidiaries.

The collection, maintenance, protection, use, transmission, disclosure and disposal of protected personal information are regulated at the federal, state, international and industry levels and addressed in requirements imposed on us by contracts with customers. Additionally, legislative and regulatory action in the United States at the federal, state and local levels, as well as internationally, is emerging in the areas of AI/ML and automation. These laws, regulations and requirements are subject to change. Compliance with new privacy, security, technology and data laws, regulations and requirements may result in increased operating costs, and may constrain or require us to alter our business model or operations. 19 19 19 Table of Contents Table of Contents Internationally, many of the jurisdictions in which we operate have established their own data security and privacy legal framework with which we or our customers must comply. We expect there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection, information security, and AI/ML and automation in the European Union, UK, Chile, India and other jurisdictions, and we cannot yet determine the impacts such future laws, regulations and standards may have on our businesses or the businesses of our customers. For example, the European Union’s General Data Protection Regulation (GDPR) imposes stringent European Union data protection requirements on us or our customers, and prescribes substantial penalties for noncompliance. Many of our businesses are also subject to the Payment Card Industry Data Security Standard, which is a multifaceted security standard designed to protect payment card account data. HIPAA requires business associates as well as covered entities to comply with specified privacy and security requirements. While we provide for appropriate protections through our contracts with our third-party service providers and in certain cases assess their security controls, we have limited oversight or control over their actions and practices. Several of our businesses act as business associates to their covered entity customers and, as a result, collect, use, disclose and maintain protected personal information in order to provide services to these customers. HHS administers its audit program to assess HIPAA compliance efforts by covered entities and business associates. An audit resulting in findings or allegations of noncompliance could damage our reputation and subject us to monetary and other sanctions. Through our Optum businesses, we maintain a database of administrative and clinical data statistically de-identified in accordance with HIPAA standards. Noncompliance or findings of noncompliance with applicable laws, regulations or requirements, or the occurrence of any privacy or security breach involving the misappropriation, loss or other unauthorized disclosure of protected personal information, whether by us or by one of our third-party service providers, could have a material adverse effect on our reputation and business and, among other consequences, could subject us to mandatory disclosure to the media, loss of existing or new customers, significant increases in the cost of managing and remediating privacy or security incidents, and material fines, penalties and litigation awards. Any of these consequences could have a material and adverse effect on our results of operations, financial position and cash flows. As an enterprise, we increasingly rely on new and evolving technologies, including those powered by or incorporating AI/ML, as part of our internal operations and in the delivery of our products and services. New technologies have potential and power to improve and optimize operational processes and clinical outcomes across the healthcare system, but also present ethical, technological, legal, regulatory and other risks. With respect to AI/ML, we have developed and implemented policies and procedures intended to promote and sustain responsible design, development, and use of AI/ML, consistent with industry best practices. Any inadequacy or failure in compliance with our responsible use of AI/ML policies and procedures or emerging laws, regulations and standards governing AI/ML use could cause our technology products not to operate as intended or to produce outcomes that could have a material and adverse effect on our business, reputation, results of operations, financial position and cash flows.

The collection, maintenance, protection, use, transmission, disclosure and disposal of protected personal information are regulated at the federal, state, international and industry levels and addressed in requirements imposed on us by contracts with customers. These laws, rules and requirements are subject to change. Compliance with new privacy and security laws, regulations and requirements may result in increased operating costs, and may constrain or require us to alter our business model or operations. Internationally, many of the jurisdictions in which we operate have established their own data security and privacy legal framework with which we or our customers must comply. We expect there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the European Union, Brazil, Chile, India and other jurisdictions, and we cannot yet determine the impacts such future laws, regulations and standards may have on our businesses or the businesses of our customers. For example, the European Union’s General Data Protection Regulation (GDPR) imposes more stringent European Union data protection requirements on us or our customers, and prescribes greater penalties for noncompliance. Brazilian privacy legislation, similar in certain respects to GDPR, took effect in September 2020. Many of our businesses are also subject to the Payment Card Industry Data Security Standard, which is a multifaceted security standard designed to protect payment card account data. HIPAA requires business associates as well as covered entities to comply with certain privacy and security requirements. While we provide for appropriate protections through our contracts with our third-party service providers and in certain cases assess their security controls, we have limited oversight or control over their actions and practices. Several of our businesses act as business associates to their covered entity customers and, as a result, collect, use, disclose and maintain protected personal information in order to provide services to these customers. HHS administers its audit program to assess HIPAA compliance efforts by covered entities and business associates. An audit resulting in findings or allegations of noncompliance could have a material adverse effect on our results of operations, financial position and cash flows. Through our Optum businesses, we maintain a database of administrative and clinical data statistically de-identified in accordance with HIPAA standards. Noncompliance or findings of noncompliance with applicable laws, regulations or requirements, or the occurrence of any privacy or security breach involving the misappropriation, loss or other unauthorized disclosure of protected personal information, whether by us or by one of our third-party service providers, could have a material adverse effect on our reputation and business and, among other consequences, could subject us to mandatory disclosure to the media, loss of existing or new customers, significant increases in the cost of managing and remediating privacy or security incidents, and material fines, penalties and litigation awards. Any of these consequences could have a material and adverse effect on our results of operations, financial position and cash flows.

Because we operate as a holding company, we are dependent on dividends and administrative expense reimbursements from our subsidiaries to fund our obligations. Many of these subsidiaries are regulated by state departments of insurance or similar regulatory authorities. We are also required by law or regulation to maintain specific prescribed minimum amounts of capital in these subsidiaries. The levels of capitalization required depend primarily on the volume of premium revenues generated by the applicable subsidiary. In most states, we are required to seek approval by state regulatory authorities before we transfer money or pay dividends from our regulated subsidiaries exceeding specified amounts. An inability of our regulated subsidiaries to pay dividends to their parent companies in the desired amounts or at the time of our choosing could adversely affect our ability to reinvest in our business through capital expenditures or business acquisitions, as well as our ability to maintain our corporate quarterly dividend payment, repurchase shares of our common stock and repay our debt. If we are unable to obtain sufficient funds from our subsidiaries to fund our obligations, our results of operations, financial position and cash flows could be materially and adversely affected.

Because we operate as a holding company, we are dependent on dividends and administrative expense reimbursements from our subsidiaries to fund our obligations. Many of these subsidiaries are regulated by state departments of insurance or similar regulatory authorities. We are also required by law or regulation to maintain specific prescribed minimum amounts of capital in these subsidiaries. The levels of capitalization required depend primarily on the volume of premium revenues generated by the applicable subsidiary. In most states, we are required to seek approval by state regulatory authorities before we transfer money or pay dividends from our regulated subsidiaries exceeding specified amounts. An inability of our regulated subsidiaries to pay dividends to their parent companies in the desired amounts or at the time of our choosing could adversely affect our ability to reinvest in our business through capital expenditures or business acquisitions, as well as our ability to maintain our corporate quarterly dividend payment, repurchase shares of our common stock and repay our debt. If we are unable to obtain sufficient funds from our subsidiaries to fund our obligations, our results of operations, financial position and cash flows could be materially and adversely affected.

Claims paying ability, financial strength and debt ratings by nationally recognized statistical rating organizations are important factors in establishing the competitive position of insurance companies. Ratings information is broadly disseminated and generally used by customers and creditors. We believe our claims paying ability and financial strength ratings are important factors in marketing our products to certain of our customers. Our credit ratings impact both the cost and availability of future borrowings. Each of the credit rating agencies reviews its ratings periodically. Our ratings reflect each credit rating agency’s opinion of our financial strength, operating performance and ability to meet our debt obligations or obligations to policyholders. We may not be able to maintain our current credit ratings in the future. Any downgrades in our credit ratings could materially increase our costs of or ability to access funds in the debt capital markets and otherwise materially increase our operating costs. 16 16 16 Table of Contents Table of Contents

Claims paying ability, financial strength and debt ratings by nationally recognized statistical rating organizations are important factors in establishing the competitive position of insurance companies. Ratings information is broadly disseminated and generally used by customers and creditors. We believe our claims paying ability and financial strength ratings are important factors in marketing our products to certain of our customers. Our credit ratings impact both the cost and availability of future borrowings. Each of the credit rating agencies reviews its ratings periodically. Our ratings reflect each credit rating agency’s opinion of our financial strength, operating performance and ability to meet our debt obligations or obligations to policyholders. We may not be able to maintain our current credit ratings in the future. Any downgrades in our credit ratings could materially increase our costs of or ability to access funds in the debt capital markets and otherwise materially increase our operating costs.

As part of our business strategy, we frequently engage in discussions with third parties regarding possible investments, acquisitions, divestitures, strategic alliances, joint ventures and outsourcing transactions and often enter into agreements relating to such transactions. If we fail to meet the needs of our alliance or joint venture partners, including by developing additional products and services, providing high levels of service, pricing our products and services competitively or responding effectively to applicable federal and state regulatory changes, our alliances and joint ventures could be damaged or terminated, which in turn could adversely impact our reputation, business and results of operations. Further, governmental actions, such as actions by the FTC or DOJ, may affect our ability to complete strategic transactions, which could adversely affect our future growth. If we fail to identify and successfully complete transactions to meet our strategic objectives, including as a result of antitrust regulatory enforcement actions, such as those that have been brought against us in the past, we may be required to expend resources to develop products and technology internally, be placed at a competitive disadvantage or be adversely affected by negative market perceptions, any of which may have a material adverse effect on our results of operations, financial position or cash flows. Successful acquisitions also require us to effectively integrate the acquired business into our existing operations, including our internal control environment and culture, or otherwise leveraging its operations which may present risks different from those presented by organic growth and may be difficult for us to manage. In addition, even with appropriate diligence, pre-acquisition practices of an acquired business have in the past and may in the future expose us to legal challenges and investigations that could subject us to criminal fines or reputational harm. Even if we are ultimately successful, defending such claims may be costly and result in negative publicity. If we cannot successfully integrate our acquired businesses and realize contemplated revenue growth opportunities, cost savings and other synergies, our business, prospects, results of operations, financial position and cash flows could be materially and adversely affected. As we operate our business outside of the United States, we face risks different from those presented by acquisitions of domestic businesses, including risks in adapting to new markets, languages, business, labor and cultural practices and regulatory environments. Managing these risks could require us to devote significant senior management attention and other resources to the acquired businesses before we realize anticipated synergies or other benefits from those businesses. These risks vary widely by country and, outside of the United States, may include political instability, government intervention, unanticipated court decisions, discriminatory regulation and currency exchange controls or other restrictions, which could prevent us from transferring funds from these operations out of the countries in which our acquired businesses operate, or converting local currencies we hold into U.S. dollars or other currencies. 14 14 14 Table of Contents Table of Contents Foreign currency exchange rates and fluctuations have had and may in future periods have an impact on our shareholders’ equity from period to period, which could adversely affect our debt to debt-plus-equity ratio, and our future revenues, costs and cash flows from international operations. Any measures we may implement to reduce the effect of volatile currencies may be costly or ineffective.

As part of our business strategy, we frequently engage in discussions with third parties regarding possible investments, acquisitions, divestitures, strategic alliances, joint ventures and outsourcing transactions and often enter into agreements relating to such transactions. For example, we have a strategic alliance with AARP under which we provide AARP-branded Medicare Supplement insurance to AARP members and other AARP-branded products and services to Medicare beneficiaries. If we fail to meet the needs of our alliance or joint venture partners, including by developing additional products and services, providing high levels of service, pricing our products and services competitively or responding effectively to applicable federal and state regulatory changes, our alliances and joint ventures could be damaged or terminated, which in turn could adversely impact our reputation, business and results of operations. Further, governmental actions, such as actions by the FTC or DOJ, may affect our ability to complete our merger and acquisition transactions, which could adversely affect our future growth. If we fail to identify and successfully complete transactions to meet our strategic objectives, we may be required to expend resources to develop products and technology internally, be placed at a competitive disadvantage or we may be adversely affected by negative market perceptions, any of which may have a material adverse effect on our results of operations, financial position or cash flows. Successful acquisitions are also dependent on effectively integrating the acquired business into our existing operations, including our internal control environment and culture, or otherwise leveraging its operations which may present challenges different from those presented by organic growth and may be difficult for us to manage. In addition, even with appropriate diligence, pre-acquisition practices of an acquired business may expose us to legal challenges and investigations. For example, in January 2021, an indictment for alleged violations of antitrust laws was issued by the DOJ against our subsidiary, Surgical Care Affiliates (SCA), based on conduct alleged to have begun more than five years prior to our acquisition of SCA. We are vigorously defending this lawsuit, but if SCA is found liable, we may be subject to criminal fines or reputational harm. If we 14 14 14 Table of Contents Table of Contents cannot successfully integrate our acquired businesses and realize contemplated revenue growth opportunities, cost savings and other synergies, our business, prospects, results of operations, financial position and cash flows could be materially and adversely affected. As we expand and operate our business outside of the United States, we are presented with challenges differing from those presented by acquisitions of domestic businesses, including challenges in adapting to new markets, languages, business, labor and cultural practices and regulatory environments. Adapting to these challenges could require us to devote significant senior management attention and other resources to the acquired businesses before we realize anticipated synergies or other benefits from those businesses. These challenges vary widely by country and, outside of the United States, may include political instability, government intervention, discriminatory regulation and currency exchange controls or other restrictions, which could prevent us from transferring funds from these operations out of the countries in which our acquired businesses operate, or converting local currencies we hold into U.S. dollars or other currencies. If we are unable to manage successfully our non-U.S. acquisitions, our business, prospects, results of operations and financial position could be materially and adversely affected. Foreign currency exchange rates and fluctuations may have an impact on our shareholders’ equity from period to period, which could adversely affect our debt to debt-plus-equity ratio, and our future revenues, costs and cash flows from international operations. Any measures we may implement to reduce the effect of volatile currencies may be costly or ineffective.

Through our risk-based benefit products, we assume the risk of both medical and administrative costs for our customers in return for monthly premiums. We generally use approximately 80% to 85% of our premium revenues to pay the costs of health care services delivered to these customers. The profitability of our products depends in large part on our ability to predict and effectively price for and manage medical costs. Our Optum Health business also enters into fully accountable value-based arrangements with payers. Premium revenues from risk-based products constitute nearly 80% of our total consolidated revenues. Estimates of benefit expense payments involve extensive judgement and are subject to considerable inherent variability. Relatively small differences between predicted and actual medical costs, or utilization rates as a percentage of revenues, can result in significant changes in our financial results. If we fail to predict accurately, or effectively price for or manage, the costs of providing care under risk-based arrangements, our results of operations could be materially and adversely affected. We manage medical costs through underwriting criteria, product design, negotiation of competitive provider contracts and care management programs. Total medical costs are affected by the number of individual services rendered, the cost of each service and the type of service rendered. Although we base the premiums we charge on our estimates of future medical costs over the fixed contract period, many factors may cause, and have previously caused, actual costs to exceed those estimated and reflected in premiums or bids. These factors may include medical cost inflation, increased use of services, business mix, unexpected differences among new customer populations, increased cost of individual services, costs to deliver care, large-scale medical emergencies, the potential effects of climate change, pandemics, the introduction of new or costly drugs or increases in drug prices, treatments and technology, new treatment guidelines, newly mandated benefits or other regulatory changes and insured population characteristics. Cost increases in excess of our forecasts typically cannot be recovered in the fixed premium period through higher premiums. For Optum Health’s fully accountable value-based care, any inability to provide higher-quality outcomes and better experiences at lower costs or to integrate our care delivery models could impact our results of operations, financial positions and cash flows. 10 10 10 Table of Contents Table of Contents In addition, the financial results we report for any particular period include estimates of costs incurred for which claims are still outstanding. These estimates involve an extensive degree of judgment. If these estimates prove inaccurate, our results of operations could be materially and adversely affected.

Through our risk-based benefit products, we assume the risk of both medical and administrative costs for our customers in return for monthly premiums. We generally use approximately 80% to 85% of our premium revenues to pay the costs of health care services delivered to these customers. The profitability of our products depends in large part on our ability to predict, price for and effectively manage medical costs. Our Optum Health business also enters into fully accountable value-based arrangements with payers. Premium revenues from risk-based products comprise nearly 80% of our total consolidated revenues. If we fail to predict accurately, or effectively price for or manage, the costs of providing care under risk-based arrangements, our results of operations could be materially and adversely affected. We manage medical costs through underwriting criteria, product design, negotiation of competitive provider contracts and care management programs. Total medical costs are affected by the number of individual services rendered, the cost of each service and the type of service rendered. Our premium revenue on commercial policies and Medicaid contracts is typically based on a fixed monthly rate per individual or family served for a 12-month period and is generally priced one to six months before the contract commences. Our revenue on certain Medicare policies is based on bids submitted to CMS in June of the year before the contract year. Our premium revenue on fully accountable value-based care products at Optum Health is typically based on a fixed monthly rate per individual served. Although we base the commercial, Medicaid and value-based premiums we charge and our Medicare bids on our estimates of future medical costs over the fixed contract period, many factors may cause actual costs to exceed those estimated and reflected in premiums or bids. These factors may include medical cost inflation, increased use of services, increased cost of individual services, costs to deliver care, large-scale medical emergencies, the potential effects of climate change, pandemics, the introduction of new or costly drugs, treatments and technology, new treatment guidelines, newly mandated benefits or other regulatory changes and insured population characteristics. For Optum Health’s fully accountable value-based care, our inability to provide higher-quality outcomes and better experiences at lower costs or our 10 10 10 Table of Contents Table of Contents inability to integrate our care delivery models could impact our results of operations, financial positions and cash flows. Relatively small differences between predicted and actual medical costs or utilization rates as a percentage of revenues can result in significant changes in our financial results. In addition, the financial results we report for any particular period include estimates of costs incurred for which claims are still outstanding. These estimates involve an extensive degree of judgment. If these estimates prove inaccurate, our results of operations could be materially and adversely affected.

We routinely process, store and transmit large amounts of data in our operations, including protected personal information subject to privacy, security or data breach notification laws, as well as proprietary or confidential information relating to our business or third parties. Some of the data we process, store and transmit may be outside of the United States due to our information technology systems and international business operations. We are regularly the target of attempted cyber-attacks and other security threats and have previously been, and may in the future be, subject to compromises of the information technology systems we use, information we hold, or information held on our behalf by third parties. While we have programs in place to detect, contain and respond to data security incidents and provide employee awareness training regarding phishing, malware and other cyber threats to protect against cyber risks and security incidents, we expect that we will continue to experience these incidents, some of which may negatively affect our business. Further, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are increasing in sophistication, in part due to use of evolving AI/ML technologies (including generative AI), and because our businesses are changing as well, we 11 11 11 Table of Contents Table of Contents may be unable to anticipate these techniques and threats, detect data security incidents or implement adequate preventive measures. Threat actors and hackers have previously been, and may in the future be, able to negatively affect our operations by penetrating our security controls and causing system and operational disruptions or shutdowns, accessing, misappropriating or otherwise compromising protected personal information or proprietary or confidential information or that of third parties, and developing and deploying viruses, ransomware and other malware that can attack our systems, exploit any security vulnerabilities, and disrupt or shutdown our systems and operations. In addition, hardware, software, or applications we develop or procure from third parties may contain defects or other problems which could unexpectedly compromise our information security controls. Our systems may also be vulnerable to financial fraud schemes, misplaced or lost data, human error, malicious social engineering, or other events which could negatively affect the data or financial accounts, proprietary or confidential information relating to our business or third parties, or our operations. There have previously been and may be in the future heightened vulnerabilities due to the lack of physical supervision and on-site infrastructure for remote workforce operations and for recently-acquired or non-integrated businesses. We rely in some circumstances on third-party vendors to process, store and transmit large amounts of data for our business whose operations are subject to similar risks. The costs to eliminate or address the foregoing security threats and vulnerabilities before or after a cyber-incident could be material. We have business continuation and resiliency plans which are maintained, updated and tested regularly in an effort to contain and remediate potential disruptions or cyber events. If our remediation efforts are not successful, we may experience operational interruptions, delays, or cessation of service and loss of existing or potential customers. In addition, compromises of our security measures or the unauthorized dissemination of sensitive personal information, proprietary information or confidential information about us, our customers or other third parties, previously and in the future, could expose us or them to the risk of financial or medical identity theft, negative operational affects, expose us or them to a risk of loss or misuse of this information, result in litigation and liability, including regulatory penalties, for us, damage our brand and reputation, or otherwise harm our business.

We routinely process, store and transmit large amounts of data in our operations, including protected personal information subject to privacy, security or data breach notification laws, as well as proprietary or confidential information relating to our business or third parties. Some of the data we process, store and transmit may be outside of the United States due to our information technology systems and international business operations. We are regularly the target of attempted cyber-attacks and other security threats and may be subject to breaches of the information technology systems we use. We have programs in place to detect, contain and respond to data security incidents and provide employee awareness training regarding phishing, malware and other cyber risks to protect against cyber risks and security breaches. However, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are increasing in 11 11 11 Table of Contents Table of Contents sophistication, we may be unable to anticipate these techniques, detect breaches for long periods of time or implement adequate preventive measures. Experienced computer programmers and hackers may be able to penetrate our security controls and access, misappropriate or otherwise compromise protected personal information or proprietary or confidential information or that of third parties, create system disruptions or cause system shutdowns, negatively affecting our operations. They also may be able to develop and deploy viruses, worms and other malicious software programs attacking our systems or otherwise exploit any security vulnerabilities. Hardware, software, or applications we develop or procure from third parties may contain defects in design or manufacture or other problems which could unexpectedly compromise information security. Our facilities and services may also be vulnerable to security incidents or security attacks; acts of vandalism or theft; coordinated attacks by activist entities; financial fraud schemes; misplaced or lost data; human error; malicious social engineering; or other events which could negatively affect our systems, our customers’ data, proprietary or confidential information relating to our business or third parties, or our operations. Moreover, there has been an increase in new financial fraud schemes and ransomware attacks on large companies, whereby cybercriminals install malicious software preventing users or the enterprise from accessing computer files, systems or networks and demand payment of a ransom for return of access. In addition, there may be a heightened vulnerability due to the lack of physical supervision and on-site infrastructure for remote workforce operations. In certain circumstances we may rely on third-party vendors to process, store and transmit large amounts of data for our business whose operations are subject to similar risks. The costs to eliminate or address the foregoing security threats and vulnerabilities before or after a cyber-incident could be material. We have business continuation and resiliency plans which are maintained, updated and tested regularly in an effort to ensure successful containment and remediation of potential disruptions or cyber events. In the event that our remediation efforts may not be successful, it could result in interruptions, delays, or cessation of service and loss of existing or potential customers. In addition, breaches of our security measures and the unauthorized dissemination of sensitive personal information, proprietary information or confidential information about us or our customers or other third parties, could expose our customers’ private information and our customers to the risk of financial or medical identity theft, or expose us or other third parties to a risk of loss or misuse of this information, result in litigation and liability, including regulatory penalties, for us, damage our brand and reputation, or otherwise harm our business.

We rely on our agreements with customers, confidentiality agreements with employees and third parties, and our trademarks, trade secrets, copyrights and patents to protect our proprietary rights. These legal protections and precautions may not prevent misappropriation of our proprietary information. In addition, intellectual property rights inherent in software are the subject of substantial litigation, and we expect our software products to be increasingly subject to third-party infringement claims as the number of products and competitors in the health care-focused software industry segment grows. Such litigation and misappropriation of our proprietary information could hinder our ability to market and sell products and services which could materially and adversely affect our results of operations, financial position and cash flows.

We rely on our agreements with customers, confidentiality agreements with employees and third parties, and our trademarks, trade secrets, copyrights and patents to protect our proprietary rights. These legal protections and precautions may not prevent misappropriation of our proprietary information. In addition, substantial litigation regarding intellectual property rights exists in the software industry, and we expect software products to be increasingly subject to third-party infringement claims as the number of products and competitors in this industry segment grows. Such litigation and misappropriation of our proprietary information could hinder our ability to market and sell products and services which could materially and adversely affect our results of operations, financial position and cash flows. 16 16 16 Table of Contents Table of Contents

Unfavorable economic conditions may have a range of impacts on the demand for our products and services. Such conditions also have caused and in future periods could continue to cause employers to stop offering certain health care coverage as an employee benefit or elect to offer particular coverage on a voluntary, employee-funded basis to reduce their operating costs. In addition, unfavorable economic conditions could adversely impact our ability to increase premiums or result in the cancellation by certain customers of our products and services. These conditions could lead to a decrease in people served and in the premium and fee revenues we generate. A prolonged unfavorable economic environment could constrain state and federal budgets and result in reduced reimbursements or payments in our federal and state government health care coverage programs, including Medicare, Medicaid and CHIP. A reduction in state Medicaid reimbursement rates could be implemented retroactively to apply to payments already negotiated or received from the government. In addition, state and federal budgetary pressures could cause the affected governments to impose new or a higher level of taxes or assessments for our commercial programs, such as premium taxes on health insurance and surcharges or fees on select fee-for-service and capitated medical claims. Any of these developments or actions could materially and adversely affect our results of operations, financial position and cash flows. A prolonged unfavorable economic environment could also adversely impact the financial position of hospitals and other care providers which could negatively affect our contracted rates with these parties and increase our medical costs or materially and adversely affect their ability to purchase our service offerings. Further, unfavorable economic conditions could have a material adverse effect on our financial results by impacting the customers of our Optum businesses, including health plans, hospitals, care providers, employers and others.

Unfavorable economic conditions may impact demand for certain of our products and services. Unfavorable economic conditions also have caused and could continue to cause employers to stop offering certain health care coverage as an employee benefit or elect to offer this coverage on a voluntary, employee-funded basis to reduce their operating costs. In addition, unfavorable economic conditions could adversely impact our ability to increase premiums or result in the cancellation by certain customers of our products and services. These conditions could lead to a decrease in people served and premium and fee revenues and could materially and adversely affect our results of operations, financial position and cash flows. During a prolonged unfavorable economic environment, state and federal budgets could be materially and adversely affected, resulting in reduced reimbursements or payments in our federal and state government health care coverage programs, including Medicare, Medicaid and CHIP. A reduction in state Medicaid reimbursement rates could be implemented retroactively to apply to payments already negotiated or received from the government and could materially and adversely affect our results of operations, financial position and cash flows. In addition, state and federal budgetary pressures could cause the affected governments to impose new or a higher level of taxes or assessments for our commercial programs, such as premium taxes on health insurance and surcharges or fees on select fee-for-service and capitated medical claims. Any of these developments or actions could materially and adversely affect our results of operations, financial position and cash flows. 15 15 15 Table of Contents Table of Contents A prolonged unfavorable economic environment could also adversely impact the financial position of hospitals and other care providers which could materially and adversely affect our contracted rates with these parties and increase our medical costs or materially and adversely affect their ability to purchase our service offerings. Further, unfavorable economic conditions could adversely impact the customers of our Optum businesses, including health plans, hospitals, care providers, employers and others which could, in turn, materially and adversely affect Optum’s financial results.